Vici Eiendom ASData processing agreement
Data Processing Agreement
This is an unofficial English translation provided for convenience. The Norwegian version at vicieiendom.no/databehandleravtale is the legally binding version and prevails in case of any discrepancy.
1. Parties and background
This agreement applies between you as the customer (the "controller") and Vici Eiendom AS, org. no. 936 127 290 (the "processor", "we"). It applies when you use Assistent, Kapital, Builder, Utleiemalen or Arkiva to process personal data about others for your own purposes, cf. clause 10 of the terms.
The agreement forms part of the terms for the products and meets the requirements of the General Data Protection Regulation (GDPR) Article 28(3). It is entered into when you accept the terms.
2. The processing
The subject matter of the processing is the personal data you enter into, or retrieve through, the products. The purpose is to provide the products to you. The nature of the processing, the categories of data subjects and the types of data for each product are set out in Appendix 1. The processing lasts for as long as you use the product, and until the data has been deleted in accordance with clause 11.
3. Instructions
We process the data only on documented instructions from you. This agreement, the terms and the choices you make in the product constitute the complete instructions. This also applies to transfers to countries outside the EEA, cf. clause 7.
We may process the data without instructions only where required by law applicable to us. In that case, we will notify you before the processing, unless the law prohibits this.
If we consider that an instruction infringes data protection legislation, we will inform you immediately.
4. Confidentiality
Everyone who has access to the data on our behalf is subject to a duty of confidentiality, either by agreement or by law. Access is granted only to those who need it in order to provide the products.
5. Security
We implement technical and organisational measures that ensure a level of security appropriate to the risk, cf. GDPR Article 32. The measures are set out in Appendix 2 and are updated when the risk or the technology changes.
6. Sub-processors
You give us general authorisation to use the sub-processors listed in section 7 of the privacy notice. We will notify you at least 30 days before we engage a new sub-processor or replace an existing one. You may object within that period. If we are unable to accommodate the objection, you may terminate the agreement for the relevant product with effect from the change and receive a refund of the unused part of any prepaid period.
We impose on each sub-processor the same data protection obligations as those set out in this agreement. We remain fully liable to you for the sub-processors' performance of their obligations, cf. GDPR Article 28(4).
7. Transfers outside the EEA
The data may be transferred to countries outside the EEA only if there is a valid transfer mechanism under GDPR Chapter V, such as an adequacy decision, including the EU-US Data Privacy Framework, or the European Commission's standard data protection clauses with supplementary measures where necessary. By this agreement, you instruct such transfers to the sub-processors referred to in clause 6.
8. Assistance
We assist you, insofar as possible and taking into account the nature of the processing, in
- responding to requests from data subjects wishing to exercise their rights under GDPR Chapter III, among other things by enabling you to extract, rectify and delete data in the product
- fulfilling your obligations under GDPR Articles 32 to 36, including those relating to security, notification of breaches, data protection impact assessments and prior consultation with Datatilsynet (the Norwegian Data Protection Authority)
If a data subject addresses a request directly to us concerning data for which you are the controller, we will forward it to you without undue delay and will not respond to it ourselves without instructions.
9. Personal data breaches
We will notify you without undue delay, and at the latest 48 hours after becoming aware of a personal data breach concerning data for which you are the controller. The notification shall, insofar as possible, describe the breach, the data and data subjects concerned, the likely consequences and the measures we have taken. Information that we do not have at the time of the initial notification will be provided on an ongoing basis.
10. Documentation and audits
We make available to you all information necessary to demonstrate compliance with the obligations in this agreement. You may conduct audits and inspections yourself or through an independent auditor bound by a duty of confidentiality. Audits shall be notified at least 30 days in advance, shall be carried out so as not to disrupt operations unnecessarily, and may normally be requested once per year, in addition to after a personal data breach. Each party bears its own costs.
11. Term, deletion and return
This agreement applies for as long as we process personal data on your behalf. When the agreement for the product ends, you can extract the data in the product. We will then delete the data, including at the sub-processors, at the latest within 90 days, and from backups when the backups are rotated. We retain only data that we are required by law to store. On request, we will confirm in writing that the deletion has been carried out.
12. Liability and conflict
Liability between the parties follows from GDPR Article 82 and clause 11 of the terms. The limitation of liability in the terms does not apply to our liability for sub-processors under clause 6.
In the event of conflict, this agreement takes precedence over the terms as regards the processing of personal data.
Appendix 1: Description of the processing
| Product | Data subjects | Types of data | Processing |
|---|---|---|---|
| Assistent | Persons you communicate with or have appointments with | Name, contact details, content of emails, calendar events and documents you give access to | Reading, compiling and preparing drafts on your instructions, sending after your approval |
| Kapital | Investors, board members, managers, owners and contact persons | Name, contact details, roles, shareholdings, subscription and interest information, and data in uploaded material | Storage, compilation, publication on pages you approve and sharing with persons you give access to |
| Builder | Persons mentioned on the websites, and visitors who submit forms | Name, images, roles, contact details and submitted messages | Storage, generation of content and publication after your approval |
| Utleiemalen | Persons named in documents you upload, for example sellers and estate agents | Name, address and other data in the sales prospectus, condition report and similar documents | Storage, text extraction and analysis |
| Arkiva | Tenants, suppliers and others appearing in receipts | Name, address, amounts, dates, invoice details and account numbers as they appear on the receipts | Storage, text extraction, categorisation after your confirmation and export |
We ask you not to enter special categories of personal data or national identity numbers unless it is necessary for the task.
Appendix 2: Security measures
- Encrypted transmission (TLS) between users, the products and the providers
- Encryption of stored data at the storage providers
- Role-based access control, so that each user only has access to their own data and data shared with them
- Personal and restricted administrative access with two-factor authentication
- Separate codebases and environments for the products
- Logging of security-relevant events
- Backups and recovery procedures
- Procedures for handling and notifying personal data breaches
Change log
- 1.0, 4 November 2026: First version.