Data processing agreement
Draft agreement under Article 28 GDPR. It covers personal data that the customer enters in Hej CRM.
Parties, purpose and duration
The customer is the controller and Aprex AS, organisation number 937 881 444, is the processor for CRM data. Processing continues while the customer uses Hej CRM and until data is returned or deleted on the customer’s instructions. Aprex may act as an independent controller for accounts, billing and service security.
Processing details
The purpose is to provide customer records, contacts, sales and follow-up, quotes, import, export, backups and support. Data subjects may include the customer’s employees, contact people, suppliers and prospects. Data may include names, work contact details, company, conversations, sales status, agreements, tasks and quotes. The customer must not enter special-category data unless the parties have first agreed on the necessary measures.
Instructions and confidentiality
Aprex processes data only on the customer’s documented instructions, under this agreement and through the customer’s use of the features. People with access are bound by confidentiality and access is limited to a business need. Aprex informs the customer without undue delay if, in Aprex’s view, an instruction conflicts with data protection law.
Security and assistance
Aprex uses access control, authentication, encrypted transmission, tenant isolation, security logging and incident procedures. Aprex provides reasonable assistance with access, correction, deletion, portability, security incidents, impact assessments and authority requests. Aprex notifies the customer of a personal data breach without undue delay after becoming aware of it.
Sub-processors, transfers and audit
The customer gives general prior authorisation for the providers listed on the Sub-processors page. Aprex posts material changes there. Aprex imposes equivalent data protection obligations on sub-processors and remains responsible to the customer for their processing. Transfers outside the EEA require a valid transfer mechanism and any necessary supplementary measures. The customer may request necessary compliance information; audits are arranged with reasonable notice and without unnecessary disruption.
Return and deletion
When the service ends, the customer can export data. Aprex deletes or returns personal data following the customer’s documented choice and action, unless the law requires continued retention. Data is not automatically removed when a subscription is cancelled or an invoice is unpaid. Backup copies are removed under the documented rotation schedule, which must be confirmed before launch.