Data Processing Agreement
Pursuant to Article 28 of the General Data Protection Regulation (GDPR).
1. Background
An “Engagement Agreement for Accounting Assignments” (the “Agreement”) has been entered into between ECONOMY REGNSKAP AS (the “Accounting Firm”) and the Customer (each a “Party”, together the “Parties”).
Carrying out the assignment means that the Accounting Firm Processes Personal Data on behalf of the Customer. The Accounting Firm thereby acts as Processor for the Customer as Controller.
The purpose of this data processing agreement is to regulate the Accounting Firm’s Processing of Personal Data on behalf of the Customer, and thereby ensure that the Processing takes place in accordance with the Norwegian Personal Data Act (personopplysningsloven, LOV-2018-06-15-38), including the EU General Data Protection Regulation (EU/2016/679), and subsequent legislation replacing or supplementing these (the “Data Protection Legislation”).
The definitions in Article 4 of the General Data Protection Regulation apply correspondingly to terms used in this data processing agreement.
2. Purpose and nature of the processing
The purpose of the Accounting Firm’s Processing of Personal Data is to carry out the accounting assignment in accordance with the Agreement, including Regnskap Norge’s standard delivery terms for accounting assignments (the “Standard Terms”).
Appendix 1 to this document describes the specific purposes of the Processing, as well as the categories of Personal Data and Data Subjects concerned.
The data processing agreement does not apply to Processing of Personal Data carried out for the Accounting Firm’s own purposes. This also includes Processing necessary to fulfil obligations imposed on the Accounting Firm by law. For such Processing, the Accounting Firm is itself the Controller.
3. The Accounting Firm’s obligations
3.1 Restriction on use and duty to notify
The Accounting Firm shall only Process Personal Data in accordance with documented instructions from the Customer, including in the Agreement and in Appendix 1 to this data processing agreement.
If the Accounting Firm considers that an instruction from the Customer, cf. the first paragraph, is in breach of the Data Protection Legislation, the Customer shall be notified of this.
The Accounting Firm must notify the Customer without undue delay if the Accounting Firm will not be able to comply with its obligations under this data processing agreement.
3.2 Disclosure and duty of confidentiality
The Accounting Firm shall not disclose Personal Data to Third Parties unless the Customer has consented in writing in advance to such disclosure, or the Accounting Firm is legally obliged to disclose the Personal Data. Disclosure to other Processors shall take place in accordance with the terms in section 4 of this data processing agreement.
The provision on the duty of confidentiality in section 1.6 of the Standard Terms also applies to Personal Data Processed under the Agreement.
3.3 Information security and breach notifications
The Accounting Firm shall take all measures necessary to establish an appropriate level of security in the Processing in accordance with the requirements of Article 32 of the General Data Protection Regulation. The measures shall be documented.
The Accounting Firm shall notify the Customer without undue delay of any Personal Data Breach that has led to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to the Personal Data Processed under this data processing agreement. The notification shall contain the information required under Article 33(3) of the General Data Protection Regulation.
The Accounting Firm shall immediately take measures to prevent or limit the consequences of the security breach.
3.4 Use of locally hosted AI models
The Accounting Firm may use open-source AI models as decision support when performing the accounting assignment, provided that the models run locally on equipment under the Accounting Firm’s control or on servers that the Accounting Firm itself has at its disposal and controls.
Personal data, accounting data, documents, prompts and generated responses shall not be transferred or made available to external AI providers, external model APIs or other third parties. The solution shall be technically configured so that processing takes place in the controlled operating environment without external data transfer, and the data shall not be used for training or further development of models without specific documented instructions from the Customer and a valid legal basis for processing.
The Accounting Firm shall document access control, logging, storage, deletion, security updates and other technical and organisational measures for the AI solution. The use of AI is solely decision support. Professional assessments, bookkeeping, reporting and submissions shall be checked and approved by authorised personnel before they are relied on in the assignment.
