Snapshot 7171
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement
for LINK’s provision of Messaging Services
1. Introduction with the Agreement and the Controller's documented
instructions, and in accordance with the DPA, unless
This Data Processing Agreement (“DPA”) is entered into
otherwise stipulated in the Data Protection Legislation.
by LINK and the Customer and constitutes an integral
LINK shall inform the Controller if an instruction from
part of Service Agreement between the parties
Controller, in LINK's opinion, infringes the Data
(“Agreement”), together with the Scope Appendix, the
Protection Legislation.
Security Appendix; the Standard contractual clauses
(“SCC”) Appendix and any other agreed appendices. LINK’s processing of personal data as controller is
available in the privacy section of
When the data exporter is based in Switzerland, the
https://linkmobility.com/privacy/ .
references to the GDPR in the SCC should be understood
as references to the Federal Act on Data Protection of 3. Obligations of the controller
19 June 1992 and its revised version of 25 September The Controller warrants that the Personal Data is
2020 (FADP) insofar as the data transfers are subject to processed lawfully, for specified, explicit and legitimate
the FADP. purposes. The Controller will not instruct LINK to
When the data exporter is based in Switzerland, the SCC process more Personal Data than required for fulfilling
clauses also protect the data of legal entities until the such purposes.
entry into force of the revised FADP. The Controller is responsible for ensuring that a valid
"Data Protection Legislation" shall mean the EU General legal basis for processing as defined in the Data
Data Protection Regulation 2016/679 ("GDPR") and the Protection Legislation (ref. GDPR Article 6.1) exists at
EU Directive on privacy and electronic communications the time of transferring the Personal Data to LINK. If
(ePrivacy Directive), and national provisions on such legal basis is consent (ref. GDPR Article 6.1 (a)) the
protection of privacy in the country in which the Controller warrants that any consent is given explicitly,
Controller or Processor is established, as amended, voluntarily, unambiguously and on an informed basis.
replaced or superseded from time to time, including laws In addition, the Controller warrants that the Data
implementing or supplementing the GDPR and ePrivacy Subjects to which the personal data pertains have been
Directive. provided with information required under the Data
Terms defined in the GDPR article 4 shall be understood Protection Legislation (ref. GDPR article 13 and 14) on
in accordance with the GDPR definition. the processing of their Personal Data.
2. Scope and commitment Any instructions regarding the processing of Personal
Data carried out under this DPA shall primarily be
The Parties agree and acknowledge that, in LINK’s
submitted to LINK. In case the Controller instructs a Sub-
performance of services under the Agreement,
processor appointed in accordance with section 10
processing of personal data on customer’s behalf will
directly, the Controller shall immediately inform LINK
take place. Customer therefore appoints LINK as data
hereof. LINK shall not in any way be liable for any
processor. The terms and conditions of data processing
processing carried out by the Sub-processor because of
are set forth in this DPA. LINK guarantees that it will
instructions received directly from the Controller, and
implement appropriate technical and organizational
such instructions result in a breach of this DPA, the
measures in such a manner that LINK’s processing will
Agreement or Data Protection Legislation.
meet the requirements of the Data Protection Legislation
and ensure the protection of the rights of the Data 4. Confidentiality
Subject. LINK ensures that its employees, its Sub-processors, and
This DPA covers processing of personal data when LINK other persons who process the personal data by
processes on the Customer’s behalf as processor (GDPR authority of LINK have committed themselves to
Article 28.3) or, if the Customer is itself a processor, as a confidentiality or are under an appropriate statutory
sub-processor (GDPR Article 28.4). obligation of confidentiality.
For the purpose of this DPA, Customer shall hold the The Controller is subject to a duty of confidentiality
obligations of Controller and is fully responsible towards regarding any documentation and information received
a controller on whose behalf it processes Personal Data by LINK, related to LINK or LINK’s Sub-processors'
by use of LINK’s services. Reference to the “Controller” implemented technical and organizational security
herein will therefore in all cases be a refer to the measures, or information which LINK’s Sub-processors
Customer. have defined as confidential. However, Controller may
always share such information with supervisory
Subject to the Customer being based in Third Country authorities, if necessary, to act in compliance with
located outside the European Union (EU) or the Controller's obligations under Data Protection
European Economic Area (EEA) and without an Legislation or other statutory obligations.
adequacy decision by the European Commission, the
SCC Appendix, Module four, shall apply to the 5. Security
processing activities requiring personal data transfers The security requirements applying to LINK's processing
from LINK as processor to the Customer. of Personal Data are governed by Security Appendix to
LINK as processor, its Sub-processors, and other the DPA.
persons acting under the authority of LINK who have
access to the Personal Data shall process the Personal
Data only on behalf of the Controller and in compliance
LINK Data Processing Agreement – Version 1.5 2026 Page 1 of 3
6. Access to Personal data and fulfilment of Data Controller shall bear any costs related to such
Subjects' rights communication to the Data Subject.
