Data processing agreement
Version 1.0, effective from 4 November 2026
This agreement applies when ON IT AS, org. no. 996 825 396 (“ON IT”), processes personal data on behalf of a customer (the “Customer”) that uses GraphQL Server for Visma Business. The Customer is the controller and ON IT the processor under Article 28 of the General Data Protection Regulation (GDPR).
1. When the agreement applies, and how it is entered into
1.1 The software runs in the Customer’s environment, and ON IT normally has no access to the Customer’s data. The agreement applies when ON IT nevertheless processes personal data for the Customer in support, troubleshooting, installation, upgrades or customisation – also when ON IT receives logs, error reports, queries, sample data, screenshots or a copy of a database, or gets remote access to the Customer’s systems.
1.2 The agreement is entered into when the Customer asks for such assistance in writing, including by e-mail, or when the parties sign it. ON IT confirms in writing, on the first contact in a case, that the assistance is given under this agreement, with its version and a link. Assistance ordered orally starts only once ON IT has confirmed the order in writing. The Customer may ask to sign the agreement.
1.3 For the processing of personal data, the agreement takes precedence over the license terms and any other agreement between the parties. Otherwise the license terms apply to the assistance, including point 8 as point 12 below provides.
1.4 The agreement does not cover the data ON IT processes as controller to license and invoice; see the privacy policy.
2. What is processed
2.1 Purpose: to give the assistance the Customer has asked for in the case. The Customer’s order states which system or company, which material and which assistance the case concerns, and ON IT processes no more than that.
2.2 Processing: receiving, storing, viewing (including through remote access), searching, copying and testing, and – only on an express instruction in the case – changing or deleting data in the Customer’s database.
2.3 Data subjects: the Customer’s customers, suppliers, employees and contact persons, and others registered in the Customer’s Visma Business.
2.4 Data: what the material the Customer gives access to in the case contains, typically names and contact details, customer and supplier relationships, orders, invoices and transactions, and for employees personal details, pay, bank account numbers and national identity numbers. Payroll data may contain special categories (GDPR Article 9), such as trade union deductions and absence. The Customer shall remove or anonymise such data where the assistance does not need it, and tell ON IT if the material still contains it.
2.5 Duration: for as long as the case lasts and until the data has been deleted under point 10.
3. Instructions and the Customer’s obligations
3.1 ON IT processes the data only on documented instructions from the Customer, including for transfers outside the EEA under point 7. This agreement and the Customer’s written order in the case are the instructions. A copy of a production database, remote access to production, and changing or deleting data require an express written instruction in the case.
3.2 Instructions may be given by the Customer’s contact person, by whoever ordered the assistance, or by someone the Customer has authorised, for example the Customer’s partner. ON IT may assume that whoever gives an instruction is authorised. Where the partner is the Customer’s processor, ON IT processes the data as the partner’s sub-processor on the terms of this agreement, and the partner warrants that the Customer has approved it.
3.3 ON IT informs the Customer immediately if, in ON IT’s opinion, an instruction infringes data protection law, and may suspend the processing until the Customer has confirmed or changed the instruction.
3.4 The Customer shall give ON IT access only to the personal data the assistance requires, and shall as far as possible use a test company, extracts or anonymised data. Database copies and payroll data are sent only when ON IT has asked for them, and only in the way ON IT specifies. Data ON IT has not asked for may be deleted by ON IT without being processed.
3.5 The Customer is responsible for the instructions being lawful and for the processing having a legal basis.
3.6 ON IT does not use the data for its own purposes and does not disclose it to anyone but sub-processors under point 6, unless EEA or Norwegian law requires it. ON IT then informs the Customer first, unless that law prohibits it. ON IT does not comply with demands for disclosure from authorities outside the EEA unless EEA or Norwegian law requires it, and informs the Customer.
4. Confidentiality
Everyone processing the data for ON IT is bound by confidentiality, also after the agreement and their employment have ended.
5. Security
5.1 ON IT implements measures under GDPR Article 32 appropriate to the risk. They normally include:
- access only for employees who need it in the case
- two-factor authentication on ON IT’s e-mail and file storage
- encrypted disks on ON IT’s computers
- encrypted transfer where ON IT chooses the channel
- remote access only in sessions the Customer has granted or approved
- national identity numbers, pay and bank account numbers masked in logs, sample data and screenshots where the case does not need them
- the Customer’s data is not loaded into ON IT’s own development or test environments beyond what the case requires
ON IT may change the measures as long as the level of security is not reduced.
5.2 ON IT does not ask for database copies or payroll data as ordinary e-mail attachments, and specifies a secure way of transferring files when it is needed.
