Data Processing Agreement

1.1 Parties

1.2 Scope

This DPA governs the processing of personal data by XFocus AS when providing educational platform services to Controllers, in accordance with GDPR Article 28.

2.1 Categories of Data

XFocus processes the following categories of personal data on behalf of Controllers:

• Student names and identifiers
• Email addresses
• Class and project information
• Educational content and submissions
• Learning activity data
• Communication within the platform
• Assessment and progress data

2.2 Purpose of Processing

Processing is performed solely to provide educational platform services including project-based learning management, student collaboration tools, and educational content delivery as instructed by the Controller.

2.3 Duration

Processing continues for the duration of the service agreement. Upon termination, data will be returned or anonymized according to Section 8 of this DPA.

4.1 Authorization

The Controller provides general authorization for XFocus AS to engage the sub-processors listed below. XFocus AS will notify Controllers of any intended changes concerning sub-processors, giving the Controller opportunity to object.

4.2 Current Sub-Processors

Note: This list is maintained and updated at xfocus.no/legal/dpa

4.3 Sub-Processor Requirements

XFocus AS ensures all sub-processors are bound by data protection obligations no less protective than those in this DPA and remain fully liable for sub-processor performance.

5.1 Technical Measures

• Encryption of data in transit (TLS 1.2+) and at rest
• Regular security updates and patch management
• Access controls and authentication mechanisms
• Network security and firewall protection
• Regular automated backups
• Monitoring and logging of access

5.2 Organizational Measures

• Confidentiality agreements with all personnel
• Regular security training for staff
• Access on a need-to-know basis
• Incident response procedures
• Regular security assessments
• Data protection by design and default

6.1 Notification Timeline

XFocus AS will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Controller's data.

6.2 Information Provided

Breach notifications will include:

• Nature of the breach and categories of data affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact point for more information

7.1 Assistance

XFocus AS will assist the Controller in fulfilling obligations to respond to data subject requests for:

• Access to personal data
• Rectification or erasure
• Restriction of processing
• Data portability
• Objection to processing
• Right to anonymization instead of deletion where applicable

7.2 Response Timeline

XFocus AS will respond to Controller requests for assistance within 10 business days or as required to meet regulatory deadlines.

8.1 Upon Termination

Upon termination of services, XFocus AS will, at the Controller's choice:

• Return all personal data to the Controller in a standard format
• Anonymize all personal data, rendering it non-identifiable and non-attributable
• Both return and then anonymize the data

Anonymized data may be retained for statistical analysis and service improvement purposes.

8.2 Anonymization Process

Anonymization will be performed using industry-standard techniques to ensure data cannot be re-identified. This includes removing direct identifiers, generalizing quasi-identifiers, and applying appropriate statistical disclosure controls.

8.3 Retention Exceptions

Complete anonymization does not apply to data XFocus AS is required to retain under EU or Norwegian law. Such data will be protected and processing limited to legal requirements only.

9.1 Audit Rights

The Controller has the right to conduct audits to verify XFocus AS's compliance with this DPA, subject to:

• Reasonable advance notice (minimum 30 days)
• During regular business hours
• No more than once per year unless required by regulators
• Conducted by independent third-party auditors bound by confidentiality

9.2 Compliance Documentation

XFocus AS maintains records of processing activities and will provide relevant compliance documentation upon reasonable request.

10.1 Limitation of Liability

Liability under this DPA is subject to the limitations set forth in the main service agreement, except where prohibited by applicable law.

10.2 Indemnification

Each party will defend and indemnify the other against claims arising from that party's breach of this DPA or applicable data protection laws.