Legal

Data Processing Agreement

Last Updated: January 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between Dealdrive AS, a Norwegian limited company with organization number 934 150 937, with registered address at Arbins gate 2, 0253 Oslo, Norway ("Dealdrive" or "Processor"), and the Customer identified in the Agreement ("Customer" or "Controller").

This DPA applies where Dealdrive processes Personal Data on behalf of Customer in connection with the Dealdrive virtual data room platform (the "Service").

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

"Applicable Data Protection Law" means all laws applicable to the processing of Personal Data under this DPA, including the GDPR and the Norwegian Personal Data Act (Personopplysningsloven).

"Controller" means the entity that determines the purposes and means of processing Personal Data.

"Data Subject" means an identified or identifiable natural person whose Personal Data is processed.

"GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation).

"Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.

"Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

"Processor" means an entity that processes Personal Data on behalf of the Controller.

"Processing" means any operation performed on Personal Data, as defined in Article 4(2) of the GDPR.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for transfer of personal data to third countries adopted by the European Commission.

"Sub-processor" means any Processor engaged by Dealdrive to process Personal Data on behalf of Customer.

2. Roles and Scope

2.1 Roles

(a) Customer is the Controller of Personal Data contained in Customer Content uploaded to the Service.

(b) Dealdrive is the Processor, processing Personal Data on Customer's behalf according to Customer's documented instructions.

2.2 Scope

This DPA applies to all Personal Data processed by Dealdrive on behalf of Customer in connection with the Service. Processing details are described in Schedule 1.

2.3 Customer Obligations

Customer represents and warrants that:

(a) It has a lawful basis for the processing contemplated by this DPA;

(b) It has provided required notices to, and obtained necessary consents from, Data Subjects;

(d) Its instructions to Dealdrive comply with Applicable Data Protection Law.

2.4 Content Uploaded by Invited Users

Where Invited Users upload content containing Personal Data to Customer's Data Rooms, the Invited User (or their principal) is the Controller of such data. Dealdrive processes it under the Terms of Use. Customer's instructions under this DPA do not extend to such content, except for access controls and Data Room administration.

3. Processor Obligations

3.1 Processing Instructions

Dealdrive shall process Personal Data only on documented instructions from Customer, unless required by applicable law. If so required, Dealdrive shall inform Customer before processing unless prohibited by law. Customer's instructions are documented in the Agreement, this DPA, and Customer's configuration and use of the Service.

3.2 Unlawful Instructions

If Dealdrive reasonably believes an instruction infringes Applicable Data Protection Law, Dealdrive shall promptly notify Customer and may suspend performance until Customer confirms or modifies the instruction.

3.3 Confidentiality

Dealdrive shall ensure that persons authorized to process Personal Data are bound by confidentiality obligations.

3.4 Security Measures

Dealdrive shall implement appropriate technical and organizational measures to ensure security appropriate to the risk, as required by Article 32 of the GDPR. Security measures are described in Schedule 2. Dealdrive may update these measures provided overall security is not materially decreased.

3.5 Sub-processing

Customer provides general authorization for Dealdrive to engage Sub-processors, subject to Section 4.

3.6 Data Subject Rights Assistance

Dealdrive shall assist Customer by appropriate measures, insofar as possible, to fulfill Customer's obligation to respond to Data Subject requests under Applicable Data Protection Law, as described in Section 6.

3.7 Compliance Assistance

Dealdrive shall assist Customer in ensuring compliance with Articles 32 to 36 of the GDPR, including: (a) security of processing; (b) Personal Data Breach notification; (c) data protection impact assessments; (d) prior consultation with supervisory authorities.

3.8 Deletion and Return

Upon termination, Dealdrive shall, at Customer's choice, delete or return all Personal Data and delete existing copies, unless law requires retention. Customer may export content prior to termination. Dealdrive retains content for thirty (30) days after termination, then deletes it.

3.9 Audit and Information

Dealdrive shall make available information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, and allow for audits subject to Section 7.

4. Sub-processors

4.1 Authorized Sub-processors

Customer authorizes Dealdrive to engage the Sub-processors listed at dealdrive.co/legal/subprocessors as of this DPA's effective date.

4.2 Sub-processor Requirements

Dealdrive shall: (a) enter written agreements with Sub-processors imposing obligations no less protective than this DPA; (b) remain liable for Sub-processor performance; (c) conduct appropriate due diligence.

4.3 New Sub-processors

Dealdrive shall notify Customer of Sub-processor changes by updating dealdrive.co/legal/subprocessors at least fourteen (14) days before the new Sub-processor begins processing. Customer may subscribe to notifications through the Service or by contacting Dealdrive.

4.4 Objection Right

Customer may object to a new Sub-processor by written notice within fourteen (14) days, based on reasonable data protection grounds. The parties shall discuss in good faith. If unresolved within thirty (30) days, Customer may terminate the affected Service with written notice, and Dealdrive will refund prepaid fees for the terminated Service covering the post-termination period.

5. International Transfers

5.1 Processing Locations

Dealdrive primarily processes Personal Data within the European Economic Area ("EEA"). Customer Content is stored in EEA data centers unless otherwise specified.

5.2 Transfer Mechanisms

Where Personal Data is transferred outside the EEA, Dealdrive ensures appropriate safeguards under GDPR Chapter V, including: (a) adequacy decisions; (b) Standard Contractual Clauses; or (c) other recognized mechanisms.

5.3 Standard Contractual Clauses

Where required, the SCCs (Module Two: Controller to Processor) apply to transfers outside the EEA and are incorporated by reference as follows:

(a) Customer is the "data exporter" and Dealdrive is the "data importer";

(b) The optional docking clause (Clause 7) applies;

(d) The optional language in Clause 11 does not apply;

(e) Option 1 in Clause 17 applies; governing law is Norway;

(f) Disputes are resolved by the courts of Oslo, Norway (Clause 18).

