Data processing agreement

This data processing agreement ("DPA") sets out the terms under which Acurcio (ACurcio Webservices), CVR 46182162, Jægersborggade 44, 1. th, 2200 København N, Denmark (the "Processor") processes personal data on behalf of the customer (the "Controller").

The DPA forms part of the agreement between the parties on website services (the "Agreement") and is accepted together with it. The Controller is the customer named in the Agreement.

The DPA is entered into to meet the requirements of Article 28(3) of Regulation (EU) 2016/679 (the "GDPR") and the Danish Data Protection Act (databeskyttelsesloven).

The processing is described in Appendix A, the approved sub-processors are listed in Appendix B, and the security measures are described in Appendix C.

If the DPA and the Agreement conflict on the processing of personal data, the DPA takes precedence.

The Controller decides the purposes and means of the processing and is responsible for it being lawful, including having a legal basis, informing data subjects and maintaining the website’s privacy policy.

The Controller must tell the Processor in writing before the website is used to process special categories of personal data (Article 9 GDPR), such as health data, or data about criminal offences, so that the parties can agree on the necessary measures.

The Processor processes personal data only on documented instructions from the Controller, unless EU or Danish law requires otherwise. In that case the Processor informs the Controller before the processing, unless that law prohibits it.

The Agreement and this DPA, including Appendix A, are the Controller’s instructions. Further instructions must be given in writing; work that goes beyond the Agreement is invoiced at the Processor’s hourly rate.

The Processor informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

The Processor gives access to the personal data only to persons who need it to perform the Agreement and who have committed themselves to confidentiality or are under a statutory duty of confidentiality.

The Processor implements appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of data subjects.

The measures are described in Appendix C. The Processor may change them as long as the overall level of security is not reduced.

The Controller gives the Processor general authorisation to use sub-processors. The sub-processors approved when the DPA is entered into are listed in Appendix B.

The Processor notifies the Controller in writing at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable grounds within that period. If the parties cannot agree, the Controller may have the website moved to its own accounts as described in clause 6.8 of our terms and conditions.

The Processor imposes the same data protection obligations on each sub-processor as those in this DPA, by contract, and remains fully responsible to the Controller for the sub-processor’s compliance.

Personal data is transferred to countries outside the EU/EEA only as described in Appendix B, and only in compliance with Chapter V GDPR — for example on the basis of an adequacy decision, including the EU-U.S. Data Privacy Framework, or the European Commission’s standard contractual clauses.

Taking into account the nature of the processing, the Processor assists the Controller, as far as possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR, such as access, rectification and erasure.

The Processor assists the Controller in meeting its obligations under Articles 32 to 36 GDPR — security, notification of personal data breaches, data protection impact assessments and prior consultation — taking into account the information available to the Processor.

Assistance beyond what reasonably follows from the Agreement is invoiced at the Processor’s hourly rate.

The Processor notifies the Controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach.

The notification describes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, so that the Controller can notify the Danish Data Protection Agency (Datatilsynet) within 72 hours where required.

When the processing services end, the Processor, at the Controller’s choice, deletes or returns all personal data and deletes existing copies, unless EU or Danish law requires the data to be stored.

If the website is moved to the Controller’s own accounts, the personal data stored as part of the website is handed over with it, and the Processor then deletes its copies.

If the website is taken offline under clause 6.10 of our terms and conditions, personal data in the retained copy is kept only for the period stated there and is then deleted.

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by the Controller.

Audits are announced at least 30 days in advance. Each party bears its own costs, and the Processor’s time is invoiced at its hourly rate. This does not limit the access of supervisory authorities.

The liability provisions of the Agreement apply to this DPA, without prejudice to the rights of data subjects under Article 82 GDPR.

The DPA enters into force with the Agreement and remains in force for as long as the Processor processes personal data on behalf of the Controller. It cannot be terminated separately while that processing continues.

The DPA is governed by Danish law, and disputes are settled as described in the Agreement. It is available in English and Danish; the English version is legally binding.

Purpose: hosting and operating the Controller’s website, including the features agreed in the Agreement, such as contact and booking forms and the AI support chatbot.

Nature of the processing: storage and transmission of data, including forwarding form submissions to the Controller by email; technical processing in server logs; and, for the AI support chatbot, processing of chat messages to generate replies.

Types of personal data:

• contact details submitted through forms, such as name, email address, phone number and company;
• the content of messages and chat conversations, which may contain any information the data subject chooses to write;
• technical data such as IP address, browser information and time stamps in server logs.

Categories of data subjects: visitors to the website, people who contact the Controller through the website, and the Controller’s customers and employees where they use the website.

Duration: for as long as the Processor hosts the website or operates its features. Form submissions are forwarded to the Controller and are kept by the Processor and its sub-processors only as long as needed for delivery and logging.

Location: the EU/EEA, except as stated in Appendix B.

The Processor uses the following sub-processors:

• Vercel Inc. (USA) — hosting and delivery of the website, including server logs. Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or the European Commission’s standard contractual clauses.
• Scaleway SAS (France, EU) — hosting and operation of the AI support chatbot, where it is part of the Agreement.
• Resend (USA) — sending email from the website’s forms, where they are part of the Agreement. Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or the European Commission’s standard contractual clauses.

A sub-processor only processes the Controller’s personal data if it is used for a feature on the Controller’s website.

Encryption: all traffic to and from the website is encrypted with TLS (https), and the sub-processors encrypt stored data.

Access control: access to hosting accounts, admin areas and source code is limited to the Processor’s staff who need it, using personal accounts with two-factor authentication.

Data minimisation: forms only ask for the information needed, and form submissions are forwarded to the Controller rather than stored in a database, unless the Agreement states otherwise.

Maintenance: software and dependencies are kept up to date, and security updates are applied without undue delay.

Recovery: the website’s code and content are kept under version control, so the website can be restored in the event of an incident.

Sub-processors: chosen among established providers with recognised security practices, and bound by data processing terms that meet Article 28 GDPR.