Snapshot 232775
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement
1
Data Processing Agreement
Version 16, 24.8.2026 9:59
Dstny A/S (og koncernforbundne selskaber) ("the Organization")
Skodsborgvej 305 D
2850 Nærum
DK
CVR: 28313160
2
Table of Contents
1. Parties
2. Preamble
3. The rights and obligations of the Controller
4. The Processor acts according to instructions
5. Confidentiality
6. Security of processing
7. Use of sub-processors
8. Transfer of data to third countries or international organisations
9. Assistance to The Controller
10. Notification of personal data breach
11. Erasure and return of data
12. Audit and inspection
13. The parties’ agreement on other terms
14. Commencement and termination
15. The controller and the processor contacts/contact points
16. Appendix A - Information about the processing
17. Appendix B - Sub-processors
18. Appendix C - Instruction pertaining to the use of personal data
19. Appendix D - The parties’ regulation of other matters
3
1. Parties
For the purposes of Article 28(3) of Regulation 2016/679 (the GDPR)
between
The customer, herinafter "The Controller"
and
Dstny A/S (og koncernforbundne selskaber)
Skodsborgvej 305 D
2850 Nærum
DK
Company registration number: 28313160
hereinafter "The Processor"
each a "Party"; together the "Parties"
HAVE AGREED on the following Contractual Clauses (the Clauses) in order to meet the requirements of the GDPR and to
ensure the protection of the rights of the data subject.
2. Preamble
These Contractual Clauses (the Clauses) set out the rights and obligations of the Controller and the Processor, when
processing personal data on behalf of the Controller.
The Clauses have been designed to ensure the parties’ compliance with Article 28(3) of Regulation 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR).
In the context of the provision of mobile telephony, IP telephony, communication services and software (PBX, collaboration
etc.), network infrastructure, security and related services, the Processor will process personal data on behalf of the
Controller in accordance with the Clauses.
The Clauses shall take priority over any similar provisions contained in other agreements between the parties.
Four appendices are attached to the Clauses and form an integral part of the Clauses.
Appendix A contains details about the processing of personal data, including the purpose and nature of the processing,
type of personal data, categories of data subject and duration of the processing.
Appendix B contains the Controller’s conditions for the Processor’s use of sub-processors and a list of sub-processors
authorised by the Controller.
4
Appendix C contains the Controller’s instructions with regards to the processing of personal data, the minimum security
measures to be implemented by the Processor and how audits of the Processor and any sub-processors are to be
performed.
Appendix D contains provisions for other activities which are not covered by the Clauses.
If standard contractual clauses as referred to in GDPR, Article 46(2), litra c and d form basis of transfer of personal data
between the Controller and the Processor covered by chapter V of the GDPR, these will be attached as Appendices E and
E1.
The Clauses along with appendices shall be retained in writing, including electronically, by both parties.
The Clauses shall not exempt the Processor from obligations to which the Processor is subject pursuant to the General
Data Protection Regulation (GDPR) or other legislation.
3. The rights and obligations of the Controller
The Controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR
(see Article 24 GDPR), the applicable EU or Member State data protection provisions and the Clauses.
3.1 The Data Controller’s decision-making authority
The Controller has the right and obligation to make decisions about the purposes and means of the processing of personal
data.
3.2 Basis for processing personal data
The Controller shall be responsible, among other, for ensuring that the processing of personal data, which the Processor is
instructed to perform, has a legal basis.
4. The Processor acts according to instructions
The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by
Union or Member State law to which the processor is subject. Such instructions shall be specified in appendices A and C.
Subsequent instructions can also be given by the Controller throughout the duration of the processing of personal data, but
such instructions shall always be documented and kept in writing, including electronically, in connection with the Clauses.
4.1 Notification of infringing instructions
The Processor shall immediately inform the Controller if instructions given by the Controller, in the opinion of the Processor,
contravene the GDPR or the applicable EU or Member State data protection provisions.
5
5. Confidentiality
5.1 Access to personal data and confidentiality
The Processor shall only grant access to the personal data being processed on behalf of the Controller to persons under
the Processor’s authority who have committed themselves to confidentiality or are under an appropriate statutory obligation
of confidentiality and only on a need to know basis. The list of persons to whom access has been granted shall be kept
under periodic review. On the basis of this review, such access to personal data can be withdrawn, if access is no longer
necessary, and personal data shall consequently not be accessible anymore to those persons.
