How RessursAgent processes and protects personal data on behalf of your organisation. Read the complete agreement and its annexes in your selected language.
Published agreementVersion 1.0 · 14 October 2026
All language versions refer to agreement version 1.0. English is the governing contractual language and prevails if a translation differs in meaning.
This is RessursAgent’s published standard data processing agreement. It becomes binding for a customer when this version is incorporated into a service agreement or otherwise accepted in writing, including electronically. Publication alone does not amend an existing customer agreement. The customer and service details are supplied by the accepted order and the arrangements in Annex D.
These terms cover the processing of personal data in RessursAgent. The annexes define the processing scope, security measures, suppliers and customer-specific arrangements.
The processor is RessursAgent AS, Norwegian organisation number 935 854 067, Gydas vei 22, 0363 Oslo, Norway. Privacy contact: privacy@ressursagent.no. The controller is the customer identified in the service agreement. Annex D may identify the customer and agreed service by reference to that order; it does not require a second copy of information already clearly recorded there.
This agreement and its annexes shall be concluded in writing, including electronically, before processing on the customer’s behalf begins. The parties may incorporate this identified version into an accepted service order without a separate handwritten signature. Visiting this page alone does not constitute acceptance. A separately concluded customer data processing agreement remains in force unless the parties agree to replace it. If there is a conflict with the service agreement, this data processing agreement takes precedence for the processing of personal data.
This DPA, including its annexes and any agreed customer-specific instructions, forms part of the RessursAgent Service Agreement identified under Annex D. The agreed subscription/order and applicable RessursAgent terms govern commercial matters. The accepted version shall be retained with the customer’s agreement.
This agreement governs processing to provide and support RessursAgent: My plan, project planning, resource planning, strategic planning and agreed AI, communication and connection features. Annex A specifies the subject matter, nature, purposes, duration, types of personal data and categories of data subjects. The agreement applies for as long as RessursAgent or a subprocessor processes personal data on the customer's behalf, including the return and deletion period.
The customer determines the purposes and essential means. RessursAgent determines practical technical arrangements within those instructions. User accounts, access permissions and activity logs are covered when processed to deliver the service on the customer's behalf. Data processed by RessursAgent for its own distinct purposes, such as billing and customer relationship contacts, must be described separately in the privacy notice. Data does not fall outside this agreement merely because it is operational data.
Applicable Data Protection Law means Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR), as applicable in the EEA and incorporated into Norwegian law by the Norwegian Personal Data Act of 15 June 2018 No. 38, together with applicable supplementary data protection legislation. The agreement is intended to specify the processing arrangements required by GDPR Article 28. Mandatory protections under applicable law remain unaffected.
Personal data, processing, controller, processor, personal data breach and supervisory authority have the meanings given in the GDPR. A User is an individual authorised by the customer to access the service. A Subprocessor is another processor engaged by RessursAgent to process personal data on the customer's behalf.
Customer Data means information submitted to or generated in the service under the customer's instructions. This agreement governs the personal data within that information, including planning records, communications, documents and analysis outputs. Whether RessursAgent acts as processor or controller for a particular activity depends on its actual purpose and responsibilities, as described in clause 2.
Service means the RessursAgent software-as-a-service application at app.ressursagent.no and the features agreed with the customer. Customer Data includes information entered or imported by authorised users and the resulting planning records. The customer retains its rights in its submitted content; this DPA permits processing only to provide the agreed service and fulfil lawful instructions. Subscription duration, pricing, support commitments and termination notice are specified in the Service Agreement, not inferred from another provider’s terms.
RessursAgent shall process personal data only on the customer's documented instructions, including instructions concerning disclosure and transfers outside the EEA. Instructions comprise this agreement, its completed annexes and requests from authorised users within the agreed service functionality, including API and MCP. The parties shall document subsequent instructions and changes to the processing scope in writing.
RessursAgent shall not use personal data processed under this agreement for its own unrelated purposes, advertising, sale of data or cross-customer profiling. If RessursAgent determines a separate purpose and essential means of processing, its legal responsibilities shall follow its actual role under applicable law; this agreement does not authorise such a change of purpose.
Where EU/EEA or Norwegian law binding on RessursAgent requires processing outside the customer's instructions, RessursAgent shall inform the customer of that legal requirement before processing unless the law prohibits this on important grounds of public interest. RessursAgent shall immediately inform the customer if an instruction appears to infringe applicable data protection law and shall suspend the affected instruction until a lawful approach is established.