5.4 Transfer Impact Assessments

Upon request, Dealdrive shall provide information reasonably necessary for Customer to conduct transfer impact assessments.

6. Data Subject Requests

6.1 Notification

If Dealdrive receives a Data Subject request regarding Personal Data processed for Customer, Dealdrive shall promptly notify Customer (unless prohibited by law) and shall not respond except to confirm the request relates to Customer, unless instructed by Customer or required by law.

6.2 Assistance

Dealdrive shall provide reasonable assistance to respond to Data Subject requests, including: (a) search functionality; (b) enabling access, correction, or deletion through the Service; (c) providing processing information.

6.3 Cost

Assistance under this Section is provided at no additional charge, except where requests are manifestly unfounded, excessive, or require substantial effort beyond standard Service functionality, in which case Dealdrive may charge a reasonable fee.

7. Audits

7.1 Audit Rights

Customer may audit Dealdrive's compliance up to once per year, or more frequently if required by Applicable Data Protection Law or following a Personal Data Breach. Customer shall provide at least thirty (30) days' notice, unless a shorter period is required due to regulatory investigation or breach.

7.2 Conduct

Audits shall occur during normal business hours with minimal disruption. Scope is limited to DPA-relevant matters. Customer and auditors shall maintain confidentiality and not access other customers' data.

7.3 Third-Party Certifications

Dealdrive may satisfy audit requests by providing: (a) third-party audit reports or certifications (SOC 2, ISO 27001); (b) security questionnaires; or (c) other compliance documentation. Customer agrees to accept such documentation in lieu of on-site audit where it reasonably addresses audit requirements.

7.4 Costs

Customer bears its own audit costs. If on-site access beyond Section 7.3 documentation is required, Customer reimburses Dealdrive's reasonable facilitation costs.

8. Personal Data Breaches

8.1 Notification

Dealdrive shall notify Customer without undue delay, and within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer's data. Notification shall include, to the extent known:

(a) Nature of the breach, including categories and approximate numbers of Data Subjects and records;

(b) Dealdrive's data protection contact;

(d) Measures taken or proposed.

8.2 Assistance

Dealdrive shall cooperate to: (a) investigate the breach; (b) fulfill Customer's notification obligations; (c) mitigate effects. Dealdrive shall document breaches and responses.

8.3 Customer Obligations

Customer is responsible for determining whether to notify supervisory authorities and Data Subjects. Dealdrive shall not notify on Customer's behalf unless instructed or required by law.

9. Liability

9.1 Liability Cap

Each party's liability under this DPA is subject to the Agreement's limitations, except as provided in Section 15.3 of the Terms of Service regarding data protection breach exceptions.

9.2 Indemnification

The Agreement's indemnification obligations apply, including Customer's indemnification of Dealdrive for claims from Customer's Controller obligations breach.

10. Term

10.1 Duration

This DPA remains effective while Dealdrive processes Personal Data on Customer's behalf under the Agreement.

10.2 Survival

Provisions that by nature should survive termination shall survive, including Section 3.3 (Confidentiality), Section 3.8 (Deletion), Section 7 (Audits) for post-termination verification, Section 8 (Breaches) for post-termination discoveries, and Section 9 (Liability).

11. General

11.1 Precedence

This DPA prevails over the Agreement for Personal Data processing matters. The SCCs prevail over this DPA where applicable.

11.2 Amendments

Dealdrive may update this DPA to reflect changes in Applicable Data Protection Law or processing practices, with notice per the Agreement. Continued use constitutes acceptance.

11.3 Governing Law

This DPA is governed by Norway's laws, unless the SCCs specify otherwise.

11.4 Contact

Questions: [email protected]

Schedule 1: Details of Processing

Subject Matter

Dealdrive processes Personal Data to provide the virtual data room Service, including secure document storage, sharing, collaboration, access control, and analytics.

Duration

Processing continues for the Agreement's duration, plus the thirty (30) day post-termination retention period, unless Customer requests earlier deletion or law requires longer retention.

Nature and Purpose

Dealdrive processes Personal Data to: (a) store and organize uploaded documents; (b) control Data Room access; (c) enable collaboration features; (d) generate audit trails and reports; (e) provide AI-powered analysis; (f) maintain security; (g) provide support.

Types of Personal Data

Any categories in Customer Content, typically including: (a) names and contact information; (b) professional information; (c) financial information; (d) identification numbers; (e) other data in due diligence materials and contracts.

Categories of Data Subjects

Data Subjects may include: (a) employees, officers, and directors of Customer and counterparties; (b) customers and suppliers referenced in documents; (c) shareholders and investors; (d) advisors and representatives; (e) other individuals in Customer Content.

Special Categories

Customer may upload special category data (health data, trade union membership, etc.). Customer ensures lawful basis. Dealdrive does not require such data but processes it as part of Customer Content under this DPA.

Schedule 2: Technical and Organizational Measures

Dealdrive implements appropriate technical and organizational security measures, including:

Access control and authentication
Encryption in transit and at rest
Infrastructure and network security
Operational security and monitoring
Business continuity and disaster recovery
Organizational measures and personnel training

Measures may be updated to reflect security improvements, provided overall protection is not materially decreased.

Detailed technical documentation describing specific security measures is available upon request under appropriate confidentiality protections. To request documentation, contact [email protected].

Schedule 3: Sub-Processors

A current list of authorized Sub-processors is maintained at dealdrive.co/legal/subprocessors.

Customer may subscribe to Sub-processor change notifications through the Service or by contacting Dealdrive at [email protected].