Legal
Data processing agreement
Data Processing
Agreement
Databehandleravtale – GDPR Art. 28
Between: [Controller Company Name] (Data Controller)
And: Edgeon AS (Data Processor)
Version 1.0 · March 2026 · Governing Law: Norway
📋 About This Agreement This Data Processing Agreement (“DPA”) is entered into between the Data Controller identified on the signature page and Edgeon AS as Data Processor. It forms part of, and is subject to, the Terms of Service between the parties. It is designed to comply with Article 28 of the General Data Protection Regulation (EU 2016/679) (“GDPR”) as incorporated into Norwegian law via the Personal Data Act (personopplysningsloven). All capitalised terms not defined here have the meanings given in the Terms of Service. |
This DPA must be signed before the Controller’s tenant goes live on the Edgeon platform. It replaces any prior data processing terms between the parties.
1. Definitions
| Term | Meaning |
| “Controller” | The natural or legal person, public authority, agency, or other body that determines the purposes and means of the processing of personal data (GDPR Art. 4(7)). In this DPA, the Controller is the customer entity named on the signature page. |
| “Processor” | The natural or legal person that processes personal data on behalf of the Controller (GDPR Art. 4(8)). In this DPA, the Processor is Edgeon AS. |
| “Sub-Processor” | Any third party engaged by the Processor to process personal data on behalf of the Controller (GDPR Art. 28(4)). |
| “Personal Data” | Any information relating to an identified or identifiable natural person (GDPR Art. 4(1)). |
| “Processing” | Any operation performed on personal data, including collection, storage, use, disclosure, erasure (GDPR Art. 4(2)). |
| “Data Breach” | A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (GDPR Art. 4(12)). |
| “Services” | The Edgeon platform services described in the Terms of Service, including Ledgeron and Thermon. |
| “Instructions” | The written instructions given by the Controller to the Processor regarding the processing of personal data, as set out in Annex A and as may be supplemented in writing from time to time. |
| “EEA” | The European Economic Area, comprising EU Member States, Norway, Iceland, and Liechtenstein. |
| “SCCs” | Standard Contractual Clauses adopted by the European Commission for transfers of personal data to third countries. |
2. Role Allocation and Relationship
The parties acknowledge and agree that:
The Controller determines the purposes and means of processing personal data through the Services and is responsible for ensuring it has a valid legal basis for such processing under GDPR Art. 6
The Processor processes personal data solely on behalf of and on the documented Instructions of the Controller
This DPA does not apply to processing by Edgeon of personal data for its own purposes as a data controller (e.g. billing, account management), which is governed by Edgeon’s Privacy Policy
⚠️ Important Note on Roles Where employees or users of the Controller’s organisation access the Edgeon platform directly and generate personal data (e.g. their name and email appear in audit logs), the Controller is the data controller for that data. Edgeon processes it strictly as instructed. Neither party shall act as joint controller unless separately agreed in writing. |
3. Processor Obligations
3.1 Processing on Instructions Only
The Processor shall process personal data only on documented Instructions from the Controller. The Instructions are set out in Annex A to this DPA. If the Processor is required by Union or Member State law to process personal data other than as instructed, it shall inform the Controller before processing unless that law prohibits such notification.
If the Processor reasonably believes that an Instruction infringes the GDPR or other applicable data protection law, it shall immediately notify the Controller. The Processor may suspend the processing of the affected data until the Controller provides an amended Instruction that does not create such risk.
3.2 Confidentiality
The Processor shall ensure that all personnel authorised to process personal data under this DPA are subject to binding confidentiality obligations (whether contractual or statutory) and have received appropriate data protection training. Access to personal data is restricted to staff whose job function requires it.