The customer shall determine and document a lawful basis under GDPR Article 6, provide the information required by Articles 13 and 14, and comply with the principles in Article 5. The customer shall ensure that personal data is adequate, relevant, limited to what is necessary, accurate and kept for no longer than required for the stated purposes. User permissions, retention instructions and data disclosed through integrations shall reflect these purposes.
The customer shall assess privacy risks and, where required by Article 35, carry out a data protection impact assessment before the relevant processing begins. Any required prior consultation under Article 36 shall be completed before processing. RessursAgent shall assist under clause 11. The customer shall also consider applicable employment and workplace-monitoring rules.
The service supports absence categories and dates for resource planning, such as holiday or sickness. The customer shall define which categories each authorised audience needs to see and document the purpose and legal basis. Detailed medical reasons and diagnoses are outside the standard planning scope. Any category-only access restriction must be verified before it is relied on. Crew notices may be provided through employment contracts and related information, but those documents do not replace the customer’s legal-basis and necessity assessments.
A holiday category does not in itself indicate health status, but a sickness category linked to a person reveals health information even without a diagnosis or detailed explanation. For that processing the customer shall identify an applicable Article 9(2) condition as well as an Article 6 basis. Employment-contract acknowledgement does not by itself establish valid consent or make every disclosure necessary. Where consent is relied on, its validity must be assessed separately, including freedom of choice in the employment relationship, specificity, information and withdrawal without detriment; Article 9(2)(a) requires explicit consent. Where the category cannot lawfully be shared with a particular audience, display a generic unavailable status instead. The customer shall document the applicable basis, necessity, access and retention safeguards.
Diagnoses, medical reports, unnecessary narrative details, criminal-offence data and national identity numbers are outside the standard planning scope unless separately agreed with the necessary lawful conditions and safeguards. HMS-card numbers are occupational identifiers, not permission to collect national identity numbers. RessursAgent shall follow lawful instructions to restrict, return or delete data outside the agreed scope; its duties continue for data actually received.
RessursAgent shall ensure that persons with access are subject to contractual or statutory confidentiality duties. Access shall be limited to what is necessary for the task and removed when no longer needed. Confidentiality shall continue after employment and the agreement end. Customer data shall not be disclosed to other customers or used for unrelated third-party purposes.
Both parties shall protect confidential information exchanged to administer this agreement, including security documentation and non-public customer information. Disclosure necessary to fulfil legal duties, assist individuals, obtain professional advice under confidentiality or cooperate with a supervisory authority remains permitted.
RessursAgent shall implement, maintain and document technical and organisational measures appropriate to the risk under GDPR Article 32, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to individuals. Measures shall cover the ongoing confidentiality, integrity, availability and resilience of processing, timely recovery of access to data after an incident, and regular testing and evaluation of their effectiveness.
Annex B shall record the concrete measures, including access controls, customer separation, protection of data in transit and at rest, backup and recovery, secure development and incident handling. Encryption and pseudonymisation shall be assessed and applied where appropriate to the risks. Personnel shall process data only within their authorisation and the customer's instructions. Measures shall be in place before the processing to which they relate begins.
RessursAgent shall assist the customer with data protection by design and by default within the services it provides. Security measures may be developed without reducing the agreed level of protection or compliance with applicable law. Material changes shall be documented and communicated to the customer.
Each party shall maintain the processing records required under Article 30, designate a data protection officer where Article 37 requires one, and cooperate with competent supervisory authorities. RessursAgent shall retain supporting security documentation, regularly assess the effectiveness of its measures and remedy identified deficiencies. Publication of this agreement is not a certification or an independent security audit.
RessursAgent shall not engage a subprocessor without the customer’s prior specific or general written authorisation. By concluding this agreement, the customer authorises the subprocessors in Annex C for the features included in the agreed service and gives general written authorisation for later additions or replacements subject to this clause. Listing an optional service does not enable it or authorise unrelated processing.
RessursAgent shall notify the customer directly in writing of intended subprocessor additions or replacements sufficiently in advance to allow a meaningful objection before the affected processing begins. The notice shall identify the entity, activity, relevant data, processing locations and transfer safeguards. Any additional agreed minimum notice period shall be recorded in Annex D. The parties shall seek a lawful solution to substantiated data-protection objections. The disputed processing shall not start for that customer while the objection remains unresolved; if no lawful solution is possible, the affected service shall be suspended or terminated with return and deletion under clause 14.
