Data processing

The parties have entered into an agreement for the provision of accounting services (“the Service Agreement”) as of the date of signature. This appendix describes how the Accounting Firm processes personal data in connection with the Service Agreement. The Accounting Firm is the data processor and processes personal data on behalf of the Customer, who is the data controller, in accordance with the Personal Data Act and the Service Agreement.

Category of data subjects and purpose of the personal data:

Employees, temporary workers and consultants
Salary, benefits, A-reports, pension, tax deductions, sick pay, leave compensation, etc.

Shareholders
Customer measures, dividends, corporate advisory services, shareholder register notification, reporting, general meeting minutes, etc.

Board members
Correct information, annual accounts, benefits and deductions.

Customers
Invoicing, bookkeeping, etc.

Suppliers
Invoicing, payment, etc.

The accounting firm will process the following types of personal data on behalf of the Customer.

Type of personal data and purpose of the personal data:

Identity information
See assignment specification point 1, marketing purpose.

Bank information
See assignment specification point 1, marketing purpose.

Salary information, including any wage deductions
See assignment specification point 1, marketing purpose.

Tax withholding information
See assignment specification point 1, marketing purpose.

Transaction information, payments and information about debt relationships
See assignment specification point 1, marketing purpose.

The accounting firm does not process personal data beyond what is set out in the Service Agreement between the Parties or special legislation.

The accounting firm will process the following special categories of personal data on behalf of the Client.

Type of personal data and purpose of the personal data:

Information about sick leave and self-certified absence
A-melding, ensure correct employment percentage and salary payment.

Information about payment of deductions for union dues
Ensure correct benefits and deductions.

The specific basis for processing special categories of personal data is the Client's consent, cf. GDPR Article 9(2)(a). Such consent is deemed to exist upon signature of the Engagement Agreement.

Upon entering into the Engagement Agreement, the Accounting Firm uses the following sub-processors.

Visma AS
Processing location: Norway
Transfer basis: The country is approved by the EU.

Sticos AS
Processing location: Norway
Transfer basis: The country is approved by the EU.

Signicat AS
Processing location: Norway
Transfer basis: The country is approved by the EU.

Supabase Inc
Processing location: Norway
Transfer basis: The country is approved by the EU.

Google Cloud EMEA Limited
Processing location: Norway
Transfer basis: The country is approved by the EU.

If there are changes in sub-processors, an updated list of sub-processors will be sent to the Customer.

The accounting firm stores accounting records with associated personal data in accordance with what is stated in the Engagement Agreement and mandatory requirements for the retention of accounting documentation, etc. The Parties shall in good faith agree on the practical implementation of such statutory retention obligation, which safeguards both Parties' need to meet legal requirements and ensure day-to-day operations.

Upon termination of the engagement, the personal data will be deleted or returned to the Customer in accordance with Standard Terms of Engagement section 9.3. Where the engagement involves storage of accounting records, the personal data will be retained for the statutory retention period.