Data Processing Agreement

1. Parties and background

This data processing agreement is between you as controller and Ordinem Group ApS, CVR 44358212, Karl Bjarnhofs Vej 13, 7120 Vejle Øst, Denmark as processor, under Article 28 of the GDPR. It applies to Team accounts and other business customers that use Newrise to process personal data about their own customers, colleagues or other data subjects. Contact: hej@newrise.dk.

The agreement forms part of the Newrise terms. If you create a Team account or use Newrise as a business, you accept this agreement. Solo accounts that only process your own data are not covered as a starting point.

2. Subject matter, nature and duration

We process personal data to provide Newrise: a desk for contacts, deals, projects, tasks, notes and time. Processing means hosting, displaying, searching, backing up and, on your instruction, sending data on, for example to Pastinak. Processing lasts while the account is active and then for as long as needed to delete or return the data.

3. Types of data and data subjects

We process the data you enter. That may be name, email, phone, address, company name, title, notes, tasks, time and the other fields Newrise provides. Data subjects are typically your customers, leads, partners and staff. You must not enter special-category data (for example health data) unless you have a lawful basis and have instructed us in writing. Newrise is not built for that.

4. Instructions

We process the data only on your documented instructions, as expressed by your use of Newrise and by this agreement, unless EU or Danish law requires otherwise. If so, we will tell you if the law allows it. We do not use your account content for our own purposes.

5. Confidentiality and security

We ensure that people who process the data are under a duty of confidentiality. We take appropriate technical and organisational measures, including access control, encryption in transit, access only for those who need it, logs and backups. Data is hosted in the EU.

6. Sub-processors

You give us a general authorisation to use sub-processors. We use them for:

• Hosting in the EU.
• Payment, to the extent the payment processor processes data on your behalf for the subscription.
• Email delivery when you or we send mail as part of the service.

We put written terms in place that impose the same data-protection obligations on sub-processors. We will tell you about planned changes so you can object. If you object on valid grounds and we cannot continue without that party, you may cancel Newrise.

7. Transfers outside the EU/EEA

Newrise account content is hosted in the EU. If a transfer outside the EU/EEA happens, it will only be on a valid transfer basis, and we will inform you.

8. Assistance

Taking into account the nature of the processing, we help you meet your duties to data subjects and to comply with Articles 32 to 36, including security, breach notification, impact assessments and prior consultation. Help is given to the extent the data is in Newrise and you cannot retrieve it in the product yourself.

9. Breaches

We will notify you without undue delay after becoming aware of a personal-data breach that concerns your data. We will give the information you reasonably need to meet your notification duties.

10. Audits

We will make available the information needed to demonstrate compliance with Article 28 and allow for audits, including inspections, by you or an auditor you mandate. Audits are notified with reasonable notice, take place in ordinary working hours and must not put other people's security or confidentiality at risk. We may meet the requirement with adequate third-party reports where that is reasonable.

11. Deletion and return

When you cancel the account or ask us to, we will delete or return your account content at your choice, unless EU or Danish law requires us to keep it. Deletion happens within a reasonable time after the account is closed.

12. Your duties

You have a valid legal basis for the data you enter. You give us the instructions we need. You use Newrise so that you do not require processing the product is not built for.

13. Governing law

The agreement is governed by Danish law. Disputes may be brought before the Danish courts.