Before a subprocessor receives personal data, RessursAgent shall assess its sufficient guarantees and enter into a binding agreement imposing, in substance, the same data protection obligations as this agreement for the delegated processing, including appropriate security and assistance. RessursAgent shall remain fully liable to the customer for the subprocessor's performance of those obligations under Article 28(4).
RessursAgent shall keep the approved register current and provide information reasonably necessary to verify the subprocessor arrangements. Relevant agreements may be redacted only as needed to protect confidential information without preventing the customer from assessing compliance. RessursAgent shall notify the customer of subprocessor non-compliance affecting the processing and take appropriate remedial action.
Application function execution, the primary application database, and managed database backup and recovery are configured in Frankfurt, Germany. RessursAgent shall maintain this regional restriction for that infrastructure. Content delivery, operational logs, support access and separately engaged AI, email, SMS and other services have their own processing locations. Annex C identifies these services; clauses 8 and 9 govern their use and any international transfers.
Annex C shall identify the agreed processing and storage locations, support access from other countries, and relevant onward processing. Locating a database in the EEA does not by itself establish that all processing takes place there. Changes to locations shall be assessed before implementation and are subject to the customer's documented instructions and clause 8 where a subprocessor changes.
Except where the legal requirement described in clause 4 applies, transfers outside the EEA shall take place only on the customer's documented instructions. Every such transfer, including relevant remote access and onward transfers, must satisfy GDPR Chapter V. Before transferring data, RessursAgent shall document the recipient, country and applicable mechanism, such as an adequacy decision within its scope or appropriate safeguards under Article 46.
Where standard contractual clauses are used, RessursAgent shall assess their effective protection in the circumstances of the transfer, document relevant recipient-country law and practice, and implement supplementary measures where necessary. Transfers shall not start, or shall be suspended, if the required protection cannot be ensured. This agreement is not itself a Chapter V transfer mechanism.
When enabled and configured, the assistant uses Anthropic’s commercial Claude API to interpret requests, prepare proposed actions, compose responses and provide language support. Task context may include selected people, equipment, projects, dates, assignments and available planning information; user profile details, saved preferences or memories, recent questions and relevant conversation history may also be included. Attachments are processed when submitted. The permitted scope must be checked against actual prompt construction and user permissions, including optional fields. RessursAgent shall disclose only what is necessary for the authorised task.
RessursAgent uses Anthropic under its standard commercial terms, which incorporate a data processing addendum and prohibit training on Customer Content. Standard API inputs and outputs are normally deleted within 30 days; provider-controlled file services, model-specific safety requirements, usage-policy investigations and legal obligations can have different retention. No bespoke zero-data-retention arrangement is included. RessursAgent shall document the applicable model, tool, retention and transfer arrangements and limit data disclosed to the authorised task.
As a contractual restriction for this service, RessursAgent shall not use, or permit its subprocessors to use, personal data processed under this agreement to train or improve general-purpose models, create cross-customer profiles or develop unrelated products. Provider agreements and settings shall support this restriction before the relevant processing begins. Any security or abuse-monitoring processing shall be documented, limited to a lawful purpose and assessed for the provider's actual role.
AI output is decision support and may contain errors. The customer shall provide meaningful human review, with authority to reject or change the proposal, before relying on output for decisions about individuals. Planning changes proposed by the RessursAgent assistant shall require user approval and remain subject to the service's permission and validation controls. A confirmation click alone does not establish meaningful review. Any intended solely automated decision producing legal or similarly significant effects requires a separate assessment of Article 22, an applicable exception and the required safeguards; it is not authorised by the standard processing instructions.
Attachments and conversation history may be processed to fulfil the authorised request. Extracted document text or uploaded files may be sent to the AI provider depending on file type. Application history and provider-held files have separate retention arrangements. For temporary Files API uploads, the application requests an expiry of no more than one hour, validates the returned expiry before use and requests deletion after processing. These application controls do not promise immediate physical erasure of every provider copy. RessursAgent shall follow up failed expiry/deletion requests, apply lawful deletion instructions to relevant copies and document any restricted residual retention under clause 14.
