Data processing agreement

1. Parties and scope

The processor is Sandbech Holding AS, organisation number 938 462 666, Tyren 1, 2165 Hvam, Norway (Sipio). Contact for instructions, rights and security incidents: privacy@sipio.no.

The controller is the organisation whose legal name and organisation number the Venue owner confirms when accepting this agreement. Acceptance covers the specific Venue identified in the electronic acceptance record. Each additional Venue requires separate acceptance, including when the same organisation operates it. The owner confirms authority to enter this agreement on the organisation's behalf.

This agreement governs Sipio's processing of guest data on the Venue's behalf through Sipio. Sandbech Holding AS offers this agreement as processor and is bound when the authorised owner records acceptance of the published version. It takes effect at that recorded time and applies until processing ends and the information is returned or deleted. Acceptance does not retrospectively establish an agreement for earlier processing. It prevails over service terms in conflicts about this processing. Sipio's own purposes for user administration, billing, support and platform security are described separately in the privacy notice.

2. Processing and the Venue's responsibilities

The purpose is to manage the Venue's bookings, events and necessary communications with bookers and guests. Processing includes collection, recording, storage, organisation, display, alteration, sending, receipt, export and erasure. It occurs continuously while the Venue uses the service and afterwards only for agreed return, deletion or legally required retention.

Data subjects are bookers, guests and contact persons included in the Venue's bookings and communications. Data includes names or organisation names, contact details, dates and times, selected services, party size, status, notes, messages and delivery information. Identifiers, access information and limited technical information may be processed as necessary for the functions and security.

The service is intended for ordinary booking information. The Venue must not use it for intentional collection of health information, other Article 9 special categories or Article 10 data. If such information is received inadvertently, the parties must restrict access and establish lawful handling and deletion without undue delay.

The Venue determines purposes and lawful bases, informs data subjects, limits information to what is necessary and ensures lawful instructions and authorised users. It may verify Sipio's compliance and instruct correction, access, export, restriction and deletion within this agreement and applicable law.

3. Documented instructions and confidentiality

Sipio processes information only on the Venue's documented instructions, including instructions concerning transfers to third countries. This agreement with completed annexes, the Venue's use of agreed functions and written instructions from authorised representatives constitute those instructions. Sipio does not use guest data for its own marketing, model training or profiling.

If EEA law requires other processing, Sipio informs the Venue before processing unless that law prohibits notification on important grounds of public interest. Sipio immediately informs the Venue if an instruction appears to infringe data-protection law and clarifies the affected processing with the Venue.

People granted access must be authorised, need access for their duties and be bound by confidentiality or an appropriate statutory duty of confidentiality. Access must be restricted and removed when no longer needed.

4. Security

Sipio implements and documents technical and organisational measures providing security appropriate to risk under Article 32, considering the nature, scope, context and purposes of processing, implementation costs and risks to individuals' rights and freedoms.

The completed security annex describes access controls, Venue isolation, transmission and storage, logging, updates, backups, recovery and incident handling. Measures are evaluated regularly and after material changes. Changes must maintain an appropriate security level. This agreement does not assert that Sipio holds a certification.

5. Subprocessors and transfers

The Venue grants general written authorisation for the subprocessors identified in the completed provider annex. That annex identifies each provider, function, information, processing countries and applicable transfer mechanism. Payment and accounting providers are not guest-data subprocessors merely because Sipio uses them.

When Sipio selects a new direct subprocessor or replaces one, it gives written notice to the Venue's agreement contact at least 30 days before the intended processing starts. The notice identifies the provider, the affected processing and relevant locations and transfer safeguards. The Venue may raise a reasoned data-protection objection before the change takes effect.

For changes made further down an existing provider's supply chain, Sipio forwards the available notice without undue delay, including the provider's actual objection deadline, and promptly raises the Venue's reasoned objection with that provider. This does not promise a 30-day notice period from every downstream provider. Sipio must preserve a real opportunity to object and ensure lawful processing; a short upstream deadline does not remove those obligations.

Where the Venue raises a reasoned data-protection objection, the parties seek a resolution before the disputed processing starts. If lawful processing cannot be ensured, the affected processing must not start or continue. Practical resolution and any termination of affected services are agreed in writing.