3.3 Security Measures
The Processor shall implement and maintain the technical and organisational security measures described in Annex B. These measures shall be appropriate to the risks to the rights and freedoms of natural persons posed by the processing, taking into account the state of the art, costs, nature, scope, context, and purposes of processing. Current measures include:
Encryption of all personal data in transit (TLS 1.2+) and at rest (AES-256)
Multi-factor authentication (MFA) enforced for all platform access
Role-based access control (RBAC) ensuring minimum-privilege access
Strict multi-tenant data isolation at database level (row-level security)
Comprehensive, immutable audit logging of all data access and modification events
Automated vulnerability scanning and regular security reviews
Formal incident response and business continuity procedures
3.4 Sub-Processors
The Controller grants Edgeon AS a general written authorisation to engage the sub-processors listed in Annex C. The Processor shall: (a) enter into a written agreement with each sub-processor imposing equivalent data protection obligations to those in this DPA; (b) remain fully liable to the Controller for the acts and omissions of sub-processors; and (c) notify the Controller of any intended change to sub-processors (addition or replacement) by updating Annex C and providing 30 days’ prior written notice. The Controller may object to a new sub-processor on reasonable data protection grounds within 15 days of notification. If the parties cannot resolve the objection, the Controller may terminate the Agreement with 30 days’ notice.
3.5 Data Subject Rights
The Processor shall, taking into account the nature of the processing, assist the Controller in responding to requests from data subjects exercising their rights under GDPR Chapter III (access, rectification, erasure, restriction, portability, and objection). The Processor will:
Promptly notify the Controller of any data subject request received that directly relates to the Controller’s data (within 5 business days)
Not respond to data subject requests on the Controller’s behalf without prior written authorisation from the Controller
Provide the Controller with technical tools and export functions to assist in fulfilling subject access requests, including the ability to extract all personal data associated with a specific user identity
Support erasure requests by providing documented deletion procedures within the agreed response timeframes in Annex A
3.6 Data Protection Impact Assessments
Where required by GDPR Art. 35, the Processor shall provide reasonable assistance to the Controller in conducting data protection impact assessments (DPIAs) relating to the processing under this DPA. The Processor shall also provide reasonable assistance with prior consultations with supervisory authorities under Art. 36.
3.7 Deletion or Return of Data
At the choice of the Controller, upon termination of the Services or upon written request, the Processor shall:
Delete all personal data processed under this DPA within 30 days of the termination date, and provide written confirmation of deletion; or
Return all personal data to the Controller in a structured, commonly used, machine-readable format (JSON or CSV) before deletion
The Processor may retain personal data where required by applicable law, but only for as long as required and only for the purpose specified by that law. The Processor shall inform the Controller of any such retention obligation.
3.8 Audit and Inspection Rights
The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits and inspections conducted by the Controller or its mandated auditors. The Controller shall:
Give the Processor at least 14 days’ advance written notice before any audit
Ensure audits are conducted during normal business hours and do not unreasonably disrupt Processor operations
Bear its own costs for audits unless the audit reveals a material breach of this DPA
The Processor may satisfy this obligation by providing up-to-date third-party audit reports (e.g. SOC 2, ISO 27001 certification) in lieu of a direct inspection, subject to Controller acceptance.
3.9 Data Breach Notification
The Processor shall notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a Data Breach involving the Controller’s personal data. The notification shall, to the extent then known, include:
A description of the nature of the breach (categories and approximate number of data subjects and records affected)
The name and contact details of the Processor’s data protection contact
The likely consequences of the breach
Measures taken or proposed to address the breach and mitigate its effects
Where complete information is not available at the time of notification, it may be provided in phases as it becomes available. The parties shall cooperate to fulfil any obligations to notify Datatilsynet or affected data subjects.
3.10 Record of Processing Activities
The Processor shall maintain a record of all categories of processing activities carried out on behalf of the Controller as required by GDPR Art. 30(2). This record is available on request.
