Data Processing Agreement

The terms governing CIRON's processing of personal data on the customer's behalf, see Article 28 of the General Data Protection Regulation.

Translation. This is an English translation of the Norwegian original. The Norwegian version is the binding version and prevails in the event of any discrepancy between the Norwegian and the English text. CIRON AS is a Norwegian company, and the agreement is governed by Norwegian law.

Version 0.9 — utkast til juridisk gjennomgang (draft 0.9, pending legal review). The text has not been reviewed by a lawyer. It applies as a click-through agreement until a signed version is in place, and the signed version prevails in the event of conflict.

1The parties

The controller is the customer. The processor is CIRON AS, org. no. 922 148 759.

2What is processed

The content the customer enters in Nirona: cases, messages, attachments, and the names of those who use the solution. CIRON does not collect email addresses at registration, and the control plane holds no identity.

3Where

Storage and processing take place in the EU. This is enforced in the code — the data stores are opened with jurisdiction eu, not merely documented as an intention.

4Security

A separate data store and a separate encryption key per organisation
Passwordless sign-in, bound to the organisation's own host name
Audit trail with a hash chain
CIRON has no standing access to the customer's content

5Deletion

On termination, the organisation's key is deleted first. After that the content is unreadable, including in backups that have not expired.

6Other terms

Sub-processors, the duty to notify breaches, assistance to the controller and the right of audit are set out in the privacy notice, which forms part of this agreement.

7Language

In the event of any conflict between the Norwegian and the English version, the Norwegian version prevails. CIRON AS is a Norwegian company, and the agreement is governed by Norwegian law.