Sipio imposes equivalent data-protection obligations on subprocessors through a written agreement and remains fully liable to the Venue for performance of their obligations. Sipio provides relevant agreement information on request, with necessary protection of confidential information and other individuals.

Transfers and access outside the EEA require documented instructions, a valid GDPR Chapter V mechanism, and necessary assessments and supplementary measures. EU storage alone does not establish the absence of third-country access. If the mechanism ceases to apply, the affected transfer must stop or be lawfully safeguarded before continuing.

6. Assistance, breaches and oversight

Sipio assists the Venue through appropriate measures, insofar as possible, with data-subject rights under Chapter III. Requests received directly concerning the Venue's guest data are forwarded without undue delay. Sipio does not respond on the Venue's behalf without instruction or a legal requirement. The Venue assesses the request and ensures a response within the applicable deadline.

Considering the nature of processing and available information, Sipio assists with Articles 32–36, including security, breach notifications, impact assessments and prior consultation with the supervisory authority.

Sipio notifies the Venue without undue delay after becoming aware of a personal data breach affecting information processed on its behalf. Initial notice must not await a completed investigation. Sipio progressively provides available information about the incident's nature, affected categories and scope, contact point, likely consequences and measures. The Venue assesses and fulfils its own notification duties.

Sipio makes available information necessary to demonstrate Article 28 compliance and allows and contributes to audits and inspections by the Venue or its authorised auditor. Reasonable planning and confidentiality protect other Venues and security without obstructing legally required oversight or supervisory-authority access.

7. Retention, return and erasure

The completed processing and retention annex sets out the Venue's default instructions, available export scope, deletion from active systems and time-limited copies. Environment settings alone do not change agreed instructions. The Venue may lawfully instruct earlier erasure.

At termination, the Venue chooses erasure or return of all personal data Sipio processes on its behalf. Remaining copies are deleted after return unless EEA law requires further storage. This includes subprocessor copies. Legally required retention is limited, explained and protected from other use.

The Venue has 30 days from service end to request return of its data and may instruct earlier erasure. During that window, Sipio restricts further processing to the agreed return and erasure process or a specific legal requirement. Sipio arranges secure delivery with the authorised contact and erases remaining copies after return, or after the window if no return is requested, subject to the copy-expiry rules and lawful exceptions in the retention annex. The 30-day window is not a universal backup-expiry period.

Sipio carries out a valid erasure instruction without undue delay and completes erasure from active systems within 30 days. On service exit, that completion period starts when the export window ends, unless the Venue instructs earlier erasure. Sipio must explain any specific lawful retention exception and separately identify restricted backup copies and their expiry. The deadline does not permit continued ordinary use of data awaiting erasure.

Backups are restricted to documented expiry periods and must not be used for ordinary processing. After restoration, previous erasure instructions must be applied before returning information to ordinary use. Sipio confirms completed erasure and identifies any time-limited or legally required remaining copies.

Electronic acceptance and annexes

The electronic acceptance record identifies the organisation's legal name and organisation number, the covered Venue's identifier and name, the authenticated owner's identifier, name where available and email address, the accepted version and language, the document digest and the acceptance time. The owner's recorded email is the initial agreement contact. The Venue must notify Sipio of contact changes. Sipio's contact is privacy@sipio.no.

The archived version must contain the agreement and all its annexes so that the record identifies the complete accepted package. The Venue can retain a copy of that version. A new version requires fresh acceptance. Acceptance recorded as testing does not enter this agreement into force.

Annex A records the agreed processing and retention instructions. Annex B describes the security measures. Annex C identifies suppliers and transfer instructions. These annexes form part of this agreement.

Annex A. Processing and retention instructions

The purpose, operations, data categories and data subjects are described in section 2. Processing continues for the service relationship and the limited return/erasure period in section 7. No new purpose is authorised by keeping a copy.

The default instruction is to remove guest-identifying booking and event information after two years (730 days) from the event's end, or start when no end is recorded, and no earlier than two years after newer correspondence. A booking without a linked event uses its requested date. An undated event requires an instruction or a date before expiry can be calculated. Earlier lawful instructions take precedence. Specific legal preservation needs must be documented, limited and reviewed.

