Data processing agreement

Conclusion of a data processing agreement with Onlime according to the General Data Protection Regulation (GDPR)

We offer a Data Processing Agreement (open here) to companies or organisations that process personal data and use a Onlime business account. See the General Data Protection Regulation Article 4 you are understood to be the data controller and we are understood to be the data processor, as we only process data as instructed by you by virtue of you or business account users using the service to store files.

We offer one general data processing agreement as our processing is the same for all users of our service. The data processing agreement is an appendix to our terms of use and forms an integral part of it.

The Data Processing Agreement is entered into by a person (DPO if appointed - read more here) on behalf of an organisation or company.

  1. Sign the data processing agreement
  2. Send it to privacy@onlime.app
  3. We review the agreement and give it final approval

If you have any questions, you are welcome to Contact us.

Questions & answers about data processing agreement

What is GDPR?
According to the EU General Data Protection Regulation, as of 25 May 2018, companies must comply with various requirements when processing personal data. May 2018, companies must comply with various requirements when processing personal data. Among other things, you must relate to:

  • What data is processed.
  • Where data is processed - physically and by which parties.
  • Who has access to this data.
  • How this data is protected

In addition, the regulation ensures that ordinary internet users have better rights, including the right to

  • Gain insight into the rest data a company/organisation has about a
  • How these are used.
  • Get data deleted or handed over.
  • Get control over what data you disclose.

Read more here:  https://www.datatilsynet.dk/hvad-siger-reglerne/vejledning

When should you use a data processing agreement?
A data processing agreement must be signed between organisations or companies and any third parties or sub-processors used to process personal data.

For example, if you own a website with a contact form, data processing takes place when the data subject (e.g. a customer) enters their contact details. This requires a data processing agreement with the website hosting provider as personal data is processed and stored on their servers.

What is personal data
Personal data refers to any information about an identified or identifiable person. This can be common contact information such as name, email, address, position, CV, account number, etc.

Particularly sensitive personal data is information about a person's health and sexual, political and religious orientation.

About digital security at Onlime

Read more below about how we continuously protect personal data in accordance with the requirements and obligations set out in our privacy policy and data processing agreement.

Onlime follows the principles for processing personal data in GDPR and the Personal Data Act and has implemented a data protection strategy to ensure compliance with GDPR.

All processing of personal data is continuously assessed and audited against these security principles to minimise the risk to data subjects' rights.

Security breaches affecting data subjects' personal data will be notified via email or Onlime's direct messaging system.

Do you have questions for our DPO? Write to privacy@onlime.app

Incident Response Plan

  • We have implemented a formal security incident procedure and have trained all our employees on our policies.
  • When security incidents are detected, they are escalated to our emergency alias, teams are searched, notified and assembled to quickly handle the incident.
  • After a security incident is fixed, we write a post mortem analysis.
  • The analysis is reviewed in person, distributed across the organisation and includes action points that will make the detection and prevention of a similar event easier in the future.

Best practices

  • We develop Onlime with a focus on minimising personally identifiable data collection
  • We develop features that utilise machine learning on physical devices rather than on our servers whenever possible.
  • We do not use personally identifiable user data to develop features of the service or for purposes other than those to which the user gives explicit consent.

Build Process Automation

  • We have a working, frequently used automation in place so we can safely and reliably implement changes to both our application and operating platform within minutes.
  • We typically deploy code several times a day, so we have a lot of confidence that we can get a security patch out quickly when needed.

Infrastructure

  • All our services run in our own data centre. We use our own routers, load balancers and physical servers.
  • We use both our own internal DNS servers and external DNS servers.
  • Our data centres are located in Norway at Green Mountain SVG1 - Rennesøy, which is certified with i.a. ISO/IEC 27001:2013 - Information Security Management System. Onlime services are built with disaster recovery in mind.
  • All our servers are within our own private network with network access control lists (ACLs) that prevent unauthorised requests from getting to our internal network.

Service levels

  • Our uptime is 99.9 % or higher.
  • All files transferred to the service are stored in Norway.
  • We do not have individual data storage for each customer. However, strict privacy controls exist in our application code to ensure data protection and prevent one customer from accessing another customer's data.
  • All data is encrypted at rest on the server

Data transfer

  • All data sent to or from Onlime is encrypted in transit using 256 bit encryption.
  • Our API and application endpoints are TLS/SSL only and receive an "A+" rating on SSL Labs tests. This means we only use strong encryption packages and have features like HSTS and Perfect Forward Secrecy fully enabled.

Approval

  • The Onlime service is delivered 100 % over https.
  • We have two-factor authentication (2FA) and strong password policies to ensure access to cloud services is protected.

Authorisations and access management

  • Onlime makes it possible to set permission levels for all customer end users with access to Onlime management tools.
  • We restrict access to personal data to only those employees who have a business need and who have signed confidentiality agreements.

Application monitoring

  • At application level, we produce audit logs for all activity
  • All access to Onlime applications is logged and audited

Compliance

  • We enter into written sub-processor agreements with all our sub-processors.
  • We ensure that any transfers of personal data to third countries are done in accordance with applicable personal data protection rules, either by using standard contractual clauses or by choosing recipients certified under the EU-US Data Privacy Framework.
  • We continuously train our employees on applicable data protection regulations and our internal policies and procedures.
  • We conduct regular audits of our systems and processes to ensure their effectiveness and compliance.

PCI obligations

Onlime is not subject to PCI obligations. All processing of payment instruments is handled by our external payment acquirer.