Data processing agreement

This is an English translation for convenience. If the English and Norwegian versions differ, the Norwegian version applies.

Last updated: October 8, 2026.

This data processing agreement applies when Techspace Solutions AS processes personal data on behalf of a client, for example for operations, hosting, maintenance, support, online stores, forms, ads or email marketing. It is an appendix to the quote and our terms, and meets the requirements of GDPR Article 28. If you want a signed version, email post@techspace.no.

1. The parties

Data controller: the client who has accepted our quote (“the client”). Data processor: Techspace Solutions AS, Org. no. 934 385 128 MVA, Karihaugveien 89, 1086 Oslo (“Techspace”).

2. Purpose and scope

Techspace processes personal data only to deliver the services in the quote. Which services, categories of data subjects (for example visitors, customers, newsletter subscribers) and types of data (for example name, email, phone, address, order history, IP address) are covered follows from the quote. The agreement applies for as long as the main agreement applies.

3. Techspace’s obligations

Techspace shall:

1. process the data only on documented instructions from the client, including for transfers to countries outside the EU/EEA, unless required by law
2. ensure that everyone with access to the data is bound by confidentiality
3. have appropriate technical and organizational security measures (Article 32), including access control, encrypted transfer (SSL) and backup
4. help the client respond to requests from data subjects who want to exercise their rights
5. help the client with security, breach notification and any impact assessments, based on the information Techspace has
6. notify the client without undue delay, and no later than 48 hours, after becoming aware of a personal data breach
7. give the client the information needed to show that the agreement is followed, and allow audits after reasonable notice

4. Sub-processors

The client approves that Techspace uses these sub-processors:

Provider	What	Where
Hostinger	Hosting, operations and backup	EU/EEA
DigitalOcean / Amazon Web Services	Hosting (when stated in the quote)	EU/EEA region when possible
Mailgun	Sending email from forms	EU region
Squares Techworks (our office in Pakistan)	Development, operations and support	Pakistan – European Commission standard contractual clauses

Techspace notifies the client before new sub-processors are used, and the client may object. Techspace imposes the same obligations on sub-processors as in this agreement.

5. Transfers outside the EU/EEA

Data is only transferred outside the EU/EEA when there is a valid transfer basis, for example the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

6. The client’s obligations

The client is responsible for having a legal basis for the processing and for informing the data subjects.

7. Termination

When the main agreement ends, Techspace deletes or returns the data at the client’s choice, no later than 90 days, unless the law requires storage. Data in backups is deleted when the backup is rotated out.

8. Liability and governing law

Liability is governed by the main agreement. Norwegian law applies, and Oslo District Court (Oslo tingrett) is the agreed venue.