4. Controller Obligations
The Controller represents, warrants, and undertakes that:
It has a valid legal basis under GDPR Art. 6 (and Art. 9 if applicable) for all personal data it submits to the Services
It will not instruct the Processor to process special categories of personal data (Art. 9) or data relating to criminal convictions (Art. 10) without prior written agreement and appropriate safeguards
It will provide accurate and complete Instructions and notify the Processor promptly of any changes
It will inform its own data subjects (employees, partners, contacts) about the processing of their data through the Services, as required by GDPR Art. 13/14
It will ensure that its Authorised Users comply with the Terms of Service and this DPA
It will promptly inform the Processor of any circumstance that may affect the Processor’s ability to comply with this DPA
5. International Data Transfers
The Processor’s primary infrastructure (Microsoft Azure) is hosted in the EU (North Europe / Ireland). Where personal data is transferred outside the EEA, the Processor ensures one of the following safeguards is in place:
| Transfer Scenario | Recipient | Safeguard | Status |
| Platform hosting | Microsoft Azure (North Europe) | EU data residency – no transfer | ✅ EEA only |
| Database (Supabase) | Azure EU region | EU data residency – no transfer | ✅ EEA only |
| Authentication (Auth0) | EU cluster / US fallback | Standard Contractual Clauses (SCCs) | ✅ SCCs in place |
| Payment processing (Stripe) | US-based | Standard Contractual Clauses (SCCs) | ✅ SCCs in place |
| Email delivery | US-based provider | Standard Contractual Clauses (SCCs) | ✅ SCCs in place |
| Analytics (if enabled) | EU-preferred (PostHog EU or Plausible) | Anonymised – no personal data | ✅ Anonymised |
The Controller may request copies of the applicable SCCs or data transfer impact assessments from privacy@edgeon.no.
6. Term and Termination
This DPA takes effect on the date of signature by both parties and continues in force for as long as the Processor processes personal data on behalf of the Controller under the Terms of Service. It terminates automatically upon the effective termination of the Terms of Service.
Termination of this DPA does not relieve either party of obligations that arose prior to termination. The confidentiality obligations in Clause 3.2 and the deletion obligations in Clause 3.7 survive termination.
7. Liability
Each party shall be liable for damage caused by processing that infringes the GDPR in accordance with GDPR Art. 82. A party’s liability under this DPA shall be subject to the limitations and exclusions set out in the Terms of Service, except to the extent that applicable law prohibits such limitations for GDPR-related liability.
The Processor shall not be liable for processing carried out in accordance with the Controller’s Instructions where those Instructions themselves caused the damage. The Controller shall indemnify the Processor against claims by data subjects or supervisory authorities arising from the Controller’s breach of its own GDPR obligations.
8. Governing Law and Jurisdiction
This DPA is governed by Norwegian law. Any disputes arising in connection with this DPA shall be subject to the exclusive jurisdiction of the Norwegian courts, with Oslo tingrett as the agreed court of first instance.
9. General Provisions
This DPA constitutes the entire agreement between the parties with respect to the processing of personal data and supersedes all prior data processing agreements
This DPA may only be amended by a written instrument signed by authorised representatives of both parties
If any provision is found unenforceable, the remaining provisions remain in full effect
Notices under this DPA shall be sent to privacy@edgeon.no (Processor) and the Controller’s data protection contact as notified in writing
SIGNATURES
By signing below, the authorised representatives of both parties agree to be bound by this Data Processing Agreement as of the later date of signature.
Edgeon AS Data Processor Signature Name (Print) Title / Position Date |
[Controller Company Name] Data Controller Signature Name (Print) Title / Position Date |
ANNEX A
Subject Matter, Nature, and Instructions
GDPR Art. 28(3)(a) – Description of Processing
A.1 Parties
| Party | Details |
| Data Controller | [Legal company name, organisation number, registered address, contact email] |
| Data Processor | Edgeon AS | [Org.nr] | [Registered address, Norway] | privacy@edgeon.no |
| Effective Date | [Date of signature] |
| Services in Scope | Ledgeron (logistics unit accounting); Thermon (IoT monitoring) – as subscribed per Order Form |
A.2 Subject Matter of Processing
The Processor provides the Controller with access to a cloud-based SaaS platform (Ledgeron and/or Thermon) for the purposes described below. In doing so, the Processor processes personal data on behalf of the Controller as part of delivering the Services.
A.3 Duration of Processing
Processing begins on the Effective Date and continues for the duration of the Subscription Term. Upon termination, the Processor retains personal data for 30 days to enable data export, after which it is deleted in accordance with Clause 3.7 of this DPA.