3.5 Duty to assist
The Accounting Firm shall assist the Customer in complying with the requirements of Articles 32 to 36 of the General Data Protection Regulation on information security.
The Accounting Firm shall also assist the Customer in fulfilling the Customer’s obligation to respond to requests from Data Subjects wishing to exercise their rights under the Regulation. The Accounting Firm shall not itself respond to such requests, but shall without undue delay forward the request to the Customer or refer the Data Subject to contact the Customer directly.
3.6 Access to information and security audits
The Accounting Firm shall, on request, give the Customer access to all information and documentation necessary to demonstrate that the Processing takes place in accordance with this data processing agreement and the Customer’s instructions.
If the Customer discovers deviations, the Accounting Firm shall implement corrective measures without undue delay.
4. Terms for the use of other data processors
The Customer consents to the Accounting Firm entrusting the Personal Data Processed under the Agreement to other Processors (subcontractors) listed in Appendix 2 to this document.
Before new Processors are engaged in the Processing, the Customer shall be given written notice no later than two weeks before the Personal Data is entrusted to the new Processor. The notice shall contain information about where the Processing will take place, cf. section 5 of this data processing agreement.
The Customer shall be able to object to the Personal Data being entrusted to new Processors. In that case, the Parties shall loyally try to agree on a solution acceptable to both Parties. If this is not successful, the Agreement may be terminated by either Party in accordance with section 12 of the Standard Terms.
The Accounting Firm shall enter into a written agreement with its Processors imposing on them the same obligations that the Accounting Firm itself has under this data processing agreement. The Accounting Firm is fully liable to the Customer for the Processing carried out by the Processor.
5. Terms for transfer outside the EU/EEA
Personal Data may only be transferred to countries outside the EU/EEA if the Customer has given prior consent to this.
The Customer consents to transfers outside the EU/EEA that take place in connection with the Personal Data being entrusted to existing Processors, on the terms set out in Appendix 2 to this document.
Prior consent under this provision also includes the absence of objections to the Processing being entrusted to a Processor that Processes the Personal Data outside the EU/EEA, cf. section 4 of this data processing agreement.
6. Deletion and return of personal data
Upon termination of the Agreement, the Accounting Firm is obliged to return, delete or anonymise all Personal Data in accordance with the Customer’s detailed instructions at the time of termination. The Parties shall loyally agree on the practical implementation of this obligation in a way that safeguards both Parties’ need to meet statutory requirements and ensure day-to-day operations.
In any event, the deletion obligation does not apply to Personal Data forming part of the Accounting Firm’s own engagement documentation, cf. section 2, third paragraph, of this data processing agreement.
7. Duration and amendments to the data processing agreement
The data processing agreement applies for as long as the Accounting Firm processes personal data on behalf of the Customer. The duty of confidentiality applies indefinitely.
The data processing agreement may be amended as needed and by agreement between the parties in accordance with section 7 of the Standard Terms.
8. Notices and other communication
Notices and other communication under this data processing agreement shall take place in accordance with section 1.4 of the Standard Terms.
9. Governing law and venue
Governing law and venue are regulated in section 15 of the Standard Terms.
