Data Processing Agreement

GDPR Article 28 mandates a written DPA between any data controller (the organization) and data processor (Norse Digital Products) before personal data is processed. Without a signed DPA, the platform cannot legally handle the sensitive personal data of peer mentors, contacts, and beneficiaries that the operational products collect. For the sales process, a standard published DPA accelerates procurement cycles within organizations whose legal teams need this document for due-diligence review. Publishing it on the Sales Website reduces back-and-forth in contract negotiations and demonstrates proactive compliance, which is a differentiator when selling to disability organizations with regulatory accountability obligations to Bufdir and Norwegian authorities.

Implemented as a static page on the Next.js static-export Sales Website. The content is more technically detailed than the Privacy Policy, covering sub-processor lists, data transfer mechanisms (standard contractual clauses if applicable), and security measures. A downloadable PDF version should be generated from the same source content to support organizations that need a signed copy. WCAG 2.2 AA compliance applies - structure with clear section headings, numbered clauses, and a table of contents for long-form navigation. The DPA must reference the specific categories of personal data processed by the platform including health-related data (medical case details in encrypted assignments) and data about minors (Barnekreftforeningen context), which elevate the GDPR sensitivity class.