Data Processing Agreement – Fenster ApS

This Data Processing Agreement ("Agreement") forms part of the Contract for Services ("Principal Agreement") between

and

the legal entity that creates an account for or uses the Services via www.fenster.dk (the “Customer” or “Company”) (the “Controller”)

(together as the “Parties”)

WHEREAS

• (A) The Company acts as a Data Controller.
• (B) The Company wishes to subcontract certain Services, which imply the processing of personal data, to the Data Processor.
• (C) The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
• (D) The Parties wish to lay down their rights and obligations.

IT IS AGREED AS FOLLOWS:

1. Definitions and Interpretation

1.1 Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:

• 1.1.1 "Agreement" means this Data Processing Agreement and all Schedules;
• 1.1.2 “Company Personal Data” means any Personal Data Processed by Data Processor and/or its Subprocessors on behalf of Company pursuant to or in connection with the Principal Agreement.
• 1.1.3 "Data Protection Laws" means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;
• 1.1.4 "EEA" means the European Economic Area;
• 1.1.5 "EU Data Protection Laws" means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR;
• 1.1.6 "GDPR" means EU General Data Protection Regulation 2016/679;
• 1.1.7 “Data Transfer” means any transfer of Company Personal Data to a recipient in a country outside the EU/EEA.
• 1.1.8 "Services" means the software-as-a-service solution made available by Data Processor to Company via www.fenster.dk (including associated hosting, storage, maintenance, technical support and security monitoring)
• 1.1.9 "Subprocessor" means any person appointed by or on behalf of Data Processor to process Personal Data on behalf of the Company in connection with the Agreement.

1.2 The terms, "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.

2. Processing of Company Personal Data

2.1 Compliance and instructions. Data Processor shall Process Company Personal Data in accordance with applicable Data Protection Laws and only on documented instructions from Company as set out in this Agreement, the Principal Agreement, any Schedules, and Company’s use and configuration of the Services. Where Data Processor is required by applicable law to Process Company Personal Data other than on Company’s instructions, Data Processor shall (to the extent permitted by law) inform Company of that legal requirement.

2.2 Operational processing. Company instructs Data Processor to Process Company Personal Data as necessary to provide, secure, monitor, maintain and support the Services, including: (a) hosting and storage; (b) backups and disaster recovery; (c) logging and monitoring; (d) fraud/abuse prevention; (e) troubleshooting and customer support; and (f) implementing security updates and patches.

2.3 Technical and commercial feasibility. If Company issues an instruction that, in Data Processor’s reasonable opinion, is not technically feasible, is outside the scope of the Services, or would require material changes to the Services or disproportionate effort, Data Processor shall promptly inform Company. The Parties will discuss in good faith a workable alternative, and Data Processor may charge reasonable fees for additional work as agreed under the Principal Agreement.

2.4 Assistance on request. Any assistance by Data Processor under this Agreement (including in relation to Data Subject requests, audits, or DPIAs) shall be provided to the extent reasonably possible and proportionate, taking into account the nature of the Services and the information available to Data Processor, and may be subject to reasonable charges where such assistance is beyond the standard Services. Data Processor may fulfil assistance obligations by providing standard documentation and information made generally available by Data Processor, and Data Processor is not required to complete customer-specific questionnaires or assessments unless separately agreed in writing.

2.5 Unlawful instructions. Data Processor shall notify Company if Data Processor believes that an instruction infringes Data Protection Laws, and Data Processor is not required to comply with such instruction.

2.6 Analytics and machine learning for service improvement. Company instructs Data Processor to Process Company Personal Data for the purpose of generating analytics, statistics and insights, and for developing, training and improving models and functionality (including using machine learning techniques), in each case to operate, maintain, secure, develop and improve the Services. Such Processing may include analysis of any business data processed in the Services. Data Processor shall implement appropriate safeguards, including restricting access to authorised personnel on a need-to-know basis and using aggregation and/or pseudonymisation where reasonably practicable.

2.7 Aggregated output. Data Processor may use results of the Processing under section 2.6 across customers, provided that any outputs made available outside the Company’s account (e.g., benchmarks, statistics or similar) are aggregated and do not identify the Company or any Data Subject.

2.8 No marketing use. Data Processor shall not use Company Personal Data for advertising or marketing purposes directed at Data Subjects.

3. Data Processor Personnel

3.1 Data Processor Personnel. Data Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor of the Data Processor who may have access to the Company Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Company Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Data Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

4. Security

4.1 Technical and Organizational Measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Data Processor shall in relation to the Company Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

4.2 Risks. In assessing the appropriate level of security, Data Processor shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.

4.3 Security Measures. The technical and organisational measures implemented by Data Processor are described in Schedule 2 (Security Measures).

5. Subprocessing

5.1 General authorisation. Company grants Data Processor a general authorisation to appoint Subprocessors to Process Company Personal Data for the purpose of providing the Services.

