Data processing agreement

Processor

ArenOrg AS, organisation number {{SUPPLIER_ORG_NUMBER}}, {{SUPPLIER_ADDRESS}} (the "Supplier")

Controller

The Customer named in the subscription agreement

Contact

contact@arenorg.com

The Customer is the controller of personal data in Customer Data and decides the purposes and means of its processing. The Supplier processes it as processor.

Personal data the Supplier processes for its own purposes in running the customer relationship — billing, support correspondence and the accounts of contact persons — is outside this agreement and is described in the privacy notice at https://4auditee.com/privacy.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.

The Supplier processes personal data only on the Customer's documented instructions, including with regard to transfers outside the EEA, unless required to do otherwise by EEA or Norwegian law, in which case it informs the Customer before processing unless the law prohibits this. The agreement, and the Customer's configuration and use of the Service, are the Customer's documented instructions.

The Supplier informs the Customer without delay if, in its opinion, an instruction infringes data protection law. The Supplier does not sell personal data or use it for its own purposes, and does not use Customer Data to train its own models.

The Supplier ensures that persons authorised to process the personal data have committed to confidentiality or are under an appropriate statutory obligation. Access to personal data in Customer Data is limited to authorised personnel who need it to provide, secure or support the Service, and to what that task requires; support that involves viewing Customer Data is given at the Customer's request. The Supplier's administrator accounts in the Service are not given access to the content of the Customer's Workspace.

The Supplier implements the technical and organisational measures in Annex II to ensure a level of security appropriate to the risk, as required by Article 32 GDPR, and keeps them under review. The Supplier may change the measures provided the overall level of security is not reduced.

The Customer gives general authorisation for the Supplier to engage Sub-processors. The current list, with each Sub-processor's service, location and the personal data it processes, is published at https://4auditee.com/subprocessors.

The Supplier gives the Customer at least 30 days' notice before a new Sub-processor begins processing personal data in Customer Data. The Customer may object within that period on reasonable data protection grounds. The parties will then discuss the objection in good faith. If it cannot reasonably be resolved, the Customer may terminate the affected part of the Service with effect from the date the new Sub-processor would begin, and the Supplier refunds the fees paid for the terminated part for the remaining, unused part of the Subscription Term.

The Supplier imposes on each Sub-processor, by contract, data protection obligations no less protective than those in this agreement, and remains fully liable to the Customer for the Sub-processor's performance of them.

Taking into account the nature of the processing, the Supplier assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects. The Service lets the Customer find, correct, export and delete most personal data itself. Where it cannot, the Supplier assists promptly, so that the Customer can respond within the time the GDPR requires. A request received directly by the Supplier is forwarded to the Customer without undue delay and is not answered by the Supplier on the Customer's behalf.

Taking into account the nature of the processing and the information available to it, the Supplier assists the Customer in meeting its obligations under Articles 32 to 36 GDPR: security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments, and prior consultation with the supervisory authority. Assistance beyond providing the information in this agreement and the Documentation may be charged at reasonable rates agreed in advance.

The Supplier notifies the Customer without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting Customer Data. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The Supplier provides further information as it becomes available and takes reasonable steps to contain the breach and limit its effects. Notifying the supervisory authority and data subjects is the Customer's responsibility as controller.

During the agreement the Customer can export Customer Data as Appendix 1, section 3 describes. For 30 days after the agreement ends the Customer can still export it. After that period the Supplier deletes all personal data in Customer Data within 30 days, unless EEA or Norwegian law requires it to be kept, and confirms the deletion in writing on request. Personal data in backups is deleted as the backups expire under the retention cycle in Annex II, and is not restored to active use in the meantime.

The Supplier makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, including answers to reasonable security questionnaires. If that information is not sufficient, the Customer, or an independent auditor bound by confidentiality, may audit the Supplier's compliance with this agreement on at least 30 days' notice, during business hours and no more than once a year, unless a personal data breach or a supervisory authority requires otherwise. Each party bears its own costs, unless the audit shows a material breach by the Supplier.

The Supplier does not currently hold an ISO/IEC 27001 certification or a SOC 2 report.