5.2 Documentation of obligation of confidentiality
The Processor shall at the request of the Controller demonstrate that the concerned persons under the Processor’s
authority are subject to the abovementioned confidentiality.
6. Security of processing
6.1 Technical and organisational measures
GDPR, Article 32, stipulates that, taking into account the state of the art, the costs of implementation and the nature, scope,
context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of
natural persons, the Controller and Processor shall implement appropriate technical and organisational measures to ensure
a level of security appropriate to the risk.
The Controller shall evaluate the risks to the rights and freedoms of natural persons inherent in the processing and
implement measures to mitigate those risks. Depending on their relevance, the measures may include the following:
1. Pseudonymisation and encryption of personal data;
2. the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and
services;
3. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or
technical incident;
4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational
measures for ensuring the security of the processing.
6.2 Risk assessment of the Processor
According to GDPR, Article 32, the Processor shall also – independently from the Controller – evaluate the risks to the
rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. To this
effect, the Controller shall provide the Processor with all information necessary to identify and evaluate such risks.
6.3 Assistance with compliance with security measures
Furthermore, the Processor shall assist the Controller in ensuring compliance with the Controller’s obligations pursuant
to GDPR, Article 32, by inter alia providing the Controller with information concerning the technical and organisational
6
measures already implemented by the Processor pursuant to GDPR, Article 32, along with all other information necessary
for the Controller to comply with the Controller’s obligation under GDPR, Article 32.
If subsequently – in the assessment of the Controller – mitigation of the identified risks require further measures to be
implemented by the Processor, than those already implemented by the Processor pursuant to GDPR, Article 32, the
Controller shall specify these additional measures to be implemented in Appendix C.
7. Use of sub-processors
The Processor shall meet the requirements specified in GDPR, Article 28(2) and (4) in order to engage another processor
(a sub-processor).
7.1 General written authorisation
The Processor shall therefore not engage another processor (sub-processor) for the fulfilment of the Clauses without the
prior general written authorisation of the Controller.
The Processor has the Controller’s general authorisation for the engagement of sub-processors. The Processor shall inform
in writing the Controller of any intended changes concerning the addition or replacement of sub-processors at least 30 in
advance, thereby giving the Controller the opportunity to object to such changes prior to the engagement of the concerned
sub-processor(s). Longer time periods of prior notice for specific sub-processing services can be provided in Appendix B.
The list of sub-processors already authorised by the Controller can be found in Appendix B.
7.2 Sub-processor obligations
Where the Processor engages a sub-processor for carrying out specific processing activities on behalf of the Controller,
the same data protection obligations as set out in the Clauses shall be imposed on that sub-processor by way of a contract
or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate
technical and organisational measures in such a manner that the processing will meet the requirements of the Clauses and
GDPR.
The processor shall therefore be responsible for requiring that the sub-processor at least complies with the obligations to
which the Processor is subject pursuant to the Clauses and GDPR.
7.3 Documentation of sub-processor agreements
A copy of such a sub-processor agreement and subsequent amendments shall – at the Controller’s request – be submitted
to the Controller, thereby giving the Controller the opportunity to ensure that the same data protection obligations as set
out in the Clauses are imposed on the sub-processor. Clauses on business related issues that do not affect the legal data
protection content of the sub-processor agreement, shall not require submission to the Controller.
7.4 Liability for sub-processors
If the sub-processor does not fulfil his data protection obligations, the Processor shall remain fully liable to the Controller as
regards the fulfilment of the obligations of the sub-processor. This does not affect the rights of the data subjects under the
GDPR – in particular those foreseen in GDPR, Articles 79 and 82 – against the Controller and the Processor, including the
sub-processor.
7
8. Transfer of data to third countries or international
organisations
8.1 Instructions on transfers to third countries
Any transfer of personal data to third countries or international organisations by the Processor shall only occur on the basis
of documented instructions from the Controller and shall always take place in compliance with Chapter V GDPR.
Without documented instructions from the Controller, the Processor therefore cannot within the framework of the Clauses:
1. transfer personal data to a controller or a processor in a third country or in an international organization
2. transfer the processing of personal data to a sub-processor in a third country
3. have the personal data processed by the Processor in a third country
The Controller’s instructions regarding the transfer of personal data to a third country including, if applicable, the transfer
tool under Chapter V GDPR on which they are based, shall be set out in Appendix C.6.