5.2 Current Subprocessors and updates. A list of current Subprocessors (including their functions and locations) is made available at https://partner.fenster.dk/legal/subprocessors. Data Processor may update the Subprocessor List from time to time.

5.3 Notification and objection. Data Processor will provide notice of any intended addition or replacement of a Subprocessor by updating the Subprocessor List and, where reasonably practicable, by email or in-product notification at least 15 days in advance. Company may object in writing within the notice period on reasonable and documented grounds relating to data protection. If Company objects, the Parties will discuss in good faith a solution. If no solution is reasonably available, Company may terminate the Services on written notice, without penalty, as its sole and exclusive remedy for such objection.

5.4 Flow-down obligations. Data Processor shall enter into a written agreement with each Subprocessor imposing data protection obligations that are no less protective than those set out in this Agreement, including appropriate technical and organisational measures, confidentiality, and obligations regarding Personal Data Breaches.

5.5 Liability. Data Processor remains responsible for the performance of each Subprocessor’s obligations to the same extent as if Data Processor had performed the services of the Subprocessor directly under this Agreement.

5.6 Cross-border transfers. Where a Subprocessor is located outside the EU/EEA and Processing involves a Data Transfer, Data Processor shall ensure that such Data Transfer is subject to an appropriate transfer mechanism under Data Protection Laws (including, where applicable, the EU Standard Contractual Clauses) and that supplementary measures are implemented where required. Company authorises Data Processor to enter into such transfer arrangements on Company’s behalf where permitted.

5.7 Emergency changes. Data Processor may appoint a new Subprocessor without prior notice where required to address an urgent security issue, prevent service disruption, or comply with law, provided that Data Processor notifies Company as soon as reasonably practicable thereafter.

5.8 Onward assistance. Upon Company’s reasonable request, Data Processor will provide information available to it regarding Subprocessors to demonstrate compliance with this section 5.

6. Data Subject Rights

6.1 Assistance. Taking into account the nature of the Processing, Data Processor shall assist the Company by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Company obligations, as reasonably understood by Company, to respond to requests to exercise Data Subject rights under the Data Protection Laws.

6.2 Data Processor shall:

• 6.2.1 promptly notify Company if it receives a request from a Data Subject under any Data Protection Law in respect of Company Personal Data; and
• 6.2.2 ensure that it does not respond to that request except on the documented instructions of Company or as required by Applicable Laws to which the Data Processor is subject, in which case Data Processor shall to the extent permitted by Applicable Laws inform Company of that legal requirement before the Data Processor responds to the request.

7. Personal Data Breach

7.1 Notification of breach. Data Processor shall notify Company without undue delay upon Data Processor becoming aware of a Personal Data Breach affecting Company Personal Data, providing Company with sufficient information to allow the Company to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.

7.2 Cooperate and assist. Data Processor shall co-operate with the Company and take reasonable commercial steps as are directed by Company to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

8. Data Protection Impact Assessment and Prior Consultation

Data Processor shall provide such information and reasonable assistance as the Company may request in connection with data protection impact assessments and prior consultations under Articles 35–36 GDPR, limited to Processing carried out by Data Processor and taking into account the nature of the Services and the information available to Data Processor. Data Processor may satisfy this obligation by providing existing documentation (e.g., security and Subprocessor information). Any assistance requiring material additional work shall be subject to separately agreed fees and timelines. For the avoidance of doubt, Data Processor is not required to complete customer-specific DPIA templates or questionnaires unless separately agreed in writing.

9. Deletion or return of Company Personal Data

9.1 Delete or return. Upon termination or expiry of the Services, Data Processor shall delete Company Personal Data within 90 days. Where the Services include a standard self-service export functionality, the Company is responsible for exporting, prior to termination, the data made available for export through such functionality. Any additional return or export of Company Personal Data beyond the standard self-service export functionality shall only be provided if separately agreed in writing (including applicable fees and timelines) and where reasonably practicable.

9.2 Retention. Data Processor may retain Company Personal Data to the extent required by applicable law or as necessary to establish, exercise or defend legal claims. Company Personal Data may also be retained in backups and logs in accordance with Data Processor’s standard backup/retention cycles (up to 180 days), provided that such data remains protected and is not otherwise Processed except for storage and security purposes. Backup data is not restored except for disaster recovery purposes, and any Company Personal Data restored from backups will be deleted again as soon as reasonably practicable.

9.3 Confirmation. Upon the Company’s written request, Data Processor shall provide written confirmation that deletion under section 9.1 has been completed, excluding any data retained under section 9.2.

10. Audit rights

10.1 Documentation. Upon written request, Data Processor will make available to the Company information reasonably necessary to demonstrate compliance with this Agreement. Data Processor may satisfy this obligation by providing existing documentation and materials (e.g., Schedule 2 (Security Measures), Subprocessor List, policies, incident procedures, and written responses).