SMS uses Strex/Target365. Product email and authentication email, including invitations and password recovery, use Resend. These services process recipient details, relevant content, delivery events and links. The approved scope, locations and retention shall be recorded in Annex C. Sensitive absence details and HMS-card numbers shall not be included in messages or AI prompts unless separately assessed and specifically authorised with suitable supplier protection.
Customer-connected systems and external AI clients using API or MCP shall be assessed according to who engages them, their actual role, the data accessed and the actions authorised. They are not automatically RessursAgent subprocessors. The customer shall ensure the required instructions, lawful disclosure and agreements for services it engages; RessursAgent remains responsible for obligations relating to its own service and subprocessors.
The optional map view uses Google Maps. Address geocoding uses Kartverket’s Geonorge service, including project addresses and resource work-base addresses where configured. Customer-directed links may disclose a telephone number to Gule Sider or an HMS-card number to Jobbkort after the user clicks. These disclosures and external identity providers are recorded separately in Annex C; their roles and lawful use must be assessed rather than treating every external service as a subprocessor. Neither this agreement nor a connection catalogue authorises unnecessary disclosure.
The customer is responsible for responding to individuals exercising rights under GDPR Chapter III. RessursAgent shall promptly forward requests it receives and shall not respond on the customer's behalf without instructions unless legally required. Requests to privacy@ressursagent.no should identify the case, scope and applicable deadline without including unnecessary personal data.
Taking account of the nature of processing, RessursAgent shall assist through appropriate technical and organisational measures, insofar as possible, so the customer can fulfil requests for access, rectification, erasure, restriction, portability and objection, and other applicable Chapter III rights. The parties shall arrange secure exchange and sufficiently prompt assistance to meet statutory deadlines; internal procedures shall not extend those deadlines.
Taking account of the nature of processing and information available to it, RessursAgent shall assist the customer with obligations under Articles 32–36, including security, breach assessment and notification, impact assessments and prior consultation. Agreed operational details shall be recorded in Annexes B and D. Any assistance charges must be agreed in advance and shall not prevent legally required assistance.
RessursAgent shall notify the customer's designated incident contact without undue delay after becoming aware of a personal data breach affecting processing under this agreement, as required by Article 33(2). It shall not wait for a complete investigation or its own assessment of whether the breach must be reported to an authority. Where information is incomplete, an initial notice shall be followed by updates without undue delay.
To the extent available, notification shall identify the nature of the breach, affected categories and approximate numbers of individuals and records, likely consequences, containment and remedial measures, and a contact for further information. RessursAgent shall document the facts and response, preserve relevant evidence, take proportionate containment and mitigation measures and assist the customer.
The customer shall assess and fulfil its obligations under Articles 33 and 34. Where authority notification is required, Article 33(1) requires notification without undue delay and, where feasible, within 72 hours of the customer becoming aware; delayed notification must explain the reasons. Notification is not required where the breach is unlikely to result in a risk to individuals' rights and freedoms. Communication to individuals shall follow Article 34, including its high-risk threshold and applicable exceptions. These rules do not give RessursAgent a 72-hour waiting period for notifying the customer.
The customer shall promptly inform RessursAgent of compromised accounts or other incidents affecting the service and cooperate in containment. Incident contacts, escalation channels and any stricter contractual response targets shall be completed in Annex D and shall not postpone a statutory obligation.
RessursAgent shall make available all information necessary to demonstrate compliance with Article 28 and this agreement, respond adequately to the customer's inquiries, and allow for and contribute to audits, including inspections, by the customer or an auditor it mandates. Relevant independent reports may support this assessment but shall not automatically replace a necessary audit or inspection.
Routine audits should normally be arranged on four weeks’ notice. This scheduling expectation does not restrict audits needed urgently following an incident, suspected non-compliance or an authority requirement. The parties shall agree proportionate arrangements that protect other customers’ data and confidential information without preventing effective verification. Charges shall be agreed in advance and shall not render the audit right ineffective. Relevant documentation and findings shall be available to the competent supervisory authority where required.
RessursAgent shall comply with the storage-limitation principle in GDPR Article 5(1)(e) and applicable Norwegian data protection law. Personal data processed on the customer’s behalf shall be retained only for as long as necessary for the agreed purposes and lawful documented instructions, or as required by applicable law. The customer shall define the relevant retention periods or objective criteria, and RessursAgent shall implement the agreed review and deletion procedures. There is no single statutory retention period applicable to all data in the service.
