Data Processing Terms


These Data Processing Terms (hereinafter the “Terms”) govern the rights and obligations between the Company (hereinafter the “Company”) and HHR ehf., a company incorporated under the laws of Iceland with its registered seat at Dalsel 25, IS-109, Iceland, Reg. No 5302201760. The Company and HHR may jointly be referred to as the “Parties” or individually as a “Party”.


Unless otherwise provided in the Terms, the meaning of capitalized words is stated in Annex A to the Terms.


The Terms govern the processing and security of Company Personal Data.


The Parties acknowledge and agree that:


HHR is a processor of Company Personal Data;


the Company is a controller or processor, as applicable, of Company Personal Data;


each Party will comply with the obligations applicable to it under the applicable law with respect to the processing of Company Personal Data.

If the Company is a processor, the Company warrants to HHR that Company’s instructions and actions with respect to Company Personal Data, including its appointment of HHR as another processor, have been authorized by the relevant controller.

By entering into the Terms, the Company instructs HHR to process Company Personal Data only in accordance with applicable law: (a) to provide the Processor Services; (b) as further specified via Company’s use of the Processor Services; (c) as documented in the Agreement, including the Terms; and (d) as further documented in any other written instructions given by the Company and acknowledged by HHR as constituting instructions for purposes of the Terms.


Processing of Company Personal Data shall be performed for the duration of the Agreement plus the period until the deletion of all Company Personal Data in accordance with the Terms.


HHR shall process Company Personal Data through means of automated processing to provide the Company with the Processor Services.


The Company Personal Data may include data collected by the HHR System during the use of HHR System, login data, identification data, user type data, user activity data, contact data, communication data and voice and image records.


Company Personal Data will concern the following categories of data subjects:

Depending on the nature of the Processor Services, these data subjects may include (a) Company’s employees or other Company’s co-workers, (b) members of Company’s bodies; (c) Company’s clients.


If any third person, particularly a data subject or supervisory authority, requests any Party to provide any information in relation to personal data processing under the Agreement or the Terms, or in this relation makes any claim or exercises any right against any Party, the Party undertakes to inform the other Party about such procedure without undue delay.

The Company is liable for fulfilling all obligations in relation to Company Personal Data processing, particularly for informing data subjects about Company Personal Data processing, obtaining consent with Company Personal Data processing if necessary, dealing with data subjects’ requests relating to the exercise of their rights (such as right to information, access, rectification, erasure, restriction of processing, right to data portability, right to object etc.). The Company is further liable for fulfilling all notification obligations towards any supervisory authority relating to Company Personal Data processing, especially for notifying the supervisory authority on any personal data breach.

The Company is solely responsible for reviewing the Terms and evaluating for itself whether the security measures, and HHR’s commitments hereunder meet Company’s needs, including with respect to any security obligations of the Company under the applicable law

The Company acknowledges and agrees that (considering the state of the art, the costs of implementation and the nature, scope, context, purposes and differently probable and differently serious risks to individuals) the security measures implemented and maintained by HHR as set out in the Terms provide a level of security appropriate to the risk in respect of the Company Personal Data.

For the duration of Company Personal Data processing, if HHR receives any request from a data subject in relation to Company Personal Data, HHR shall advise the data subject to submit its request to the Company and the Company will be responsible for responding to any such request.

For the purpose of the Company Personal Data protection HHR undertakes, for the duration of processing Company Personal Data under the Terms, that it:


The Terms have been drawn up in English, Danish, Norwegian, German and Spanish. All obligations of HHR towards the Company related to the Terms shall be fulfilled in the English, Danish, Norwegian, German or Spanish language, at HHR’s sole discretion.

Should any of the provisions hereof be or become invalid, void, ineffective or unenforceable, this fact shall not affect the rest of the Terms. The Parties agree to replace any such invalid, ineffective, void or unenforceable provisions of the Terms with a provision that is valid, effective, not considered void, enforceable and with the same business and legal meaning within 14 (fourteen) days of receiving a request from the other Party.

In the event of changes to the applicable law or changes to the interpretation rules or practices for interpretation of the applicable law, HHR may amend the Terms within a reasonable scope. The amendment of the Terms shall be reported by HHR on its website and by e-mail to the last known e-mail address of the Company used for the communication with HHR. Unless rejected by the Company within 1 (one) month since sending the notification to the Company, the Company is deemed to have adopted the amended Terms. Should the Company reject the amended Terms within the aforementioned period, this fact shall constitute the termination of the Terms with a 2 (two) months termination period; during this period the last Terms accepted by both Parties shall apply. Termination of the Terms under this clause does not constitute termination of the Agreement; however, following the termination of the Terms if the Parties do not reach an agreement on new data processing terms as required by applicable law within a 2 (two) months period, any Party has the right to immediately terminate the Agreement by sending a written termination notice to the other Party effective as of the day of its delivery.




an agreement concluded between the Parties which incorporates the Terms by referring to them, particularly the agreement on using the HHRystem, concluded when the Company accepted the “Company Terms and Conditions for HHR system”.


is the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Processor Services

are the services provided by HHR to the Company under the Agreement and any related technical support which includes personal data processing.


is the commercial company that has concluded the Agreement with HHR.

Company Personal Data

is the personal data that is processed by HHR on behalf of the Company while providing the Processor Services to the Company.

The terms „controller“, „data subject“, „personal data“, „personal data breach“, „processing“, „processor“ and „supervisory authority

have the meaning given to them in GDPR.



As from the Terms effective date, HHR will implement and maintain the security measures set out in this Annex B. HHR may update or modify such security measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the processing.

Risk-based principle. HHR shall periodically review the risk of information security, in connection with personal data and important activities of the Company. Fulfilment of the HHR’ obligation to ensure the data security is performed by the position of security manager, who acts within the HHR’ management.

Organizational security. HHR shall implement measures to secure the personal data against the human failure, in particular:

Technical measures. HHR shall implement appropriate technical measures to secure the personal data, particularly:

On-site security. To secure the personal data stored in written form and the IT devices, HHR shall particularly implement:




The Company must send any requests for the audit solely to the HHR’s email address


Following receipt by HHR of a request for audit, HHR and the Company will discuss and agree in advance on: (i) the reasonable date(s) of and security and confidentiality controls applicable to any audit; and (ii) the reasonable commencing date, scope and duration of and security and confidentiality controls applicable to any audit.


HHR may charge a fee (based on its reasonable costs) for any audit requested by the Company. HHR shall provide the Company with further details of any applicable fee or the basis of its calculation, in advance of any such audit. The Company will be responsible for any fees charged by any auditor appointed by the Company to execute any such audit.


HHR may object in writing to an auditor appointed by the Company to conduct any audit, if the auditor is, in HHR ’s reasonable opinion, not suitably qualified or independent, a competitor of HHR, or otherwise manifestly unsuitable. Any such objection by HHR will require the Company to appoint another auditor or to conduct the audit itself.