A.4 Nature and Purpose of Processing
| Service | Nature of Processing | Purpose |
| Ledgeron | Storage, retrieval, display, modification, and deletion of user account data; logging of user actions; generation of reports referencing user identities | Enable authenticated access; maintain an audit trail of logistics events and ownership transfers; support period-close reconciliation and dispute resolution |
| Thermon | Storage, retrieval, and display of IoT sensor data associated with device and user configuration; logging of alert acknowledgement by named users | Enable real-time monitoring dashboards; deliver threshold alerts to named recipients; maintain sensor event history |
| Both (Platform) | Authentication, session management, audit logging of all access events referencing user identity (email, IP, device) | Security, fraud prevention, compliance with ISO 27001 Annex A 8.15 logging requirements |
A.5 Types of Personal Data Processed
| Category | Data Elements | Applies To | Sensitivity |
| Identity data | First name, last name, username, job title | Platform users (employees/contractors of Controller) | Standard |
| Contact data | Work email address, work phone number (optional) | Platform users | Standard |
| Authentication data | Hashed password, MFA secrets (encrypted), session tokens | Platform users | High – encrypted at rest |
| Access & audit log data | User ID, action performed, timestamp, IP address, device/browser, success/failure | All authenticated users | Standard – 12-month retention |
| Business operational data (identifying) | User name appearing in movement records, approval signatures, dispute notes, instruction authors | Users who create operational records in Ledgeron | Standard |
| Alert contact data (Thermon) | Named recipient email/phone for threshold alerts, acknowledgement records | Users configured as alert recipients | Standard |
| Support communications | Name, email, message content of support requests | Users who contact support | Standard – 3-year retention |
🔒 Special Categories The Processor does not knowingly process special categories of personal data (GDPR Art. 9) or data relating to criminal convictions (Art. 10) as part of the standard Services. The Controller must not submit such data without prior written agreement and implementation of additional safeguards. |
A.6 Categories of Data Subjects
Employees of the Controller who are registered as Authorised Users on the platform
Contractors, agents, and temporary workers of the Controller given platform access
Employees of the Controller’s trading partners and customers who are granted access to the Customer Portal feature in Ledgeron
Employees of logistics service providers (carriers, 3PLs) given access to execute operational instructions in Ledgeron
Named individuals in support communications
A.7 Data Retention Schedule
| Data Type | Retention Period | Legal Basis for Retention | Deletion Method |
| User account data (name, email) | Duration of contract + 30 days post-termination | Contract (GDPR Art. 6(1)(b)) | Logical deletion + physical purge |
| Phone number | Duration of contract + 30 days | Contract (GDPR Art. 6(1)(b)) | Encrypted; purged on deletion |
| Audit log data (user actions) | 12 months from event date | Legal obligation / Legitimate interest (Art. 6(1)(c)/(f)) | Automated purge after 12 months |
| Authentication logs | 12 months | Legal obligation / Legitimate interest | Automated purge |
| Support communications | 3 years from closure | Legitimate interest (Art. 6(1)(f)) | Manual or automated purge |
| Financial records referencing users | 5 years (Norwegian Bookkeeping Act) | Legal obligation (Art. 6(1)(c)) | Pseudonymisation after 2 years |
A.8 Controller’s Instructions
The Controller hereby instructs the Processor to process personal data as follows:
Collect and store personal data submitted by the Controller’s Authorised Users when registering accounts and using the Services
Display personal data to Authorised Users in accordance with the role-based access controls configured by the Controller’s Tenant Administrator
Include user identity in audit logs for security and compliance purposes
Enable Authorised Users to export their own personal data via the platform’s self-service export features
Delete personal data promptly upon valid erasure requests communicated by the Controller
Send transactional notifications (emails, alerts) to named recipients as configured by the Controller
The Controller may issue further Instructions in writing to privacy@edgeon.no. The Processor is not required to follow Instructions that would cause it to violate applicable law.
ANNEX B
Technical and Organisational Security Measures
GDPR Art. 28(3)(c) – Art. 32 – Current as of March 2026
The following measures are implemented and maintained by Edgeon AS to protect personal data processed under this DPA. These measures are reviewed at minimum annually and updated as technology and threat landscapes evolve.