During the service, RessursAgent shall implement lawful retention and deletion instructions within the agreed scope. When the relevant processing services end, the customer shall choose return or deletion of the personal data. RessursAgent shall carry out that choice and delete remaining copies, unless EU/EEA or Norwegian law requires continued storage. Data shall not be kept or used for unrelated purposes after termination.
Return or deletion shall be completed without undue delay and within 30 calendar days after the customer's instructions and necessary scope are clarified. RessursAgent shall seek any necessary clarification promptly and shall not use clarification to prolong retention unnecessarily. Return shall use a structured, commonly used format and an authenticated or encrypted delivery channel. Remaining active copies shall be deleted when return is complete unless a lawful instruction or retention duty requires otherwise. The procedure covers active systems, attachments, relevant logs and subprocessor copies, subject to the documented backup and lawful provider exceptions below. This operational deadline does not extend statutory deadlines for individuals' rights.
Backup copies awaiting erasure under a documented retention cycle shall be protected and unavailable for ordinary use. RessursAgent’s managed database backups rotate over approximately seven days. Supplier-specific residual copies follow the applicable restricted retention arrangements identified in Annex C. On return or deletion, RessursAgent shall record and inform the customer of the final expiry date or applicable legal retention criterion for any remaining copies. A provider policy does not itself permit retention contrary to applicable law or this agreement. Outstanding deletion instructions shall be reapplied before normal access resumes after a restore. RessursAgent shall obtain appropriate evidence of subprocessor deletion and confirm completion and any restricted residual retention to the customer in writing.
Where law requires continued storage, RessursAgent shall, unless prohibited, inform the customer of the legal basis, affected data and required period. Access and processing shall be restricted to that legal requirement and the data shall remain protected until deletion.
Each party is responsible for its obligations under applicable data protection law and this agreement. Liability between the parties follows applicable law and any valid limitations expressly agreed in the service agreement. No limitation shall displace mandatory obligations or create an additional cap through this agreement.
Nothing in this agreement restricts data subjects' rights to compensation under GDPR Article 82 or the powers of supervisory authorities. Where a party has paid compensation for damage for which the other party is responsible, recovery between the parties shall follow the allocation of responsibility under Article 82(5) and applicable law.
Changes required by law, service development or processing arrangements shall be documented. Proposed material amendments shall normally be notified at least 30 days before their intended effective date and require written agreement, including electronic agreement. Publishing a revised document does not itself amend a concluded customer agreement. Supplier changes follow clause 8; mandatory legal obligations apply when legally required.
In the event of non-compliance, the parties shall seek timely remediation. Processing that cannot be carried out lawfully shall be suspended or terminated in a way that protects the data, with return and deletion under clause 14. Mandatory legal obligations take precedence over conflicting instructions or terms.
This agreement is governed by Norwegian law. Subject to mandatory jurisdiction rules, disputes between the parties arising out of this agreement shall be brought before Oslo District Court (Oslo tingrett). This does not restrict data subjects' statutory remedies, their right to complain to a supervisory authority or the powers of competent authorities.
English is the governing contractual language of this agreement and all annexes. Translations are provided to make the agreement accessible in the website languages. If a translation differs in meaning, the English version prevails. Any completed annexes, written amendments and the agreed version shall be maintained in English.
This annex defines the standard processing scope. The customer-specific order and Annex D identify the features actually used and any additional lawful instructions. Optional features and connections do not authorise unrestricted disclosure.
The following technical and organisational measures form part of RessursAgent’s obligations under clause 7. Supporting documentation, testing records and security assessments are maintained separately and made available under clause 13. No certification, uninterrupted availability or numerical recovery guarantee is implied.
The following register identifies RessursAgent’s subprocessors and other recipients for the standard service. Optional services apply only when included in the agreed service. RessursAgent shall keep the register and the supporting recipient, country, retention and transfer records current, provide them under clause 13 and follow clause 8 for subprocessor changes.
The Frankfurt restriction applies to the infrastructure specified in clause 9. It does not apply to every recipient listed below. International transfers and relevant remote access require the safeguards in clause 9. Supplier links provide supporting information; changes on a supplier website do not automatically amend the customer’s agreed terms.
The customer-specific information below is supplied by the accepted service order, account administration record and any agreed written instructions. It need not be repeated in a separate signed schedule. The standard provisions in Annexes A–C apply unless the parties agree a lawful variation in writing.
Published agreement · Version 1.0 · 14 October 2026