Data processing agreement

1. Parties

Data controller (you): The company or person that has created an account on the Online Erhverv platform.
Data processor (us): Online Erhverv ApS, CVR: DK43216163, Strandvejen 126, 2900 Hellerup.

2. Purpose and scope

The data processor processes personal data on behalf of the data controller for the purpose of providing the following services:

• Operating an AI chatbot that interacts with the data controller's customers
• A booking system that collects customer data (name, phone, email)
• Synchronisation of data from third-party integrations
• Sending SMS and email on behalf of the data controller
• Generating reports based on customer data
• Storing customer contacts, invoices and bookings

3. Categories of personal data

• Contact details: Name, email, phone number, address
• Chatbot data: Conversations, session ID, IP addresses
• Booking data: Dates, times, services, notes
• Integration data: Contacts, invoices, payments, reviews from connected systems
• Job and project data: Job descriptions, addresses, photos, quality assurance reports, service agreements, materials, quotes, invoices and notes linked to the data controller's customers
• Position on the way to a job: When an employee taps Start drive, the phone's latest position is stored so the customer and the business can follow the drive. It stops when the employee arrives, starts the job or cancels, and after 3 hours at the latest. The coordinates are removed when the drive ends; if it expires after 3 hours, the position is no longer shown and is deleted at the next daily clean-up. No position is stored outside a drive

4. Categories of data subjects

• The data controller's customers and clients
• Chatbot visitors on the data controller's website
• Contacts synchronised from integrations

5. The data processor's obligations

The data processor undertakes to:

• Only process personal data on documented instructions from the data controller, including with regard to transfers to third countries, unless processing is required by EU or Member State law. In that case, the data processor informs the data controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest
• Immediately inform the data controller if, in the data processor's opinion, an instruction infringes the GDPR or other applicable data protection law
• Ensure that employees and other persons with access to the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
• Implement appropriate technical and organisational security measures, see GDPR Article 32 (described in more detail in section 6)
• Only use sub-processors in accordance with section 7 (general written authorisation with prior notice and a right to object)
• Taking into account the nature of the processing, assist the data controller by appropriate technical and organisational measures in fulfilling the data subjects' rights (GDPR Chapter III, Articles 12-23)
• Assist the data controller in complying with GDPR Articles 32-36 (security of processing, notification and communication of breaches, impact assessment and prior consultation)
• At the choice of the data controller, delete or return all personal data when the provision of the services ends, and delete existing copies, unless EU or Member State law requires continued storage
• Make available to the data controller all information necessary to demonstrate compliance with GDPR Article 28, and allow for and contribute to audits, including inspections (see section 11)

6. Security measures

The data processor uses the following security measures:

• Encryption: TLS 1.3 for data in transit, AES-256 for integration tokens at rest
• Access control: Row Level Security in the database; customers can only see their own data
• Authentication: Bcrypt-hashed passwords, session-based authentication
• Rate limiting: All public endpoints are protected against misuse
• Prompt injection protection: The AI chatbot has input filtering and output validation
• Logging: Activity log with traceability
• Hosting: Vercel (SOC 2 Type II) and Supabase (SOC 2 Type II, ISO 27001)

7. Sub-processors

By accepting this agreement, the data controller approves the following sub-processors:

The data controller hereby gives a general written authorisation for the sub-processors listed above. When sub-processors are added or replaced, the data controller is informed at least 30 days in advance, so that the data controller has the opportunity to make a reasoned objection. If the data controller makes a reasoned objection and the parties cannot agree on a solution, the data controller can terminate the agreement with regard to the processing concerned without being bound.

The data processor imposes by contract on every sub-processor the same data protection obligations as set out in this agreement, including requirements for appropriate technical and organisational security measures and confidentiality. Online Erhverv ApS remains fully liable to the data controller for the performance of every sub-processor's obligations. If a sub-processor fails to fulfil its data protection obligations, Online Erhverv ApS is fully liable to the data controller for the performance of the sub-processor's obligations.

8. Transfer to third countries

Data may be transferred to the USA via the sub-processors listed above. Transfers to third countries only take place on documented instructions from the data controller (given by accepting this agreement) or where EU or Member State law requires it. The transfer takes place on a valid transfer basis, the EU Standard Contractual Clauses (SCC), supplemented by the suppliers' supplementary technical and organisational measures.

9. Personal data breaches

In the event of a personal data breach, the data processor notifies the data controller without undue delay and no later than 48 hours after becoming aware of the breach. The notification contains:

• A description of the breach and its scope
• Likely consequences
• Measures taken or proposed
• Contact details for further information

The data processor also assists the data controller with its own obligations in the event of a breach, including any notification to the Danish Data Protection Agency (Datatilsynet) without undue delay and, where feasible, no later than 72 hours (GDPR Article 33), and communication to affected data subjects where the breach is likely to result in a high risk (GDPR Article 34).

10. Duration and termination

• This agreement applies as long as the data controller has an active account on the platform
• On termination, all personal data is deleted within 12 months, unless EU or Member State law (for example the Danish Bookkeeping Act, bogføringsloven) requires continued storage
• Certain categories are deleted earlier on an ongoing basis, regardless of termination: the AI phone's transcripts and audio recordings are deleted automatically after 90 days (with us; at ElevenLabs for calls from 7 October 2026), and chatbot conversations after 12 months
• Bookkeeping and payment data is kept for 5 years under the Danish Bookkeeping Act
• The data controller can request an export of its data at any time

11. Review and audit

The data processor makes the necessary documentation available and contributes to audits and inspections carried out by the data controller or an authorised auditor, with reasonable notice. Compliance by the data processor and its sub-processors can be documented by recognised independent third-party audit reports and certifications (for example ISAE 3000, SOC 2 Type II or ISO 27001), where available, and the data controller can request these instead of a physical inspection, unless there is specific reason to do otherwise.

12. Governing law, precedence and termination of the agreement

This data processing agreement is governed by Danish law, and any disputes are settled by the Danish courts. The agreement is ancillary to Online Erhverv's terms. In the event of any inconsistency between this agreement and the other agreements between the parties regarding the processing of personal data, this data processing agreement takes precedence. The agreement is valid as long as the data processor processes personal data on behalf of the data controller, and regardless of the termination of the agreement, sections 5, 6 and 9 remain in force until all personal data has been deleted or returned.

13. Contact

Enquiries about data protection should be sent to:
hej@onlineerhverv.dk