Data Processing Agreement
This Data Processing Agreement ("DPA") is part of the agreement between the Customer ("Controller") and Skiwo AS, operating BufferDesk ("Processor"), and meets the requirements of Article 28 of the GDPR. A signed copy is available on request.
1. Subject and purpose
The Processor processes personal data only to provide BufferDesk: receiving SuperOffice requests the Controller's users send to it, reading the purchase orders in them, matching buyers and lines against the Controller's Visma.net customers and items, writing sales orders on Hold into the Controller's Visma.net, emailing the Controller's order address, and reading released orders back to measure accuracy.
2. Data subjects and data
- Data subjects: people who send purchase orders to the Controller and people named in them; the Controller's users; contact persons at the Controller's customers as held in Visma.net.
- Data: names, business email addresses and phone numbers, signatures and names on purchase orders, delivery details, the content of requests and attachments, Visma.net customer and item records, and logs.
3. Duration
For the term of the agreement. On termination, the Processor deletes or returns the personal data at the Controller's choice, unless the law requires it to be kept.
4. The Processor's obligations
- Process personal data only on the Controller's documented instructions, which are the agreement, this DPA and the Controller's settings in BufferDesk.
- Ensure that people authorised to process the data are bound by confidentiality.
- Implement the security measures in section 5.
- Engage sub-processors only as set out in section 6.
- Assist the Controller with data subjects' requests and with its obligations under GDPR articles 32–36.
- Make available the information needed to show compliance with this DPA and allow audits under section 8.
5. Security measures
- Encryption in transit (TLS) and HSTS.
- Sign-in by one-time codes that expire after 15 minutes; codes and session tokens stored only as SHA-256 digests; sessions end after 24 hours idle and 7 days at most.
- Separate access tokens per customer for the SuperOffice scripts and web panel.
- Separation of each customer's data; an activity log of sign-ins and of changes to members and settings.
- Hosting and database in the EU, with the hosting provider's continuous database backups.
- Every order written to Visma.net is written on Hold; the Processor never releases one.
6. Sub-processors
The Controller authorises the following sub-processors. The Processor informs the Controller before adding or replacing one, giving it the opportunity to object, and binds each to obligations equivalent to this DPA. The Processor remains responsible for them.
| Sub-processor | Processing | Location |
|---|---|---|
| Heroku (Salesforce, Inc.) | Hosting, database and managed AI inference | EU region |
| Anthropic, via Heroku managed inference | Reading purchase orders with a language model | Heroku's EU inference |
| Amazon Web Services (SES, S3) | Email delivery; storage of purchase-order attachments | EU (Frankfurt) |
SuperOffice and Visma.net are the Controller's own systems. The Processor reads from and writes to them on the Controller's instruction; they are not sub-processors of the Processor.
7. Transfers
Personal data is stored and processed in the EU/EEA. A transfer outside it requires the Controller's prior authorisation and appropriate safeguards under GDPR Chapter V, such as the Standard Contractual Clauses.
8. Breach notification and audits
The Processor notifies the Controller without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach, with what is known of its nature, scale, likely consequences and the measures taken.
The Controller may audit compliance on at least 30 days' notice, during business hours, no more than once a year, without unreasonably disrupting the Processor's operations.
9. Liability and law
Liability follows the limitations in the main agreement, except where the law does not allow it to be limited. This DPA is governed by Norwegian law, with Oslo District Court as venue unless mandatory law provides otherwise.
10. Contact
Skiwo AS, Pilestredet 17, 0164 Oslo, Norway · support@bufferdesk.com