B.1 Infrastructure & Hosting
| Control | Implementation |
| Cloud hosting | Microsoft Azure – North Europe (Dublin) region. ISO 27001 and SOC 2 certified infrastructure. |
| Data residency | All primary data stored within the EEA. No personal data stored outside EEA without SCCs. |
| High availability | Kubernetes cluster with auto-scaling and multi-zone redundancy. Target 99.9% uptime (Enterprise). |
| Backup | Automated daily encrypted database backups. 30-day retention. Tested quarterly. |
| Disaster recovery | RPO ≤ 4 hours; RTO ≤ 8 hours for critical data. Business continuity plan documented. |
B.2 Access Control
| Control | Implementation |
| Authentication | Auth0 / Azure AD B2C. OAuth 2.0 + OpenID Connect. Short-lived JWT access tokens with refresh rotation. |
| Multi-factor authentication | MFA enforced for all platform access. TOTP or push-based second factor required. |
| Role-based access control | Granular RBAC enforced at API and UI layer. Minimum-privilege principle. Tenant Admin manages roles. |
| Tenant isolation | PostgreSQL row-level security (RLS) prevents any cross-tenant data access. Enforced at database layer. |
| Session management | Automatic session timeout after inactivity. Concurrent session limits enforced. |
| Privileged access | Edgeon internal admin access to customer data is restricted, logged, and subject to approval workflow. |
| Password policy | Minimum 12 characters. Complexity requirements. Password history prevents reuse of last 10 passwords. |
B.3 Encryption
| Control | Implementation |
| Encryption in transit | TLS 1.2+ enforced for all communications. HSTS headers. Certificate pinning for mobile apps. |
| Encryption at rest | AES-256 encryption for all stored data (Azure Storage Service Encryption). Database-level encryption. |
| Sensitive field encryption | Phone numbers and authentication secrets encrypted at application layer (field-level encryption) in addition to disk-level. |
| Key management | Azure Key Vault for all cryptographic key management. Keys rotated annually. |
| Secrets management | No secrets in code or environment variables. All secrets managed via Azure Key Vault. |
B.4 Audit Logging & Monitoring
| Control | Implementation |
| Audit logging | All authentication events, data access, data modifications, and admin actions logged with: WHO (user ID), WHAT (action), WHEN (UTC timestamp), WHERE (IP/device), OUTCOME. |
| Log integrity | SHA-256 hash chaining on audit log entries. Logs are immutable – cannot be altered or deleted by any user including admins. |
| Log retention | 12 months minimum. Automated deletion after retention period. |
| Monitoring | Azure Monitor + Application Insights for real-time anomaly detection. Alerts for suspicious patterns (brute force, data exfiltration indicators). |
| Security event response | Automated IP blocking for repeated authentication failures. Incident escalation procedure documented. |
B.5 Development & Operational Security
| Control | Implementation |
| Vulnerability scanning | SAST (SonarQube/Snyk) on every CI/CD pipeline run. Dependency scanning for known CVEs. |
| Code review | All code (including AI-generated) reviewed by senior developer before merge. Security checklist applied. |
| Penetration testing | Annual penetration test by independent third party. Critical and high findings remediated within 30 days. |
| OWASP Top 10 | Controls implemented for all OWASP Top 10 categories. Verified via SAST and manual review. |
| Change management | All infrastructure changes via version-controlled IaC (Terraform). CI/CD gates require passing all tests. |
| Incident response | Documented incident response plan. 72-hour breach notification procedure. Tabletop exercises conducted annually. |
| Employee security training | Annual security awareness training for all Edgeon staff with access to production systems. |
| Data minimisation | Only data necessary for service delivery is collected. Default settings are privacy-protective. |
ANNEX C
Approved Sub-Processors
GDPR Art. 28(4) – Current as of March 2026 – 30 days’ notice of changes
The Controller grants general authorisation to the following sub-processors as of the DPA Effective Date. Edgeon will provide 30 days’ prior written notice of any intended addition or replacement of sub-processors.
