Data Processing Agreement

This Data Processing Agreement (the "DPA") is entered into between the Customer identified in the Order and Preferium AS, Norwegian organization no. 999 323 286. The DPA becomes binding when it is expressly included in a specific Order and document set that a person with authority accepts, or when the parties actually sign the agreement. The acceptance record must identify the parties, the document version, the acceptor and the time. Ordinary use of the website, a privacy request or confirmation of an email address does not conclude the DPA.

The Customer may be (a) a controller, with Preferium as processor, or (b) a processor for an End Customer, with Preferium as subprocessor. Where the Customer is a processor, the Customer warrants that the controller has approved Preferium and further subprocessors in writing, and that the instructions are lawful and pass on the controller's instructions.

For accounts, billing, security, legal compliance and its own business purposes, Preferium is an independent controller under the Privacy Notice; this DPA does not apply to that processing.

Preferium processes personal data only to provide, secure, troubleshoot, support and terminate the Service in accordance with the Order, the Service Terms, the Customer's configuration and other documented instructions. We do not process the data for our own advertising purposes or to train general models for other customers.

Support access to the Customer's workspaces or websites takes place only under a documented support case, is time-limited where practicable and is logged under the applicable security procedures.

Preferium will immediately inform the Customer if, in our assessment, an instruction infringes data-protection law. We may suspend only the affected processing until the parties have clarified the instruction. Legally required processing without an instruction is notified in advance where the law permits.

The Customer has the right and the duty to determine the purpose, legal basis, data subjects, permitted content, control level, retention and lawful instructions. The Customer must not give Preferium data or instructions it is not entitled to process.

The description above covers the customer services included in the Order. Preferium's own processing of contact details, agreement and acceptance evidence, privacy requests and security incidents on preferium.com is described separately in the Privacy Notice. This public DPA is not evidence that every listed function or subprocessor is used for a particular Customer.

Preferium limits access to what the role requires and ensures that persons with access are bound by a statutory or contractual duty of confidence and receive relevant privacy and security instruction. Access is removed or changed when the need ends.

Preferium maintains risk-based technical and organizational measures for the agreed processing. The measures below are agreed requirements. Which specific controls are implemented, which systems they cover and which provider relationships are confirmed is documented separately, for Preferium AI Edge and for preferium.com, in the Trust and Security page. A mention in this DPA is not by itself evidence that a control is in operation.

The requirements include at least:

• TLS in transit and provider-supported encryption at rest where suitable
• encrypted storage of third-party tokens and handling of secrets outside source code
• role- and tenant-based access, least privilege and multi-factor authentication where supported
• environment separation, secure development, dependency control and patching
• security, error and audit logging with data minimisation
• backup and recovery under a documented architecture and provider agreements
• incident handling, provider assessment and continuity or fail-safe controls where implemented
• deletion and retention jobs with verification that they are actually operating

Preferium does not promise ISO 27001, SOC 2, an annual external penetration test, three independent backup systems or any other control that is not expressly confirmed as active. Measures may change as long as overall security is not materially reduced. A material reduction is notified.

On conclusion of the DPA the Customer gives general written authorization to the subprocessors identified in the register version tied to the agreement, for the processing stated there. Preferium enters into agreements that impose equivalent data-protection obligations and remains responsible for their processing as Article 28(4) GDPR requires.

A new or replacement subprocessor is notified at least 30 days before it starts processing. The Customer may object on reasonable data-protection grounds within 14 days. If no reasonable solution exists, the Customer may terminate the affected Service before the change takes effect and receive a proportionate refund of unused prepaid fees; this is the Customer's sole remedy for a subprocessor change to which it objects. Necessary emergency changes are notified without undue delay.

The 30-day and 14-day periods are agreed periods. Publishing a new list is not by itself notice to the Customer. We document the recipient, the content and dispatch of the notice, relevant delivery information, objections and the decision before ordinary activation. An emergency change requires a documented reason and subsequent notice without undue delay.

Preferium does not carry out a restricted transfer without a valid basis. Where an adequacy decision or verified participation in the EU-US Data Privacy Framework does not cover the transfer, the relevant completed module of the EU standard contractual clauses with annexes and a transfer assessment is used. For a restricted transfer covered by UK data-protection law, a valid UK transfer basis is used; where standard clauses are required, this may be the current UK Addendum to the EU standard contractual clauses or the IDTA, with the necessary assessment of protection and any supplementary measures. The EU standard contractual clauses alone are not sufficient as UK standard clauses.

The Customer mandates Preferium to conclude Module 2 where the Customer is a controller and Module 3 where the Customer is a processor, to the extent necessary. The applicable instrument and relevant non-security-sensitive information are provided on request. The reference alone does not replace execution of the instrument.

A transfer basis is assessed for the actual recipient, processing and access. A country designation, a certification scheme or a standard agreement does not by itself confirm that the specific transfer is covered. The necessary instruments must be bindingly concluded and documented before the transfer takes place. Conclusion may follow from a valid agreement that incorporates the instrument; a separately signed PDF is not a universal requirement.

Preferium provides reasonable assistance with data subjects' requests, security, DPIAs, prior consultation and dialogue with authorities, taking into account the nature of the processing and the information we have. We normally do not answer directly on the Customer's behalf without instruction, but forward requests.