The Service is operated from the EU. Personal data is transferred outside the EEA only where a transfer mechanism under Chapter V GDPR applies — an adequacy decision of the European Commission or, where none applies, the Commission's standard contractual clauses with supplementary measures where required. The Sub-processor list states the location of each Sub-processor and the mechanism relied on. Customer Data is hosted in the EU; where the AI Features are used, submitted content is processed by the AI provider in the United States.

This agreement applies for as long as the Supplier processes personal data on the Customer's behalf. For anything concerning personal data it prevails over Appendix 1. Liability under this agreement is subject to Appendix 1, section 15.

Subject matter and nature

Hosting and operating a quality management system for the Customer: storing, organising, displaying, exporting and deleting Customer Data, sending notifications, generating documents and reports, and — where the AI Features are used — sending submitted content to an AI provider and returning its output.

Purpose

To provide the Service to the Customer under the agreement.

Duration

The Subscription Term, the export period after it, and the deletion period in section 10.

Categories of data subjects

• the Customer's employees, contractors and other Users;
• employees named in competence, training and audit records, whether or not they are Users;
• external auditors and certification-body staff given access to an auditor portal;
• visitors who sign in at the Customer's sites;
• other persons named by the Customer in documents, findings, incidents, complaints or other records.

Types of personal data the Service is designed to process

• identity and contact details: name, work email, mobile number, job title, employer;
• organisational details: site, department, role and permissions;
• competence data: qualifications, certificates, training completions, exam results, competence requirements, gaps and expiry dates;
• records in which persons appear: documents and approvals, audit findings, non-conformities, incidents and complaints, corrective actions, risk assessments, and photographs attached as evidence;
• visitor data: name, employer, host, vehicle, arrival and departure times, and — where the site uses it — a yes/no health declaration;
• technical data: sign-in times, IP addresses and audit trails of who changed what.

Special categories of personal data

The only special category of personal data the Service is designed to process is the visitor health declaration described above, kept for the period in the retention schedule. Users can enter other information in free-text fields and attachments, including information about health, performance or conduct. The Customer decides what its Users may enter and is responsible for doing so lawfully.

Retention schedule

The Service deletes the following automatically after the period shown. These are the default values the deletion routine applies; a site may set its own period for its visitor records. Changes to the schedule are notified under Appendix 1, section 17.

Visitor records

180 days

Visitor health declarations

14 days

Auditor portal access logs

365 days (1 year)

Read notifications

180 days

Sign-in and password-reset tokens

7 days

Support tickets

365 days (1 year)

Quality records — documents, competence records, audits, findings and risk assessments — are kept for as long as the Customer keeps them during the agreement, because their retention is set by the Customer's certification and regulatory requirements.

Separation of customers

Requests are restricted to the Customer's own organisation by access controls applied in shared application code. Automated integration tests, including tests that attempt to reach another organisation's data, run against a real database for each change to the main code line.

Access control and authentication

• role-based permissions, checked on the server;
• passwords stored as bcrypt hashes; changing or resetting a password ends the account's other sessions;
• rate limiting on sign-in, password reset and other sensitive functions;
• external auditors receive a scoped, expiring link to the information the Customer selects, and each access is logged;
• the Supplier's administrator accounts in the Service are not given access to Workspace content.

Single sign-on and enforced multi-factor authentication are not currently available.

Encryption

• traffic is encrypted in transit with HTTPS, and the application sends HTTP Strict Transport Security headers;
• the database (Neon) and file storage (Cloudflare R2) encrypt all stored data at rest;
• credentials for connected services, such as AI provider keys and single sign-on secrets, are encrypted in the database with AES-256-GCM under a separate application key.

Hosting

The application runs on Vercel in Frankfurt, the database on Neon in Frankfurt (eu-central-1), and uploaded files are stored in Cloudflare R2's EU jurisdiction.

Logging and traceability

Document approvals, competence decisions, audit findings, changes to the Subscription and administrative actions are recorded with who performed them and when. These records cannot be edited through the Service. Application errors are reported to an error monitoring service listed as a Sub-processor.

Backups and recovery

The database is backed up daily. Backups are kept for 30 days, stored separately from the production database, and restored using a documented procedure.

Deletion

Data is deleted automatically under the retention schedule in Annex I. Visitor and prospect data can also be erased on request by phone number or email address.

Assurance

The Supplier does not currently hold an ISO/IEC 27001 certification or a SOC 2 report, and no independent penetration test has been completed. The Supplier will inform customers when this changes.