6. Sub-processors
6.1 The Customer gives general prior authorisation for ON IT to use sub-processors. On entering into the agreement, these are approved:
| Sub-processor | What | Where |
|---|---|---|
| Google Cloud EMEA Ltd (Ireland), with Google LLC and Google’s subprocessors | E-mail and file storage in a case | The EEA, the USA and other countries Google operates in |
6.2 ON IT informs the Customer at least 14 days before a new sub-processor is used for the Customer’s data. The Customer may object on reasonable grounds within that period. ON IT then does not use the new sub-processor for the Customer, or the Customer may end the assistance and terminate this agreement at no cost.
6.3 ON IT enters into a written agreement with every sub-processor giving the guarantees for protecting the data that GDPR Article 28(4) requires, and is liable to the Customer for them.
6.4 Tools the Customer chooses, operates or asks ON IT to use in the case, for example the Customer’s meeting or remote access solution, are not ON IT’s sub-processors.
7. Transfers outside the EEA
Transfers to Google LLC in the USA are based on the EU–US Data Privacy Framework (an adequacy decision under GDPR Article 45). Transfers to other countries without an adequacy decision are based on the EU Standard Contractual Clauses (Article 46(2)(c)) in Google’s data processing terms. The Customer receives a copy on request. If a basis falls away, ON IT informs the Customer and stops the transfer.
8. Assistance to the Customer
8.1 ON IT helps the Customer, as far as possible, to meet the data subjects’ rights and the Customer’s obligations under GDPR Articles 32 to 36. If a data subject contacts ON IT about data ON IT processes for the Customer, ON IT forwards the request to the Customer without undue delay.
8.2 Notification and assistance after a breach at ON IT or a sub-processor, deletion and confirmation under point 10, forwarding under 8.1 and documentation under 11.1 are not charged for. Other assistance under this agreement is charged at ON IT’s hourly rates.
9. Personal data breaches
9.1 ON IT notifies the Customer without undue delay, and if possible within 48 hours, after ON IT or a sub-processor became aware of a personal data breach concerning data ON IT processes for the Customer. The notice goes to whoever ordered the assistance and to the Customer’s address under point 10 of the license terms, and never only to a partner.
9.2 The notice describes, as far as is known, what happened, which data subjects and data are affected, the likely consequences, what has been or will be done, and who at ON IT can give more information. ON IT sends what is not yet known as it becomes known, and limits the damage as far as possible.
9.3 The Customer notifies Datatilsynet and informs the data subjects. ON IT does not do so without agreeing it with the Customer, unless the law requires it.
10. Deletion and return
A case is closed when ON IT has reported that the assistance has been delivered and the Customer has not reopened it within 14 days. Within 30 days after that, ON IT returns or deletes the data, as the Customer chooses; without an answer, it is deleted. Correspondence in the case without attachments containing the Customer’s data may be kept as case history for up to twelve months. Backups at ON IT and its sub-processors are deleted under their regular routines, within 180 days at the latest, and are not used in the meantime. ON IT confirms the deletion in writing when the Customer asks.
11. Documentation and audits
11.1 ON IT gives the Customer the information needed to show that the agreement is complied with, within a reasonable time of a request.
11.2 Audits are first made by ON IT answering written questions and providing documentation. The Customer may also audit ON IT, itself or through an independent auditor bound by confidentiality who is not a competitor of ON IT, when the documentation is not sufficient, after a breach at ON IT, or when Datatilsynet requires it. Such an audit is announced at least 30 days in advance, or 5 working days after a breach or an order from Datatilsynet, and shall not give access to other customers’ data. The Customer bears its own costs and pays for ON IT’s time at its hourly rates, unless the audit reveals a material breach by ON IT.
11.3 ON IT cooperates with inspections by Datatilsynet.
12. Liability
12.1 The parties’ liability towards the data subjects follows GDPR Article 82. Where one party has paid compensation to a data subject, liability is apportioned between the parties under Article 82(5).
12.2 Between the parties, point 8 of the license terms applies, also to the assistance, with these exceptions: the exclusion of third-party claims in point 8.5 does not apply to claims from data subjects or to apportionment under 12.1, and the liability cap in point 8.6 is calculated from the fees for both the software and the assistance over the last twelve months. The limitations do not apply in case of intent or gross negligence.
13. Term, changes and disputes
13.1 The agreement applies for as long as ON IT processes personal data for the Customer. Confidentiality and the obligations on deletion survive its end.
13.2 ON IT may change the agreement with 30 days’ notice. The version that applied when a case started applies to that case, unless the Customer accepts the new one. Earlier versions are available from ON IT on request.
13.3 The agreement is governed by Norwegian law. Disputes are resolved under point 11 of the license terms.
Contact
Questions about the agreement go to post@on-it.no.