Data Processing Agreement

01 Definitions

Terms used in this DPA have the meanings given to them in the GDPR unless defined otherwise below.

• Controller — the Customer entity that determines the purposes and means of processing Personal Data using the dotspot Services.
• Processor — Dotspot AS, org.nr. 937 881 932, Bedriftsveien 18, 4313 Sandnes, Norway.
• Agreement — the Master Subscription Agreement, Pilot Agreement or other written agreement between the Customer and dotspot AS under which the Services are provided, of which this DPA forms part.
• Personal Data — any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller in connection with the Services.
• Services — the dotspot platform, including capture from mobile devices, wearable cameras and connected camera systems, cloud storage, indexing, automated privacy filtering, AI analysis, and related management tools.
• Sub-processor — any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• Data Subject, Processing, Supervisory Authority and Personal Data Breach — as defined in Article 4 GDPR.

02 Subject matter, duration, nature and purpose

The subject matter, duration, nature, purpose, types of Personal Data and categories of Data Subjects are described in Annex I. The Processor processes Personal Data only on documented instructions from the Controller, including with regard to transfers to a third country or international organisation, unless required to do so by Union or Member State law to which the Processor is subject.

This DPA applies for the duration of the Services and survives termination for so long as the Processor processes Personal Data on behalf of the Controller.

03 Roles of the parties

For all Personal Data processed under the Services, the Customer is the Controller and dotspot is the Processor. Where the Customer acts as a processor for a third-party controller (for example, when the Customer captures work performed at a downstream client's site), dotspot acts as a sub-processor on the same terms as set out in this DPA, and the Customer is responsible for obtaining the necessary authorisations from the third-party controller.

04 Controller's obligations

The Controller warrants that:

• it has a valid legal basis under Article 6 GDPR (and, where applicable, Article 9) for the processing of Personal Data through the Services;
• it has provided all required information to Data Subjects under Articles 13 and 14 GDPR, including in respect of POV video, audio and biometric-relevant capture in the workplace;
• it has consulted with employee representatives and complied with any local works-council, co-determination or worker-information requirements applicable to wearable, body-worn or smart-glass capture;
• its instructions to the Processor comply with applicable data protection law; and
• it is responsible for the accuracy, quality and legality of Personal Data and the means by which the Controller acquires the Personal Data.

05 Processor's obligations

In accordance with Article 28(3) GDPR, the Processor shall:

1. Documented instructions. Process Personal Data only on the Controller's documented instructions, including in respect of transfers, unless required to do so by Union or Member State law (in which case the Processor will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest).
2. Confidentiality. Ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Security. Take all measures required pursuant to Article 32 GDPR, as further described in Annex II.
4. Sub-processors. Respect the conditions for engaging another processor as set out in clause 06 and Annex III.
5. Data subject rights. Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to requests for exercising Data Subjects' rights under Chapter III GDPR.
6. Assistance with Articles 32–36. Assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor.
7. Return / deletion. At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of Services, and delete existing copies unless Union or Member State law requires storage.
8. Audit. Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for and contribute to audits, as set out in clause 09.

The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

06 Sub-processors

The Controller grants the Processor a general authorisation to engage the Sub-processors listed in Annex III. The Processor shall:

• impose on each Sub-processor, by way of contract, data-protection obligations that are no less protective than those set out in this DPA, and in particular those required by Article 28(3) GDPR;
• remain fully liable to the Controller for the performance of each Sub-processor's obligations; and
• notify the Controller of any intended addition or replacement of Sub-processors with at least thirty (30) days' prior notice (by updating the published list at this URL and by email to the Controller's registered contact).

The Controller may object to a new Sub-processor on reasonable data-protection grounds within the notice period. If the parties cannot resolve the objection in good faith, the Controller may terminate the affected portion of the Services without penalty.

07 International data transfers

Personal Data is hosted in the European Economic Area (EEA) by default. Where the Processor or a Sub-processor transfers Personal Data outside the EEA, the transfer shall be governed by:

• an adequacy decision under Article 45 GDPR; or
• the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2 / Module 3, as applicable), which are hereby incorporated by reference, together with such supplementary measures as are required following the Schrems II judgment; or
• another transfer mechanism permitted under Chapter V GDPR.

For Customers established in the United Kingdom, the UK International Data Transfer Addendum issued by the ICO applies in addition to the SCCs.

08 Personal data breaches

The Processor shall notify the Controller without undue delay, and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting Controller Personal Data. The notification shall include, to the extent then known:

• the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
• the name and contact details of the Processor's data protection contact (support@dotspot.ai);
• the likely consequences of the breach; and
• the measures taken or proposed to address the breach and mitigate its possible adverse effects.

Where it is not possible to provide all information at the same time, information may be provided in phases without undue further delay. The Processor shall reasonably co-operate with the Controller and any competent Supervisory Authority in the investigation, mitigation and remediation of any such breach.

09 Audit rights

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, in the first instance through:

• the dotspot Trust documentation (architecture overview, sub-processor list, security overview); and
• the published compliance documentation of the Processor's Sub-processors (for example, Microsoft's and Google's public ISO/IEC 27001 and SOC 2 attestations for their cloud platforms), provided on request under a non-disclosure agreement where applicable.

Where such documentation is insufficient to demonstrate compliance with a specific concern, the Controller may, at its own cost and on reasonable prior notice of at least thirty (30) days, conduct an audit no more than once per calendar year (and additionally following a confirmed Personal Data Breach). Audits shall be conducted during business hours, with minimal disruption to the Processor's operations, and shall not require access to data of other customers, source code, or commercially sensitive information. Both parties bear their own costs unless the audit reveals a material non-compliance by the Processor.

10 Return and deletion of Personal Data

On termination or expiry of the Services, the Processor shall, at the Controller's choice, delete or return all Personal Data and delete existing copies, unless Union or Member State law requires storage of the Personal Data.

Unless the Controller instructs otherwise, the Processor shall delete all Personal Data from active systems within thirty (30) days of termination, and from back-ups in accordance with its documented retention cycle (no later than ninety (90) days). The Processor shall, on request, provide written confirmation of deletion.

11 Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits or excludes either party's liability where such limitation or exclusion is not permitted by applicable law, including the rights of Data Subjects under Article 82 GDPR.

12 Governing law and jurisdiction

This DPA is governed by the laws of Norway, without regard to its conflict of laws provisions. The courts of Oslo (Oslo tingrett) shall have exclusive jurisdiction over any dispute arising out of or in connection with this DPA, without prejudice to mandatory provisions of Union or Member State law that grant Data Subjects the right to bring proceedings in the courts of their habitual residence.

13 Order of precedence

In the event of a conflict between this DPA and the Agreement, this DPA shall prevail to the extent of the conflict in respect of the processing of Personal Data. The Standard Contractual Clauses referenced in clause 07 prevail over this DPA in respect of restricted international transfers.