Unless otherwise agreed or dictated by applicable law, 9. Transfer to Third Countries
the Controller is entitled to request access to personal Transfer of Personal Data to countries located outside
data being processed by LINK on behalf of the the European Union (EU) or the European Economic Area
Controller. (EEA) and without an adequacy decision by the
If LINK, or a sub-processor, receives a request from a European Commission, hereunder disclosure or
Data Subject relating to processing of Personal Data provision of access, may only occur in case of
processed on behalf of the Controller, LINK shall send documented instructions from the Controller.
such request to the Controller, for the Controller's further For transfer to sub-processors, the documented
handling thereof, unless otherwise stipulated in statutory instructions are described in section 10 below and are
law. subject to EUs standard contractual clauses as provided
Taking into account the nature of the processing, LINK in the SCC Appendix, Module three - transfers from LINK
shall assist the Controller by appropriate technical and as processor to a sub-processor in a Third Country.
organizational measures, insofar as this is possible, for The Customer accepts and understands that transfer to
the fulfilment of the Controller's obligation to respond to operators in Third Countries that is necessary to
requests for exercising the Data Subject's rights transmit messages to recipients located in such
stipulated in Data Protection Legislation, including the countries is not covered by the requirements herein.
Data Subject's right to (i) access to its Personal Data, (ii)
rectification of its inaccurate Personal Data; (iii) erasure 10. Use of sub-processors
of its Personal Data; (iv) restriction of, or objection to, The Controller agrees that LINK may appoint another
processing of its Personal Data; and (v) the right to processor, hereinafter referred to as sub-processor, to
receive its Personal Data in a structured, commonly used assist in providing the services and processing Personal
and machine-readable format (data portability). To the Data under the Agreement, provided that LINK ensures
extent Customer requests assistance exceeding the that the data protection obligations as set out in this
requirements for processors in the GDPR, LINK shall be DPA and in Data Protection Legislation are imposed
compensated for such assistance at LINK's then current upon any Sub-processor by a written agreement; and
rates. that any Sub-processor provides sufficient guarantees
that they will implement appropriate technical and
7. Other assistance to the Controller
organizational measures to comply with Data Protection
If LINK, or a Sub-processor, receives a request for Legislation and this DPA, and will provide the Controller
access or information from the relevant supervisory and relevant supervisory authorities with access and
authority relating to the registered Personal Data or information necessary to verify such compliance.
processing activities subject to this DPA, LINK shall
LINK shall remain fully liable to the Controller for the
notify the Controller, for the Controller's further
performance of any Sub-processor.
processing thereof, unless LINK is entitled to handle
such request itself. Applicable sub-processors are listed in Scope Appendix.
LINK may update the list to reflect any addition or
If the Controller is obliged to perform a Data Protection
replacement of Sub-processors by notification to the
Impact Assessment and/or Prior consultation with the
Customer at least 3 months prior to the date on which
supervisory authority in connection with the processing
such Sub-processor shall commence processing of
of Personal Data under this DPA, LINK shall provide
Personal Data. Any objection to such changes must be
assistance to the Controller, taking into account the
provided to LINK within 3 weeks of receipt of such
nature of processing and the information available to
notification or publication on the website. In case of an
LINK. To the extent Customer requests assistance
objection from Customer as to the supplementing or
exceeding the requirements towards processors in the
change of a Sub-processor, LINK may terminate the
GDPR, the Customer shall bear any costs accrued by
Agreement and this DPA with 1 months’ notice.
LINK related to such assistance.