| Sub-Processor | Country/Region | Purpose | Personal Data Processed | Safeguard |
| Microsoft Azure | EU (North Europe / Ireland) | Cloud infrastructure: compute, storage, networking, IoT Hub, Key Vault | All personal data processed through the Services (hosted infrastructure) | EU data residency; Microsoft DPA; ISO 27001 / SOC 2 |
| Supabase Inc. (hosted on Azure EU) | EU | PostgreSQL database hosting and real-time API layer | All structured personal data stored in the platform database | EU data residency; Supabase DPA; SCCs where applicable |
| Auth0 Inc. (Okta) | EU cluster; USA fallback | Authentication, identity management, SSO, MFA | Email, name, authentication tokens, login events | SCCs (EU–US); Auth0 DPA; ISO 27001 |
| Stripe Inc. | USA | Payment processing and subscription billing | Billing contact name, email, payment card data (tokenised) | SCCs (EU–US); Stripe DPA; PCI-DSS Level 1 |
| Email delivery provider (SendGrid / TBD) | USA | Transactional email notifications (alerts, invitations, password reset) | Recipient email address, first name, notification content | SCCs (EU–US); Provider DPA |
| PostHog Inc. (if analytics enabled) | EU (self-hosted option) | Product analytics – anonymised usage data only | Anonymised session data; no personally identifiable data transmitted | Anonymised; no personal data transferred |
📧 Sub-Processor Change Notification Edgeon will notify the Controller of sub-processor changes by email to the Controller’s registered account address and by updating this Annex on the Edgeon website (edgeon.no/legal/dpa). The Controller has 15 days from notification to raise a written objection on reasonable data protection grounds. |
ANNEX D
Data Subject Rights – Handling Procedures
GDPR Art. 28(3)(e) – Processor Assistance Obligations
This Annex describes how Edgeon AS (Processor) will assist the Controller in fulfilling data subject rights requests. The Controller retains responsibility for responding to data subjects – the Processor provides technical assistance only.
| Right (GDPR Article) | What the Processor Will Do | Response Timeframe | How to Request |
| Right of Access (Art. 15) | Provide a full JSON/CSV export of all personal data associated with a specified user account, including: profile data, audit log entries, movement records, alert configs, and support tickets. | Within 5 business days of request from Controller | Controller emails privacy@edgeon.no with user ID or email address |
| Right to Rectification (Art. 16) | Update inaccurate profile data (name, email, phone) on documented Instruction. Note: audit log entries recording historical events are immutable by design and cannot be altered. | Within 5 business days | Controller submits correction via platform admin tools or privacy@edgeon.no |
| Right to Erasure (Art. 17) | Logically delete user account and associated profile data. Purge from active database within 30 days. Audit logs are retained for 12 months per legal obligation – this is documented as an exemption under Art. 17(3)(b). | Logical deletion within 5 days; physical purge within 30 days | Controller submits erasure request to privacy@edgeon.no |
| Right to Restriction (Art. 18) | Suspend all active processing of the specified user’s data, flag account as restricted, and notify Controller. Data remains stored but is not used for any active processing. | Within 3 business days | Controller emails privacy@edgeon.no with user ID and grounds |
| Right to Data Portability (Art. 20) | Export specified user’s personal data in JSON format or structured CSV. Covers profile data, consent records, and operational records attributed to that user. | Within 5 business days | Controller uses platform export feature or requests via privacy@edgeon.no |
| Right to Object (Art. 21) | Where processing relies on legitimate interest, Processor will assess and respond to valid objections. Most platform processing is contract-based and not subject to this right. | Within 10 business days | Controller raises in writing to privacy@edgeon.no |
The Processor will not charge the Controller for reasonable data subject assistance requests. Where requests are manifestly unfounded, repetitive, or excessive in scope, the Processor may charge a reasonable administrative fee after prior notice to the Controller.
Document Information
Version 1.0 · March 2026 · Edgeon AS · GDPR Art. 28 Compliant · Governing Law: Norway
This DPA contains four Annexes (A–D). All annexes form an integral part of this agreement. [TODO: Insert org.nr, registered address, confirm sub-processor list, have Norwegian legal counsel review before use]