The Customer must identify the correct workspace, End Customer and controller. Extraordinary work may be invoiced at the agreed rate where the assistance is not caused by Preferium's breach, but mandatory minimum assistance cannot be refused for non-payment.

Preferium notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and aims to give a first preliminary notice within 24 hours where possible. The notice will progressively contain the known event, the affected data and data subjects, the likely consequences, the measures taken and a contact point. Information may be given in stages.

Preferium documents the incident and cooperates reasonably. The Customer is responsible for its own notifications to authorities and data subjects, unless the law or the parties' actual roles say otherwise. A notice is not an admission of liability.

The 24-hour target for the first customer notice is an agreed target, not a deadline; missing it is not by itself a breach of this DPA and does not change the duty to notify without undue delay. The Customer's own deadline for notifying the supervisory authority and its duty to inform affected persons are assessed separately. Acceptance by an email provider does not by itself document that the recipient has received or read the notice.

Preferium makes the necessary information available and contributes to audits under Article 28 GDPR. A routine audit normally takes place once a year, with 30 days' notice, remote-first and without access to other customers' data, source code or vulnerability details. Independent reports may be used where they cover the relevant service, period and control.

The limitations do not apply where a competent authority or the law requires an audit, after a relevant breach, or where there is credible evidence of material non-compliance. Audits must be proportionate, confidential and minimally disruptive. The Customer bears ordinary costs; Preferium bears reasonable costs if a material deviation is confirmed.

On termination the Customer selects return/export and deletion under the switching rules of the Service Terms, unless the law requires retention. Active optimization, frozen edge serving, the Dashboard account and stored personal data are treated as separate matters. Cancellation of the subscription alone does not end this DPA as long as Preferium continues to process personal data as part of expressly agreed Frozen Delivery, transition or deletion.

Frozen Delivery is a continued, limited Service and processor relationship only where it is expressly selected or earned under the Order. It covers only the data needed to serve the last approved configuration, security and uptime. The Customer may at any time require express technical disconnection, export and deletion.

On technical termination, export is made available during the transition period and for at least 30 days afterwards. Production data is deleted or anonymised under the agreed process. A fixed deletion deadline is not confirmed until the operational deletion mechanism is verified; if 30 days are agreed and cannot be met, the data is restricted, the Customer is notified and correction is prioritised. Backups expire by ordinary rotation. Statutory records and necessary evidence for legal claims are isolated and used only for that purpose.

On request Preferium confirms deletion in writing. The Customer is responsible for its own copies and for giving End Customers correct information.

A deletion confirmation must state which system, which data and which action it concerns. Blocking of ordinary access, deletion from active systems and later expiry of isolated backups are different matters. Any remaining copies, processing restrictions, deadlines and lawful exceptions are stated in the confirmation. Closing a case is not by itself documentation of deletion in another system.

Where Preferium is a "service provider" or "contractor" under the CCPA/CPRA, the specific, limited business purposes and processing activities must be stated in the Order and the description of processing. A general reference to the whole agreement is not sufficient. Preferium provides the level of privacy protection the law requires and processes the personal information only for the stated purposes.

Preferium does not sell or share this personal information; does not retain, use or disclose it outside the direct business relationship or for incompatible commercial purposes; and does not combine it with other data sets except as a lawful exception permits. Preferium's own processing as an independent controller is not covered by this limited provider role.

Where Preferium acts as a "contractor", Preferium certifies that it understands and will comply with these restrictions. The Customer is notified of new subcontractors, which are bound by equivalent written requirements. Preferium assists with relevant consumer requests and with security and risk assessments as the applicable rules require.

Preferium notifies the Customer if it can no longer meet its obligations. The Customer may take reasonable and appropriate steps to verify compliance and may require unauthorized use to stop and be remediated. This Section applies only where the processing and the parties' roles fall within California Civil Code §§ 1798.100 and 1798.140 and the related regulations. It is not a general confirmation of CCPA/CPRA compliance for every service.

Sections 15 to 17 of the Service Terms (warranties, indemnities and limitation of liability), including the aggregate cap and its exceptions, apply to all claims under or in connection with this DPA, whether in contract, tort or otherwise, and whether the Customer acts as controller or as processor. To the extent the law permits, a party's recourse claim against the other under Article 82(5) GDPR for compensation paid to data subjects is subject to that cap and is not increased by the number of End Customers, controllers or data subjects concerned. Preferium is not liable for processing carried out in accordance with the Customer's documented instructions, for the lawfulness of the Customer's or an End Customer's purposes, legal basis or information to data subjects, or for data the Customer was not entitled to give Preferium. This does not restrict the powers of supervisory authorities, the rights of data subjects or liability that cannot be limited, and does not change the parties' external liability under Article 82 GDPR.

The DPA is governed by the choice of law and venue in the Service Terms. Where this DPA and the Service Terms conflict on the processing of personal data, this DPA prevails. The contract language and the specific DPA version are recorded in the Order or the acceptance record. A new text published on this website does not automatically change a DPA already concluded.

Preferium AS · organization no. 999 323 286 · Sponheimveien 19, 1613 Fredrikstad, Norway · info@preferium.com.

The Customer's legal name, organization or registration number, address, contact, role (controller/processor), End Customer controllers where relevant, agreement version, acceptor, confirmation of authority and time of acceptance must appear in the Order, the signature or the electronic acceptance log.