The Clauses shall not be confused with standard data protection clauses within the meaning of GDPR, Article 46(2)(c) and
(d), and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR unless such standard
contractual clauses are attached in Appendix E.
8.2 Notification of legally required transfers
In case transfers to third countries or international organisations, which the Processor has not been instructed to perform
by the Controller, is required under EU or Member State law to which the Processor is subject, the Processor shall inform
the Controller of that legal requirement prior to processing unless that law prohibits such information on important grounds
of public interest.
9. Assistance to The Controller
9.1 Assistance with data subject rights request
Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and
organisational measures, insofar as this is possible, in the fulfilment of the Controller’s obligations to respond to requests
for exercising the data subject’s rights laid down in Chapter III GDPR.
This entails that the Processor shall, insofar as this is possible, assist the Data Controller in the Controller’s compliance
with:
1. the right to be informed when collecting personal data from the data subject
2. the right to be informed when personal data have not been obtained from the data subject
3. the right of access by the data subject
8
4. the right to rectification
5. the right to erasure (‘the right to be forgotten’)
6. the right to restriction of processing
7. notification obligation regarding rectification or erasure of personal data or restriction of processing
8. the right to data portability
9. the right to object
10. the right not to be subject to a decision based solely on automated processing, including profiling
9.2 Assistance with data breaches and data protection impact
assessments
In addition to the Processor's obligation to assist the Controller pursuant to Clause 6.3, the Processor shall furthermore,
taking into account the nature of the processing and the information available to the Processor, assist the Controller in
ensuring compliance with:
1. The Controller’s obligation to without undue delay and, where feasible, not later than 72 hours after having
become aware of it, notify the personal data breach to the competent data protection agency, unless the personal
data breach is unlikely to result in a risk to the rights and freedoms of natural persons;
2. The Controller’s obligation to without undue delay communicate the personal data breach to the data subject,
when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons;
3. The Controller’s obligation to carry out an assessment of the impact of the envisaged processing operations on
the protection of personal data (a data protection impact assessment);
4. The Controller’s obligation to consult the competent data protection agency, prior to processing where a data
protection impact assessment indicates that the processing would result in a high risk in the absence of measures
taken by The Controller to mitigate the risk.
9.3 Specification of Technical and Organisational Assistance Measures in
Appendix C
The Parties shall define in Appendix C the appropriate technical and organisational measures by which The Processor is
required to assist the controller as well as the scope and the extent of the assistance required. This applies to the obligations
forseen in Clause 9.1 and 9.2.
10. Notification of personal data breach
In case of any personal data breach, the Processor shall, without undue delay after having become aware of it, notify the
Controller of the personal data breach.
10.1 Notification deadline for Personal Data Breaches
The Processor’s notification to the Controller shall, if possible, take place within and by the latest 24 hours after the
Processor has become aware of the personal data breach to enable the Controller to comply with the Controller's obligation
to notify the personal data breach to the data protection agency, cf. GDPR, Article 33.
9
10.2 Assistance with notification of breaches
In accordance with Clause 9.2.1, the Processor shall assist The Controller in notifying the personal data breach to the
competent supervisory authority, meaning that the Processor is required to assist in obtaining the information listed below
which, pursuant to GDPR, Article 33(3), shall be stated in the Controller’s notification to the competent data protection
authority:
1. The nature of the personal data including where possible, the categories and approximate number of data
subjects concerned and the categories and approximate number of personal data records concerned;
2. the likely consequences of the personal data breach;
3. the measures taken or proposed to be taken by the Controller to address the personal data breach, including,
where appropriate, measures to mitigate its possible adverse effects.
The parties shall define in Appendix D all the elements to be provided by the Processor when assisting the Controller in the
notification of a personal data breach to the competent data protection agency.
11. Erasure and return of data
11.1 Erasure of personal data on termination
On termination of the provision of personal data processing services, the Processor shall be under obligation to delete all
personal data processed on behalf of the Controller and certify to the Controller that it has done so unless Union or Member
State law requires storage of the personal data.
11.2 Storage on the basis of legal obligation
The following EU or Member State law applicable to the Processor requires storage of the personal data after the
termination of the provision of personal data processing services:
1. Due to the Danish Bookkeeping act (Bogføringsloven) section 10, we are required to store documentation for a
period of 5 years.
The Processor commits to exclusively process the personal data for the purposes and duration provided for by this law and
under the strict applicable conditions.