The scope includes names, contact details, identifying titles and free text, notes, message content and addresses, copied snapshots and cancellation alerts, related tasks, delivery records and queued email payloads. Removing only a name or only message content does not fulfil the instruction. Retained history is limited to monthly event and attendance totals. Individual dated event history is not retained under this default. Totals may remain only where individuals can no longer reasonably be identified, including through other retained fields or available information. Otherwise the identifying record must be erased.

Email delivery diagnostics normally expire after 90 days. That diagnostic period does not extend an earlier valid erasure instruction. Separate supplier-held messages, logs and backups follow the specified copy limits and any required deletion instruction; Sipio does not treat deletion from its calendar as deletion from every system.

On return, Sipio provides the Venue's available booking, event and correspondence records and their relevant related data in a commonly readable electronic format, with an explanation of the format and any specific omissions. A read-only database snapshot can form part of the package. Provider-held data and unlinked records require separate review, without exposing another Venue's information. Authorisation and the delivery channel must be verified, and temporary export copies removed when no longer needed for delivery and confirmation.

Sipio reviews retention during the pilot at least weekly and carries out scoped operator erasure with affected processing paused and drained. A database-only or message-content-only cleanup is not confirmation of complete erasure. Monthly totals require an identifiability assessment before retention or disclosure as anonymous information. Minimal instruction and completion evidence is restricted and retained only while justified for compliance or specific claims.

The configured Neon history window is seven days and backup retention is 30 days. Upstash daily backups have a user-reported 30-day retention setting. Manual snapshots must be removed when no longer necessary or assigned a documented finite expiry; indefinite manual snapshots are not authorised. Relevant supplier recovery copies and expiry are recorded separately for an erasure instruction, restricted from ordinary processing and reconciled before any restore. Google Workspace system deletion after customer-irrecoverable deletion follows its CDPA, as soon as reasonably practicable and within a maximum of 180 days unless applicable law requires storage. This does not extend Sipio’s active-system erasure deadline. A provider’s published event or plan period is not a universal limit for every copy category.

Annex B. Security measures

Access and confidentiality. Sipio limits production and administrative access to authorised operators with a work-related need and confidentiality obligations. The current Sipio operator uses two-factor authentication on provider accounts, disk encryption and automatic screen lock. Application access uses authenticated identity, Venue ownership/membership and role checks. Guest access links are treated as credentials. Access is reviewed and removed when no longer needed.

Transmission and storage. Browser access and managed-service connections use HTTPS/TLS where supported by the relevant connection. The production database provider requires TLS and documents encryption at rest. Hosting, email and monitoring providers supply their own documented storage and key-management controls. Sipio does not claim to hold the providers' encryption keys or its own security certification. Ordinary email delivery depends on receiving systems and is not end-to-end encrypted by Sipio.

Environments and exports. Production information stays with the agreed production providers. Development and staging use separate data. An authorised return or rights-request operation may create a limited temporary export on an encrypted operator device, with private file permissions, outside source control, secure delivery and deletion when no longer needed. Database URLs, access tokens and API secrets must not be placed in public documents, issues or logs.

Monitoring and minimisation. Session Replay is disabled. Error reporting removes automatically attached request bodies and scrubs booking/access tokens in URLs. Failed-booking diagnostics use technical errors and correlation identifiers rather than a copy of the guest form. Such identifiers may still be personal data. Sentry Developer error events have a documented 30-day retention period; this is separate from organisation audit logs, supplier backups and other monitoring records. Earlier stored events require separate handling where an erasure instruction applies.

Updates and testing. Sipio uses dependency-update notifications, reviews relevant security fixes and tests application changes before release. Source control has weekly dependency-update configuration. Venue isolation and authorised access form part of application verification. Measures are reviewed regularly and after material changes or incidents.

Backups and recovery. The configured Neon production project is in Frankfurt, with a seven-day history window and 30-day backup retention. Restore access is restricted. A restore is verified in isolation before returning to ordinary processing, and earlier erasure instructions must be reapplied. Other suppliers' copies have separate limits. Recovery-drill observations are not a contractual uptime or recovery-time guarantee.

