1. The subscription the customer has with Nordic Shipping Options is a platform to assist with freight processes for the customer and as a natural part of this, Nordic Shipping Options processes various personal data on behalf of the customer. This concerns data relating to the customer's customers, i.e., data regarding the persons who are recipients of the consignments.
This policy details the relationship between the Data Controller (the customer) and the Data Processor (Nordic Shipping Options).
2. Processed personal data
2.1. As part of the subscription, the Data Processor has access to, on behalf of the Data Controller, process:
- Name and address of the persons who will receive the shipments.
- Information about the individual type of item sent and the value/price of the item.
3. Purpose of personal data processing and scope
3.1. Customer and order data are not stored by Nordic Shipping Options but are only retrieved to the extent necessary to facilitate the shipping processes at the customer.
3.2. In a context of the Data Processor's status as a supplier of a subscription-based solution for managing the Data Controller's shipping processes, the Data Processor exchanges the information with relevant third parties in the form of the shipping companies the Data Controller uses.
3.3. The purpose of the personal data processing is the handling of the Data Controller's shipping processes.
3.4. The Data Processor may only process the personal data to the extent necessary for the operation of the Data Controller's subscription with the Data Processor.
3.5. The shipping companies to which personal data is passed on as part of this agreement are the Data Controller's (customer's) Data Processors and thus not Nordic Shipping Options' Data Processors. Nordic Shipping Options only acts as an intermediary in this connection.
4. Data Processor obligations
4.1. The Data Processor may only process the personal data in question in accordance with the Data Controller's instructions. That is, the instructions contained in the Nordic Shipping Options solution, stating that the Data Processor must manage freight processes for the Data Controller.
4.2. The Data Processor is obliged to comply with the personal data legislation in force at all times and must immediately notify the Data Controller if an instruction from the Data Controller, in the Data Processor's opinion, is contrary to the Personal Data Regulation or Danish personal data law in general.
4.3. The Data Processor must use appropriate technical and organizational security measures to ensure that the personal data is not destroyed, lost, degraded or comes to the knowledge of unauthorized persons, misused or otherwise processed in violation of personal data legislation, including that the Data Processor must implement the measures that are necessary according to the personal data regulation Article 32.
4.4. The Data Processor is required to notify the Data Controller of a breach of data security without undue delay. In this connection, the Data Processor must inform the Data Controller of:
- The nature of the security breach.
- If possible, the type and number of affected data subjects as well as the type of affected personal data and the number of affected registrations of personal data information.
- The measures that the Data Processor has taken or proposes to take to deal with the breach of personal data security, including, if relevant, measures to limit its possible harmful effects.
- The consequences of the breach of personal data security.
4.5. The Data Processor must, at the Data Controller's request, provide the Data Controller with sufficient information so that the latter can ensure that the Data Processor has taken the necessary technical and organizational security measures.
4.6. The Data Processor must provide all the information necessary to demonstrate that the Data Processor complies with Article 28 of the Personal Data Regulation, including that the Data Processor must provide the opportunity for and contribute to audits, including inspections, conducted by the Data Controller or other auditor authorized by the Data Controller. Every aspect of an inspection/audits are at the expense of the Data Controller.
4.7. The Data Processor must ensure that the persons authorized by the Data Processor to process personal data have committed to confidentiality or are subject to an appropriate statutory duty of confidentiality.
4.8. If a registered data subject requests the Data Processor (normally such requests will be made to the Data Controller) for access to and insight into the data subject's personal data, the Data Processor must immediately forward the request to the Data Controller.
5. Transfer of information to sub-processors or third parties
5.1. The Data Processor is, as a natural part of the Nordic Shipping Options solution, entitled to pass on the personal data to the Data Controller's other Data Processors, in the form of freight companies.
5.2. In addition, the Data Processor may only pass on or entrust personal data to third parties or sub-Data Processors after prior agreement with the Data Controller. The Data Processor may, however, pass on or leave personal data without the Data Controller's instructions, according to the legislation.
5.3. If the Data Processor entrusts personal data to another Data Processor (sub-processor), the Data Processor is obliged to enter into a sub-Data Processor agreement with the sub-Data Processor, in which the sub-Data Processor is bound to the Data Processor on at least the same terms as stated in this policy.
5.4. The Data Processor must notify the Data Controller if the Data Processor has plans to expand the circle of sub-Data Processors and/or replace existing sub-Data Processors with others.
5.5. The Data Processor may not transfer personal data to 3rd party countries that the EU Commission has not assessed as safe 3rd party countries.
5.6. If the information is transferred to foreign sub-processors, this must be stated in the Data Processor agreement, cf. 9.5.3 that the sub-processor must comply with the EU's personal data regulation and the personal data legislation in force at all times. Sub-processors established in EU countries with special legislative requirements regarding Data Processors must also comply with these requirements.
6. Duration of data processing
6.1. The processing of personal data according to this agreement continues until the Nordic Shipping Options subscription entered into between the parties ends.
6.2. Since Nordic Shipping Options stores neither personal nor order data for the customer, this agreement will end upon termination of the subscription and Nordic Shipping Options will no longer have access to the customer's data.