12. Audit and inspection
12.1 Assistance with audits and inspections
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the
obligations laid down in GDPR, Article 28, and the Clauses and allow for and contribute to audits, including inspections,
conducted by the Controller or another auditor mandated by the Controller.
10
12.2 Procedures for audits and inspections
Procedures applicable to the Controller’s audits, including inspections, of the Processor and sub-processors are specified
in C.7 and C.8 .
12.3 Access for supervisory authorities
The Processor shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access
to the Controller’s and Processor’s facilities, or representatives acting on behalf of such supervisory authorities, with access
to the Processor’s physical facilities on presentation of appropriate identification.
13. The parties’ agreement on other terms
The parties may agree other clauses concerning the provision of the personal data processing service specifying e.g.
liability, as long as they do not contradict directly or indirectly the Clauses or prejudice the fundamental rights or freedoms
of the data subject and the protection afforded by the GDPR.
14. Commencement and termination
14.1 Effective date
The Clauses are binding upon the Parties.
14.2 Renegotiation
Both Parties shall be entitled to require the Clauses renegotiated if changes to the law or inexpediency of the Clauses
should give rise to such renegotiation.
14.3 Duration
The Clauses shall apply for the duration of the provision of personal data processing services. For the duration of the
provision of personal data processing services, the Clauses cannot be terminated unless other Clauses governing the
provision of personal data processing services have been agreed between the Parties.
14.4 Termination
If the provision of personal data processing services is terminated, and the personal data is deleted to the Controller
pursuant to Clause 11.1 and Appendix C.4, the Clauses may be terminated by written notice by either Party.
14.5 Binding Effect
The Processor is bound by the Clauses without the Parties’ signatures. The Clauses are thus entered into without physical/
digital signatures, as the Clauses are binding in accordance with the requirement set out in GDPR, Article 28(3).
11
15. The controller and the processor contacts/contact
points
The Parties may contact each other using the following contacts/contact points. The Parties shall be under obligation
continuously to inform each other of changes to contacts/contact points.
Contact information for The Controller:
The to any applicable contact information, which was received at the conclusion of the contract and through ongoing
cooperation.
Contact information for The Processor:
Carsten Thomsen
dpo@dstny.dk
16. Appendix A - Information about the processing
16.1 The purpose of the Processor’s processing of personal data on
behalf of the Controller is:
The following purposes form the basis of the Processor's processing of personal data on behalf of the Controller:
The Controller uses Dstny’s solutions and services, including telephony solutions, which involve the processing of personal
data relating to the Controller’s users. Dstny processes such personal data on behalf of the Controller for the purposes
of providing, operating, supporting and administering the solutions and services, including the creation, maintenance and
administration of users. In addition, the Controller may opt for supplementary services, the provision of which may involve
the use of sub-processors that process personal data relating to the Controller’s users.
16.2 The Processor’s processing of personal data on behalf of the
Controller shall mainly pertain to (the nature of the processing):
The data processor uses data from the data controller in order to deliver the requested services. For example, to make
it possible to search for a colleague in the telephone system (PBX), to be able to see if the colleague is availeble, or to
enable a desired integration. The data processor save the required information to enable billing of the requested services,
for example a CDR (Call Data Record) is saved for each call made, to ensure that the billing is done correctly. If the
customer have Danish telephone numbers, Dstny must, according to the Telecommunications Act (Bekendtgørelse af lov
om elektroniske kommunikationsnet og -tjenester) section 31, provide number information to public directory services.
12
Development of apps and customer portals and provision of services in relation hereto:
• The processor develops and provides apps, web-shops and customer portals
16.3 Types of personal data
The processing includes the following types of personal data concerning the data subjects:
• Username for one or several systems
• E-mail
• IP-address
• Name
• Information about users' used device
• Phone number
The Processor may process personal data about the Controller's employees in connection with the Processor's sales,
marketing and product development. This processing of personal data is not covered by the Clauses, because the
Processor acts as a controller regarding of this processing. Instead, reference is made to the Processor's privacy policy
which can be found on the Processor's website or upon request.
See section 3.2.
16.4 Categories of data subjects
The processing includes the following categories of data subjects:
• Customers that are consumers or sole proprietors
• Customers' employees (when customers are companies)
16.5 Duration
The Processor’s processing of personal data on behalf of the Controller may be performed when the Clauses commence.