Incidents and requests. The operator monitors privacy@sipio.no and supplier security notifications, can contact affected Venues and keeps a limited record of instructions, actions and remaining copies. Initial breach notice is given without undue delay and updated as facts become available. Supplier changes follow section 5, including the subscribed upstream notices. These measures do not claim a staffed round-the-clock security team.

Annex C. Suppliers and transfer instructions

The Venue authorises the following suppliers for the stated processor work. A supplier may also perform a separate task for which Sipio is controller. The scope of authorisation follows the actual data and task, not the fact that a supplier appears in the stack.

Vercel Inc., United States. Hosting and execution of booking/host functions, delivery of the public service, technical logs and Venue branding files. Data can include booking/contact information during execution, request and technical identifiers, and uploaded branding. Selected Functions and Blob regions are Stockholm, Sweden (`arn1`). Edge delivery, logs, support and other provider operations are separate from those selected regions and may involve the United States or authorised onward locations.

Databricks, Inc. / Neon, LLC, United States. Managed production database for the booking, event, contact, message and related records described in section 2. Selected production storage is AWS Europe Central 1, Frankfurt, Germany. The configured history window is seven days and backup retention is 30 days. These are product settings, not an assertion that every supplier copy or support activity is confined to that location or duration.

Plus Five Five, Inc., trading as Resend, United States. Sending and receiving booking-related email: sender/recipient addresses, message content, replies and delivery information. The selected sending/domain region is `eu-west-1`, Ireland. This does not guarantee that every inbound, log, support or backup operation stays there. Pro has published 30-day data retention; specific copy categories and an earlier erasure instruction require separate handling.

Functional Software, Inc., trading as Sentry, United States. Technical error monitoring, including limited request/device information, diagnostic context and booking correlation identifiers. The organisation uses EU event storage. Session Replay is disabled and guest form recovery payloads are excluded. Developer error-event retention is 30 days; organisation audit records and supplier copies are distinct categories.

Upstash, Inc., United States. Redis for traffic limits and operational change/work signals. Data includes HMAC-derived IP identifiers, Venue/booking identifiers, counters and scheduling signals, rather than a copy of the guest's booking text or messages. Production primary storage is Frankfurt, Germany (`fra1`), without read replicas. Identifiers remain subject to applicable data-protection duties.

Google Cloud EMEA Limited, Ireland, with Google LLC and authorised onward suppliers. Google Workspace for the privacy/support mailbox and limited instruction-handling records, including guest information when necessary to assist the Venue. The Business Starter subscription has no configured Europe data-residency policy. Processing can occur in Google's published service/data-centre and onward-supplier locations, including the United States. This authorisation covers necessary Workspace processor work, not unrelated Google products. Supplier-system deletion follows the applicable CDPA conditions; it is separate from Sipio removing content from active mailboxes.

Separate controller functions. Clerk, Inc. supplies platform authentication and session security for user identity, login and related technical information. Stripe and DNB Regnskap/Unimicro support Sipio's own subscription billing and accounting. They are not authorised to receive the Venue's guest booking conversations merely by being listed. Where Sipio uses a listed supplier for its own controller purpose, the privacy notice applies to that distinct processing. The same distinction applies to Workspace compliance correspondence and Sentry platform-security records.

Third-country instructions. The Venue instructs the necessary processing in the selected EEA regions and permits qualifying United States transfers for the named recipients under the EU–US Data Privacy Framework where the actual recipient and data are covered by an active participation and a valid adequacy decision. Relevant register profiles were checked on 18 October 2026, including Neon under Databricks. Resend was listed as active with re-certification under review. Status and coverage must be rechecked when circumstances change.

For a transfer not covered by an applicable adequacy decision, the relevant provider agreement's EU standard contractual clauses under Decision 2021/914, with the module appropriate to the actual roles, required assessment and supplementary measures must be in place before transfer. An EEA storage choice or a parent company's DPF entry does not by itself authorise every onward country or recipient. Sipio must identify the applicable onward processing and safeguards, provide relevant information on request and apply section 5 to changes. Processing without a valid safeguard must not start or continue.

The current public supplier overview is available at /providers (Norwegian) and /en/providers (English). Sipio provides the applicable supplier-list and safeguard information through privacy@sipio.no. A supplier website update does not silently remove the notice, objection or transfer duties in this agreement.