Data Processing Agreement for Toolcape

Version 1.0, effective from 4 November 2026

This is a translation. The Norwegian version of the agreement applies (clause 18 and clause 18.3 of the customer terms).

This data processing agreement forms part of the Agreement between the Customer, as controller, and Dyst, as processor, under the customer terms for Toolcape. It is entered into when the Customer accepts the Agreement. Capitalised words have the same meaning as in the customer terms. Terms from the General Data Protection Regulation (GDPR) have the same meaning as there.

1. Purpose and relationship to the customer terms

1.1 This agreement governs Dyst's processing of personal data on behalf of the Customer when Dyst delivers the Service, and shall meet the requirements of Article 28 of the GDPR.

1.2 In case of conflict, this agreement prevails over the customer terms for duties when processing personal data. Liability, including liability for subprocessors and recourse claims, is governed exhaustively by clauses 12 and 13 of the customer terms, even if this agreement should provide otherwise.

1.3 Dyst processes data about the Customer's account, the Users' accounts and logins, invoicing, acceptance of terms and security logs as an independent controller, as described in the privacy policy. This agreement does not apply to such data.

2. The processing

The subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects are set out in annex 1.

3. Instructions

3.1 The Agreement, this data processing agreement, the Customer's settings in the Service and the Users' actions in the Service are the Customer's complete, documented instructions, also regarding transfers to countries outside the EEA.

3.2 Dyst processes the personal data only in accordance with these instructions, unless otherwise required by EEA law or Norwegian law. Dyst shall in that case notify the Customer before the processing, unless the law prohibits this.

3.3 Other instructions must be given in writing and lie within the Service's features. Dyst may charge for following them at its applicable hourly rates, or decline them. If Dyst declines an instruction, the Customer may terminate the Agreement.

3.4 Dyst shall immediately notify the Customer if Dyst considers that an instruction breaches data protection law, and may wait to follow it until the Customer has confirmed, amended or withdrawn it.

4. Confidentiality

Dyst shall ensure that everyone with access to the personal data is bound by a duty of confidentiality, also after they have stopped working for Dyst.

5. Security

5.1 Dyst shall implement technical and organisational measures that ensure a level of security appropriate to the risk, see Article 32 of the GDPR. The measures are set out in annex 2.

5.2 Dyst may change the measures as long as the overall level of security is not reduced. The Customer approves such changes in advance.

6. The Customer's duties

The Customer is responsible for the processing it instructs being lawful. This includes, among other things, the legal basis, also for special categories of personal data and data relating to criminal convictions and offences (Articles 9 and 10 of the GDPR), information to the data subjects, data protection impact assessments where required, and the data being correct. The Customer shall only enter special categories of personal data when necessary and lawful.

7. Subprocessors

7.1 The Customer gives general prior authorisation for Dyst to use subprocessors. The list of subprocessors, with service, place of processing and transfer basis, is at toolcape.com/en/subprocessors and is annex 3.

7.2 Dyst shall in a written agreement impose on each subprocessor essentially the same duties as follow from this agreement.

7.3 Dyst shall notify the Customer's Administrators by email at least 30 days before Dyst starts using a new subprocessor or replaces an existing one.

7.4 The Customer may object in writing within 14 days after the notice, on reasonable grounds relating to data protection. If the parties find no solution within 30 days, the Customer may terminate the affected Service with effect before the change is applied to the Customer's personal data. This is the Customer's only remedy in case of objection.

7.5 If Dyst must replace a subprocessor immediately for security or operational reasons, Dyst may do so and give notice as soon as possible. The Customer then has the same right to object.

7.6 Dyst is liable to the Customer for the subprocessors fulfilling their duties, within clause 12 of the customer terms.

8. Transfers to countries outside the EEA

8.1 Dyst transfers personal data to countries outside the EEA only to subprocessors on the list and only with a valid transfer basis under Chapter V of the GDPR, for example an adequacy decision, the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

8.2 Transfers to Connected Services take place on the Customer's instructions and at the Customer's responsibility, see clause 9.

9. Connected Services and Partners

9.1 Connected Services and Partners that the Customer gives access act for the Customer under the Customer's own agreements. They are not Dyst's subprocessors, and Dyst is not responsible for them.

9.2 By connecting a service or giving a Partner access, the Customer instructs Dyst to make personal data available to them as the Customer's settings permit. Once the data has been delivered, the Customer is responsible for it, including for transfers out of the EEA.

10. Assistance

10.1 Dyst forwards requests from data subjects that Dyst receives to the Customer without undue delay. Dyst does not answer the data subject itself unless the Customer asks it to.

10.2 Dyst assists the Customer in fulfilling the data subjects' rights and the duties under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultations with the Norwegian Data Protection Authority (Datatilsynet), as far as reasonable given the nature of the Service and the information available to Dyst. Assistance beyond the features of the Service and the general documentation is invoiced at the applicable hourly rates.