The processing of personal data shall be performed until the Processor's services has been terminated, after which the
personal data is erased in accordance with Clause 11. The Processor's processing of personal data is performed as long
as the underlying commercial agreement(s) consists.
17. Appendix B - Sub-processors
17.1 Approved sub-processors
13
On commencement of the Clauses, the Controller authorises the engagement of the following sub-processors:
General sub-processors:
SuperOffice Danmark A/S (CVR no: 20020695)
Delta Park 46, st.
2665 Vallensbæk Strand
Denmark
Data processing: SuperOffice processes data on behalf of Dstny using its Customer Relationship Management (CRM)
solution.
Microsoft Corporation (CVR no: 13612870)
One Microsoft Way
Redmond, WA 98052-6399
USA
Data processing: Microsoft processes data on behalf of Dstny using their document management software and Microsoft
Teams.
Zendesk’s United States Representative:
Zendesk, Inc.
Attn: Hasani Caraway, General Counsel & Chief Privacy Officer
1019 Market Street
San Francisco, CA 94103, United States
Data processing: Zendesk processes data on behalf of Dstny through its ticketing system, which is used to manage
customer service and support inquiries.
ActiveCampaign LCC
One North Dearborn, 5th floor
60602 Chicago, IL
USA
Data processing: ActiveCampaign LLC processes data on behalf of Dstny for email communications sent via the MyDstny
self-service system and the operational status platform, Sorry App.
Product-specific sub-processors:
Destiny for Service Providers AB (CVR no: 556890-1747)
Lumaparksvägen 9
120 31 Stockholm
Sweden
Data processing: Destiny for Service Providers AB processes data on behalf of Dstny using its communication platform,
Connect 3.0.
OCH A/S c/o Telia Company Danmark A/S (CVR no: 18936909)
Holmbladsgade 139
2300 København S
Denmark
Data processing: OCH operates the central number database in Denmark and serves as the common reference point for
the exchange of information regarding ported telephone numbers. Dstny uses OCH for import and export of telephone
numbers within Denmark.
NPS.TODAY ApS (CVR no.: 36464917)
Bredgade 41, 2. tv.
1260 København K
Denmark
Data processing: NPS.TODAY processes data on behalf of Dstny using the Net Promoter Score - SMS Survey product.
Capacit A/S (CVR no: 42607797)
Overgaden Neden Vandet 9A, st.,
1414 København K.
Denmark
Data Processing: Capacit processes data on behalf of Dstny in connection with the customer’s use of the ScriptIQ,
CaptureIQ and TeamsIQ products, which are part of the DstnyIQ product suite.
14
Red Cactus B.V. (CVR no: 77957229)
Dirk Dronkersweg 12A
4462 GA Goes
The Netherlands
Data processing: Red Cactus processes data on behalf of Dstny in connection with the customer’s selection of integrations
for PBX and AI solutions, where Red Cactus acts as a sub-processor.
18. Appendix C - Instruction pertaining to the use of
personal data
18.1 The subject of/instruction for the processing
Delivers Telephony, network and PBX functionality to the Data responsible.
18.2 Security of processing
The level of security shall take into account:
Taking into account the nature, scope, context and purposes of the processing activity as well as the risk for the rights and
freedoms of natural persons, the Processor must implement an appropriate leve of security.
The Processor shall hereafter be entitled and under obligation to make decisions about the technical and organisational
security measures that are to be applied to create the necessary (and agreed) level of data security.
The Processor shall however – in any event and at a minimum – implement the following measures that have been agreed
with the Controller:
18.3 Assistance to the Controller
The Processor shall insofar as this is possible – within the scope and the extent of the assistance specified below – assist
the Controller in accordance with Clause 9.1 and 9.2 by implementing the following technical and organisational measures:
• If the Controller receives a request for the exercise of one of the rights of the data subjects in accordance with applicable
data protection law, and a proper reply to the request requires assistance from the Processor, the Processor shall assist
the Controller with the necessary and relevant information and documentation as well as appropriate technical and
organizational security measures.
• If the Controller needs the Processor's assistance in order to reply to a request from a data subject, the Controller must
send a written requst for assistance to the Processor and the Processor shall in response provide the necessary help or
documentation as soon as possible and no later than 7 calendar days after receiving the request.
• If the Processor receives a request for the exercise of the rights pursuant to applicable data protection law from
other persons than the Controller, and the request concerns personal data processed on behalf of the Controller, the
Processor shall without undue delay forward the reuest to The Controller.
