Translation for information. The Norwegian version applies.
This agreement applies between the customer (controller) and ANZYZ Technologies AS, org. no. 914 490 944 (processor), hereafter ANZYZ, as the parties are stated in the standard contract. It meets the requirements of the General Data Protection Regulation (GDPR) Article 28, and is accepted by signing the standard contract.
1. Purpose. ANZYZ shall process personal data only to deliver the FIKO customer relationship platform to the customer: dialling, recording, maps, orders, SMS, reports and – if the customer has chosen it – AI summary and quality check.
2. Data concerned. About the customer's customers and contacts: name, address, phone number, email, date of birth, order and call history, recordings and transcripts. About the customer's users (agents and manager users): name, username, activity log and position on the map when the agent shares it.
3. Instructions. ANZYZ shall process the data only on the customer's instructions, as set out in the agreement and in the settings the customer makes in the solution. ANZYZ shall say so if an instruction may conflict with data protection law.
4. Confidentiality and security. Everyone with access to the data at ANZYZ shall be bound by confidentiality. ANZYZ shall have access control, encrypted transfer, logging and backups, appropriate to the risk, cf. Article 32.
5. Storage and transfer. Data shall be stored in Norway. Data shall not be transferred outside the EEA without a valid basis under GDPR Chapter V. If the customer uses the AI add-on with an external language model, call data may be processed outside the EEA on the basis of the European Commission's standard contractual clauses. With the customer's own local language model, the data does not leave the customer's control.
6. Sub-processors. The customer gives general authorisation for ANZYZ to use sub-processors for operations, telephony, SMS and the AI add-on. An overview of current sub-processors is available from ANZYZ on request. The customer is notified at least 30 days before new sub-processors are used, and may object. ANZYZ shall impose the same obligations on its sub-processors as follow from this agreement.
7. Assistance to the customer. ANZYZ shall help the customer respond to requests from data subjects (access, rectification, erasure) and with data protection impact assessments when needed.
8. Breaches. ANZYZ shall notify the customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach. The customer can then notify the Norwegian Data Protection Authority within 72 hours.
9. Audit. ANZYZ shall provide the customer with the information needed to show that the agreement is followed, and facilitate audits on reasonable notice.
10. Deletion. The solution has automatic deletion routines controlled by the customer. When the agreement ends, ANZYZ shall delete or return the data within 30 days, unless the law requires it to be stored.
11. Duration. The agreement applies for as long as ANZYZ processes personal data for the customer.
12. Privacy contact. ANZYZ Technologies AS, support@fiko.no, +47 38 70 15 15.