Skip to content
ResearchTeamPressContactLog inEnglish / Norsk
← Legal

Data Processing Agreement

Version 1.0 · Effective from 15 October 2026

This data processing agreement (the "DPA") forms part of the Customer Terms and applies between the customer (the "Customer") and Reliable AI AS, reg. no. 934 343 786 (the "Supplier"). It governs the Supplier's processing of personal data on behalf of the Customer when delivering the Service, and meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).

This DPA is published in Norwegian and English. In case of discrepancy, the Norwegian version prevails.

1. Roles

1.1 The Customer is the controller and the Supplier is the processor of personal data that the Supplier processes on the Customer's behalf when delivering the Service, as described in Appendix 1.

1.2 For processing the Supplier carries out for its own purposes, which are limited to managing the customer relationship, invoicing, securing the Service and improving the Service, the Supplier is itself the controller. That processing is described in the Supplier's privacy policy.

1.3 The Customer is responsible for having a lawful basis for the personal data processed on its behalf, and for ensuring that its instructions to the Supplier comply with data protection law.

1.4 The Customer may switch off storage of search text for all its Users. Stored search text is not linked to the Customer or the Users, is processed by the Supplier as controller under clause 1.2, and is deleted or anonymised within 90 days. Clause 7.2 does not apply to stored search text.

2. The Supplier's obligations

2.1 The Supplier shall process personal data only on documented instructions from the Customer. The Customer Agreement, the Customer Terms and this DPA constitute the Customer's instructions. If the Supplier considers that an instruction infringes data protection law, the Supplier shall inform the Customer. If the law requires the Supplier to process the personal data otherwise, the Supplier shall inform the Customer before the processing, unless that law prohibits it.

2.2 The Supplier shall ensure that persons with access to the personal data are bound by confidentiality.

2.3 The Supplier shall implement appropriate technical and organisational measures to secure the personal data, in accordance with Article 32 GDPR. The measures are described in Appendix 2.

2.4 The Supplier shall, as far as is reasonable given the nature of the processing, assist the Customer in fulfilling data subjects' rights and the Customer's obligations under Articles 32 to 36 GDPR.

2.5 The Supplier shall not use personal data processed on the Customer's behalf to train generative AI models.

3. Sub-processors

3.1 The Customer gives general authorisation for the Supplier to use sub-processors. Current sub-processors are listed on the Supplier's website, see Sub-processors.

3.2 The Supplier shall notify the Customer of new or replaced sub-processors in reasonable time, and as a rule at least 30 days, before the change takes effect. The Customer may object on reasonable grounds. If the parties cannot find a solution, the Customer may terminate the Customer Agreement with effect from the change.

3.3 The Supplier shall impose the same data protection obligations on sub-processors as follow from this DPA, and is liable to the Customer for the sub-processors' performance of them.

4. Location of processing

4.1 Personal data is stored and processed within the EU/EEA. Transfers to countries outside the EU/EEA take place only on a valid transfer basis under Chapter V GDPR.

5. Personal data breaches

5.1 The Supplier shall notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer. The notice shall, as far as it is known, contain the information the Customer needs to fulfil its obligations under Articles 33 and 34 GDPR.

5.2 The Supplier shall promptly take the measures necessary to limit the consequences, and keep the Customer informed until the incident is closed.

6. Audits

6.1 The Supplier shall make available the information necessary to demonstrate compliance with this DPA.

6.2 The Customer may, itself or through an independent auditor bound by confidentiality, carry out an audit on reasonable notice, at a time agreed between the parties. The Supplier shall contribute to the audit. The audit shall be carried out without undue disruption to the Supplier's operations and at the Customer's cost.

7. Term, deletion and return

7.1 This DPA applies for as long as the Supplier processes personal data on the Customer's behalf.

7.2 When the Customer Agreement ends, the Supplier shall, at the Customer's choice, delete or return the personal data and delete existing copies, unless the law requires them to be retained. The Supplier confirms the deletion in writing on request. Data in backups and logs is deleted when their fixed retention periods expire.

8. Liability and precedence

8.1 Liability under this DPA is governed by the Customer Terms, including the limitations of liability.

8.2 In case of conflict between this DPA and the Customer Agreement or the Customer Terms, this DPA prevails in matters concerning the processing of personal data.

8.3 If the parties have entered into a separate data processing agreement, that agreement prevails over this one.

Appendix 1: The processing

Purpose: To deliver the Service to the Customer, including user access, search, storing and sharing projects within the Customer's organisation, and user support.

Nature of the processing: Collection, storage, structuring, use, sharing within the Customer's organisation and deletion.

Data subjects: The Customer's employees and others the Customer gives access to the Service, and persons referred to in content that users enter themselves.

Categories of personal data:

  • User details: name, e-mail address and employer
  • Sign-in and security logs
  • Information about use of the Service
  • Search text
  • Project content: saved results, notes and comments

Special categories: The Service is not intended for special categories of personal data under Articles 9 and 10 GDPR, and users should not enter such data in searches or notes.

Duration: The term of the agreement, then as set out in clause 7. User accounts inactive for 24 months are deleted automatically.

Appendix 2: Security measures

  • The Service runs on Microsoft Azure within the EU/EEA. Sign-in is handled by Microsoft Entra ID.
  • Data is encrypted in transit and at rest.
  • Access to Customer Data is limited to a small number of named persons at the Supplier, with multi-factor authentication.
  • Customer Data is kept separate between customers and is never added to the search indexes, which contain only public sources.
  • Customer Data is kept in the production environment and is not copied to development environments or laptops.
  • Data is backed up automatically and can be restored.
  • Sign-ins and events in the Service are logged.
  • The Supplier has written procedures for handling security incidents, business continuity and recovery.
  • The Supplier carries out regular internal security reviews.

More information is on the Security page.

Appendix 3: Sub-processors

See Sub-processors.