15
18.4 Storage period/erasure procedures
Upon termination of the provision of personal data processing services, the Processor shall delete the personal data in
accordance with Clause 11.1 unless the Controller – after the signature of the contract – has modified the Controller’s
original choice. Such modification shall be documented and kept in writing, including electronically, in connection with the
Clauses.
18.5 Processing location
Processing of the personal data under the Clauses cannot be performed at other locations than the following without the
Controller’s prior written authorisation:
At the Processor's own headquarter or at the headquarters of approved subprocessors as specified in Appendix B.
18.6 Instruction on the transfer of personal data to third countries
Personal data is only being processed by the Processor on the locations specified in this appendix.
Transfers to the United States occur on the basis of the data importer’s certification under the EU-U.S. Data Privacy
Framework (see certified organisations here.)
Unsafe third countries
The Data Processor transfers personal data to the following countries not subject to an adequacy decision on the basis of
Article 45 of Regulation (EU) 2016/679t in order to fulfill the Main Agreement: USA
General
If the Controller does not provide a documented instruction in these Clauses or subsequently with regards to the transfer of
personal data to a third country, the Processor is not entitled to carry out such transfers within the scope of these Clauses.
Transfer of personal data can in all cases only be done in accordance with these Clauses, on the instructions of The
Controller and to the extent permitted by the applicable data protection law.
If the transfer of personal data to third countries outside the EU/EEA is carried out in connection with the Processor's
transfer to sub-processors, the Processor is by the provisions of the agreement authorized to enter into the standard
contractual provisions adopted by the European Commission with the Processor's sub-processors on behalf of the
Controller, provided that all the applicable rules regarding transmission and other processing of personal data are otherwise
complied with. If the data controller itself is the processor, and the data processor is a sub-data processor of the data in
relation to the data controller's ultimate contractual partner(s), the Controller must obtain authorization from the ultimate
contracting party of the Processor in the standard contract terms.
Where, in accordance with these clauses, The Processor transfers personal data to subdata processors in third countries
outside the EU / EEA, the Processor must independently secure a legal basis for the transfer in accordance with Chapter 5
of GDPR.
18.7 Procedures for the Controller’s audits, including inspections, of the
processing of personal data being performed by the Processor
The Processor shall, upon the Controller's written request, document to the Controller that the Processor
16
• is complying with his obligations under these Clauses and the Instruction, and
• with the relevant articles in the GDPR in regards to the personal data being processed on behalf of the Controller.
The Processor's documentation shall be sent to the Controller within a reasonable time after receiving the request.
In order to ensure that the Data Controller has sufficient insight into and documentation of the Data Processor's secure
processing of the Personal Data, the Data Processor must every 18 months have an external, independent third party
conduct an audit of the Data Processor's compliance with the Data Processing Agreement, including the implemented
security measures. The complete records must be submitted to the Data Controller.
18.8 Procedures for audits, including inspections, of the processing of
personal data being performed by sub-processors
The Data Processor shall, at a minimum, conduct an annual review of the sub-processors at its own expense.
The Parties agree that the ISAE 3000 standard may be used for this purpose.
The Data Processor shall obtain an external audit annually, in accordance with the ISAE 3000 standard, which also includes
an assessment of the sub-processor controls and related documentation.
19. Appendix D - The parties’ regulation of other matters
19.1 Note on the procedure for the Data Controller's audits in Annex C
point 7
According to our documentation for compliance with the Data Processor agreement, reference is made to the procedure in
Annex C point 7.3, as it will not be possible in practice to carry out a physical inspection of our data centres.
19.2 Update of the Data Processing Agreement
It is always the latest version of the data processing agreement that applies between the parties, see https://dstny.dk/
aftalebilag. The data processor reserves the right to continuously make changes to, including clarifications of, the
agreement. These changes will typically be a result of new recommendations from e.g. The Danish Data Protection
Authority or the EU Commission as well as changes in practice and legislation in the area. The Data Controller is therefore
encouraged, to sign up to receive notifications, when there are changes to the agreement: https://dstny.dk/aftalebilag-gdpr.
After receiving a notification about a change, the Data Controller has 14 working days to object, if the change cannot
reasonably be accepted. This provision does not apply to changes in the use of sub-processors, which are regulated in
section 7 of the agreement.
17