Appendix 1 Categories of Personal Data and purposes of processing
| Personal data | Purpose of the data |
|---|---|
| First and last name | Identification for correct payment of salary and remuneration, including travel expense reports and outlays. Identification for events related to the employment relationship and identification for other mandatory public reporting. |
| Home address | Communication. |
| Work address | Public and internal reporting. |
| Citizenship | A-melding (payroll report to the authorities) and to ensure correct benefits and deductions. |
| Country of residence | A-melding and to ensure correct benefits and deductions. |
| Telephone number (landline) | Communication. |
| Telephone number (mobile) | Communication. |
| E-mail address | Communication. |
| Date of birth / national ID number | Identification for payment of salary and remuneration, including travel expense reports and outlays, employment relationship, other mandatory public reporting. |
| Gender | Statistical purposes for the board’s annual report, internal reporting, etc. |
| Employee number / employment relationship ID | A-melding. Internal identification and categorisation for allocation in departmental accounts, etc. |
| Bank account number | To ensure correct payment of salary and other benefits. |
| Marital status | To ensure correct benefits and deductions affected by marital status. |
| Spouse, including name and national ID number | To ensure correct tax reporting of salary matters, financial position, etc. |
| Next-of-kin information | Communication with next of kin regarding specific matters in the event of acute illness, death, etc. |
| Job title / occupation code | A-melding and to ensure correct payment of salary. |
| Position level, including position percentage and hours per week. Date of last change. | A-melding and to ensure correct payment of salary. |
| Working time arrangement | A-melding and to ensure correct payment of salary. |
| Occupational information of relevance to salary and working conditions | A-melding and to ensure correct payment of salary. |
| Education and experience, including salary seniority. | A-melding and to ensure correct benefits and deductions. |
| Membership of trade unions and other occupation-related associations. | To ensure correct benefits and deductions. |
| Covered by collective agreement, including pay grade | To ensure correct benefits and deductions. |
| Salary and commission information, including type of remuneration and last date of payment. | A-melding and to ensure correct payment of salary. |
| Pension information | To ensure correct pension contributions and pension benefits. |
| Tax deduction information | To ensure correct tax deduction. |
| Insurance matters, including scope of cover and necessary health information (self-declarations, etc.) | To ensure correct insurance cover under the agreement between employer and insurance company. |
| Absence and leave, including type and duration. | To ensure correct benefits and deductions. Mandatory public reporting of sick pay, leave allowance, etc. |
| Start and end date of employment, including start and end dates in the event of merger and demerger. | The A-melding, salary calculations and insurance arrangements. Following up anniversaries, etc. |
| Reason for termination, including resignation and death. | To ensure correct benefits and deductions. Statistical purposes. |
| Company car and other benefits in kind | To ensure correct accounting reporting and reporting of benefits. Insurance coverage purposes. |
| Ownership interests in the company | Shareholder register notifications |
| Role in the company | To ensure correct benefits and deductions. Internal reporting purposes. A-melding. To ensure correct information in the annual accounts. |
| Terms in shareholder agreements | To ensure correct treatment between shareholders. |
| Assets in cohabitation | To ensure correct reporting for tax purposes. |
| Debt / receivables owed to or from the employer, including the terms of the current account. | To ensure correct payment and receipt as well as settlement of interest and fees. |
| Information in accounting documentation on employees’ behavioural patterns, including purchases of goods and services and movement patterns | Reimbursement of outlays incurred in business operations or recording of private expenses on a private account. |
Categories of data subjects may include:
- Employees, temporary staff or fixed-term employees of the Customer
- Individual (private) customers of the Customer
- Owners of the Customer’s business
- Board members of the Customer
Appendix 2 Overview of Processors (subcontractors)
| Processor’s name and contact information | Place of processing (country) | Transfer basis (if applicable) for transfers outside the EU/EEA* |
|---|---|---|
| Adata AS | Norway | |
| Conta AS | Norway | |
| Economy Konsulenttjenester AS | Norway | |
| Economy Kontortjenester AS | Norway | |
| Fiken AS | Norway | |
| PowerOffice AS | Norway | |
| Marija Stojšin PR Scancons | Serbia | 2 |
| Sticos AS | Norway | |
| Tripletex AS | Norway | |
| Visma Software AS | Norway | |
| Hubspot Inc | USA | 4 |
| Microsoft Inc | USA | 4 |
*) Applicable transfer bases under this data processing agreement are:
- The country is approved by the EU (adequacy decision)
- Standard Contractual Clauses (SCC)
- Binding Corporate Rules (BCR)
- Transfer in accordance with the “Guidelines on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR”
- Other valid transfer bases in line with the guidance of the Norwegian Data Protection Authority (Datatilsynet). To be specified.
Data Processing Agreement | Economy Regnskap AS, September 2026