By entering into this DPA, the Customer grants LINK
8. Notification of Personal Data Breach
authority to secure any legal basis for Transfer to Third
LINK shall notify the Controller without undue delay after Countries for any Sub-processor approved in accordance
becoming aware of a Personal Data Breach. The with the procedure stipulated above. If Customer is not
Controller is responsible for notifying the Personal Data itself controller, Customer will ensure such grant from
Breach to the relevant supervisory authority in controller. Upon request, LINK shall provide the
accordance with GDPR article 33. Controller with a copy of the EUs standard contractual
The notification to the Controller shall be sent on agreed clauses under the SCC Appendix, Module three or
e-mail address, and as a minimum describe (i) the nature description of the legal basis for Transfer.
of the Personal Data Breach including where possible, LINK shall provide reasonable assistance and
the categories and approximate number of Data documentation to be used in Controller's independent
Subjects concerned and the categories and approximate risk assessment in relation to use of Sub-processors or
number of Personal Data records concerned; (ii) the Transfer of Personal Data to a Third Country.
likely consequences of the Personal Data Breach; (iii) the
measures taken or proposed to be taken by LINK to 11. Audits
address the Personal Data Breach, including, where LINK shall, upon request, provide the Customer with
appropriate, measures to mitigate its possible adverse documentation of implemented technical and
effects. organizational measures to ensure an appropriate level
of security, and other information necessary to
In the event the Controller is obliged to communicate a
demonstrate LINK's compliance with its obligations
Personal Data Breach to the Data Subjects, LINK shall
under the DPA and relevant Data Protection Legislation.
assist the Controller, taking into account the nature of
processing and the information available to LINK. The
LINK Data Processing Agreement – Version 1.5 2026 Page 2 of 3
Controller and the supervisory authority under the 14. Breach of the DPA and Limitation of liability
relevant Data Protection Legislation shall be entitled to Each party’s non-conformity with requirements set out in
conduct audits, including on-premises inspections and this DPA shall be regarded as a breach of agreement by
evaluations of Personal Data being processed, the that party, and the party shall ensure that breach is
systems and equipment used for this purpose, remedied without delay. The party in breach shall update
implemented technical and organizational measures, the other party on measures adopted to remedy the non-
including security policies and similar, and Sub- conformity. Neither party shall be liable to the other
processors. Controller shall not be given access to party for errors caused by the other party's systems or
information concerning LINK's other customers and actions, negligence or omissions, or by general internet
information subject to confidentiality obligations. or line delays, power failure or other error outside the
Controller is entitled to conduct such audits one (1) day parties’ reasonable control.
per year, upon no less than two weeks’ notice. If Liability limitations in the Services Agreement between
Controller appoints an external auditor to perform the the parties apply to liability under this DPA and the SCC
audits, such external auditor shall be bound by a duty of Appendix.
confidentiality. Controller shall bear any costs related to
15. Notices and amendments
audits initiated by Controller or accrued in relation to
audits of Controller, including compensation to LINK to All notices relating to the DPA shall be submitted in
the extent Controller requires support exceeding the writing or email to agreement contact person.
requirements in the GDPR. LINK shall nevertheless bear In case changes in Data Protection Legislation, a
such costs if an audit reveals non-compliance with the judgement or opinion from another authoritative source
DPA or Data Protection Legislation. causes another interpretation of Data Protection
12. Term and termination Legislation, or changes to the services under the
Agreement require changes to this DPA, LINK will
The DPA is valid for as long as LINK processes Personal
propose implementation of such changes into the DPA.
Data on behalf of the Controller.
Any modification or amendment of this DPA shall be
In the event of LINK's breach of the DPA or non-
effective only if agreed in writing and signed by both
compliance of the Data Protection Legislation, the
parties.
Controller may (i) instruct LINK to stop further
processing of Personal Data with immediate effect; 16. Governing law and legal venue
and/or (ii) terminate the DPA with immediate effect. The Agreement’s terms regarding governing law, dispute
13. Effects of termination resolution method and legal venue agreement shall
apply if the location is within the EU or EEA. In other
LINK shall, upon the termination of the DPA delete all the
cases, the governing law shall be Norwegian, and the
Personal Data processed on behalf of the Controller
legal venue shall be the courts of Oslo
unless otherwise stipulated in applicable law. Customer
accepts and understands that Personal Data is
accessible by it until termination, should Customer
require copies of such data before deletion.
Upon Customer’s request, LINK shall document in
writing to the Controller that deletion has taken place in
accordance with the DPA.
***
LINK Data Processing Agreement – Version 1.5 2026 Page 3 of 3