10.2 No on-site audits. The Company is not entitled to conduct on-site audits or inspections. On-site access shall only be provided if and to the extent required by a competent supervisory authority under applicable Data Protection Laws.

10.3 Remote review only. Any permitted audit shall be conducted remotely and limited to a review of the documentation provided under section 10.1 and reasonable written Q&A, and shall not include penetration testing, vulnerability scanning, source code review, or access to Data Processor’s systems.

10.4 Frequency and notice. Audits may be requested no more than once per 36-month period and require at least 45 days’ prior written notice.

10.5 Auditor requirements. Any auditor must be independent, bound by confidentiality, and may not be a competitor of Data Processor. Data Processor may require reasonable evidence of the auditor’s appointment and confidentiality commitments.

10.6 Costs. The Company shall bear all costs of the audit and shall reimburse Data Processor for time spent assisting at Data Processor’s then-current rates.

10.7 Findings. The Company shall provide Data Processor with the audit results. Data Processor will remedy any material non-compliance within a reasonable time.

11. Data Transfer

11.1 Data Transfers. Company provides its prior authorisation for transfers of Company Personal Data outside the EU/EEA as necessary for the provision of the Services, including via Subprocessors, as described in the Subprocessor List. Any such transfers shall be carried out in accordance with section 5.6.

12. General Terms

12.1 Confidentiality. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement (“Confidential Information”) confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that: (a) disclosure is required by law; (b) the relevant information is already in the public domain.

12.2 Notices. All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by post or sent by email to the address or email address set out in the heading of this Agreement at such other address as notified from time to time by the Parties changing address. Notices to the Company may be sent to the primary admin email associated with the Company account.

12.3 Company identification. The Company is identified by the account registration details submitted to Data Processor (including legal name, registered address, VAT/CVR or other company registration number where provided, and the primary admin email), which form part of the Parties’ Contract.

12.4 Acceptance record. Data Processor may maintain records of the Company’s acceptance of this Agreement (including date/time, user account and Agreement version) for evidentiary purposes.

12.5 Acceptance (electronic). This Agreement is entered into electronically and becomes effective when the Company (i) creates an account for the Services, (ii) clicks “I accept” (where presented), or (iii) accesses or uses the Services after being presented with or given access to this Agreement (e.g., via a link in the signup flow or the Principal Agreement). The individual accepting represents that they have authority to bind the Company.

12.6 No signature required. This Agreement does not require a handwritten signature and is effective in accordance with section 12.5.

13. Governing Law and Jurisdiction

13.1 This Agreement is governed by the laws of Denmark.

13.2 Any dispute arising in connection with this Agreement, which the Parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the courts of Lyngby.

Schedule 1 – Description of Processing

• Subject matter. Provision of the Services (SaaS platform) to Company.
• Duration. For the term of the Principal Agreement and until deletion in accordance with section 9.
• Nature of processing. Hosting, storage, retrieval, viewing, organisation, transmission (as configured by Company), logging, backup, deletion, and support/troubleshooting as necessary to provide the Services.
• Purpose(s). Providing, operating, securing, maintaining and supporting the Services, and performing analytics and model/functionality improvement as described in section 2.6.
• Categories of Data Subjects. Company’s authorised users and any individuals whose Personal Data is uploaded or otherwise processed through the Services by Company (e.g., Company’s customers, employees, suppliers).
• Types of Personal Data. As determined by Company and may include identification and contact data (name, email, phone), account and access data (user ID, role/permissions), content/data uploaded by Company and its users, and technical/log data (e.g., IP address, timestamps).
• Special categories. The Services are not intended for Processing of special categories of Personal Data (Article 9 GDPR) or Personal Data relating to criminal convictions and offences (Article 10 GDPR). The Company shall not upload or otherwise make such data available to Data Processor unless the Parties have separately agreed in writing on additional safeguards and instructions.
• Processing locations. As set out in the Subprocessor List and Data Processor documentation.

Schedule 2 – Security Measures

Data Processor implements technical and organisational measures designed to ensure a level of security appropriate to the risk (GDPR Article 32), including the following measures:

• Access control and confidentiality. Access to production systems and Company Personal Data is restricted to authorised personnel on a need-to-know basis and subject to confidentiality obligations.
• Logical access controls. Logical access controls are applied, including role-based permissions and least-privilege principles where applicable.
• Encryption in transit. Company Personal Data is protected in transit using industry-standard encryption (e.g., TLS).
• Monitoring and logging. Systems are monitored for availability and security events; relevant logs are collected and retained for a limited period.
• Backups and restore. Regular backup procedures are in place and restore processes are tested on a periodic basis.
• Vulnerability and patch management. Security updates and patches are applied as part of ongoing maintenance and vulnerability remediation processes.
• Incident response. Incident response procedures are in place to detect, investigate and manage security incidents, including Personal Data Breaches, and to notify the Company in accordance with this Agreement.