11. Personal data breaches

11.1 Dyst shall notify the Customer without undue delay, and as far as possible within 48 hours, after Dyst became aware of a personal data breach concerning the Customer's personal data.

11.2 The notification shall contain the information Dyst has at the time, as far as possible about the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Dyst supplements the notification as more becomes known.

11.3 The Customer assesses the breach and makes any notification to the Norwegian Data Protection Authority and communication to the data subjects. A notification from Dyst is not an admission of liability.

12. Documentation and audit

12.1 Dyst makes available the information necessary to demonstrate that the duties in this agreement have been fulfilled, including annex 2, relevant policies and answers to one reasonable questionnaire per year.

12.2 If the information is not sufficient, or if the Norwegian Data Protection Authority requires it, the Customer may conduct an audit once per year with at least 30 days' written notice, itself or through an independent auditor bound by confidentiality who is not Dyst's competitor. The audit is conducted digitally, unless an on-site inspection is necessary after a breach, at the request of the Norwegian Data Protection Authority or because the documentation is not sufficient. The audit shall not give access to other customers' data.

12.3 Each party bears its own costs for one audit day per year. For time beyond this, Dyst may charge at its applicable hourly rates. If the audit reveals material breaches on Dyst's part, Dyst bears its own costs.

13. Troubleshooting

The Customer's instructions include that Dyst may use copies of the Customer's personal data to troubleshoot errors in the Customer's use of the Service, in environments with access control that are not publicly accessible. The copies are deleted when the troubleshooting is complete.

14. Deletion and return

14.1 The Customer may export the personal data during the term of the Agreement and for 60 days after termination, see clause 7.5 of the customer terms.

14.2 Dyst then deletes the Customer's personal data from the Service within 30 days. Copies in backups are made inaccessible and deleted by ordinary rotation, no later than 90 days after they were deleted from the Service. The same applies to data the Customer deletes during the term of the Agreement.

14.3 The Customer is itself responsible for retaining data the Customer is legally obliged to retain.

15. Liability

15.1 The parties' liability under this agreement, including liability for subprocessors, for loss of data and for recourse claims under Article 82(5) of the GDPR, is governed exhaustively by clauses 12 and 13 of the customer terms.

15.2 This agreement does not limit the rights of the data subjects or the powers of the authorities. Each party bears any administrative fine and other sanction imposed on that party.

16. Changes

16.1 Dyst may change this agreement with at least 30 days' notice by email to the Customer's Administrators.

16.2 A change that weakens the protection of the personal data applies only once an Administrator has accepted it. Until then the current version applies, and either party may terminate the affected Service with effect from the end of the notice period.

16.3 Changes required by law or authorities may take effect with shorter notice. Changes to the list of subprocessors follow clause 7.

17. Term

The agreement applies as long as Dyst processes personal data for the Customer. Clauses 4, 14 and 15 continue to apply after termination.

18. Governing law and venue

Clause 18 of the customer terms applies correspondingly.

Annexes

1. Description of the processing in Toolcape
2. Security measures
3. Subprocessors

Annex 1: Description of the processing in Toolcape

Purpose. To deliver Toolcape to the Customer: store access keys to the Customer's Sources, perform operations in the Sources for the Customer's Users and AI clients within the access the Customer has granted, log the operations, store files, notes and instructions the Customer enters, provide support, and operate, secure and troubleshoot the Service.

Nature of the processing. Retrieval, storage, alteration and deletion of data in the Sources on instruction. Transfer to AI clients and other Connected Services on the Customer's instruction. Logging of operations. Storage of files, notes and instructions. Deletion.

Categories of data subjects. The Customer's Users, and persons found in the Customer's Sources, for example employees, customers, suppliers and contact persons.

Types of personal data.

• Access keys to the Sources, stored encrypted.
• The content of the operations: code, arguments and results. This may include email, documents, accounting and bank data and all types of personal data found in the Sources.
• Logs of operations.
• Files, notes and instructions.

Special categories. May occur when the Sources contain such data. The Customer decides which Sources and operations are used.

Duration and storage. The processing lasts for the term of the Agreement and until deletion under clause 14. Logs of operations, with code, arguments and results, are stored for the term of the Agreement. Files uploaded to temporary storage are deleted automatically when their time limit expires.

Connected Services. AI clients and Sources are the Customer's own providers and are not Dyst's subprocessors, see clause 9.

Annex 2: Security measures

Dyst implements the measures below for Toolcape.

• Access to personal data is personal and granted on a need-to-know basis, and removed when no longer needed.
• Each customer's data is separated from other customers' data in the database.
• All calls through Toolcape are logged.
• Passwords, keys and other secrets are stored in a password vault and never in source code.
• Access keys to Sources are stored encrypted.
• All traffic is encrypted with TLS.
• The servers are in the EEA and do not accept traffic directly from the internet.
• The servers are kept up to date with security updates.
• The database is backed up every night, and the backups are stored encrypted in two separate locations in the EEA.

Annex 3: Subprocessors

See toolcape.com/en/subprocessors.