Parties and Scope
This Data Processing Agreement (“DPA”) is between the customer organisation (“Customer”) and Kickflip Grødahl, organisation number 937 657 269 (“Rogue”). It forms part of the Terms of Service and applies whenever Rogue processes personal data on the Customer’s behalf.
Definitions
Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in Regulation (EU) 2016/679 (the “GDPR”), as it applies in Norway through the EEA Agreement and the Personal Data Act. “Customer Data” has the meaning given in the Terms of Service.
Roles
The Customer is the controller and Rogue is the processor of personal data in Customer Data. Rogue is the controller of account data (Users’ names, email addresses, roles and sign-in details) and usage data it processes for its own purposes, as described in the Privacy Policy. This DPA does not cover that data.
Details of Processing
- Subject matter: providing the Rogue Service under the Terms of Service.
- Duration: for as long as the Terms of Service apply, plus the period in Return and Deletion.
- Nature and purpose: collecting exposure data from connected platforms, matching it against threat intelligence, producing threat cards and rationales, and making them available to AI assistants the Customer’s Users connect.
- Data subjects: the Customer’s employees and contractors whose identifiers appear in device data, and Users, whose actions in the Service are recorded in the activity log.
- Categories of data: device identifiers and names, operating system, installed software and vulnerabilities, records of Users’ actions in the Service, and search terms Users send through connected AI assistants.
- Special categories: none.
Rogue’s Obligations
Rogue will:
- process personal data only on the Customer’s documented instructions, including for transfers outside the EU/EEA, unless EU or EEA law requires otherwise; in that case Rogue tells the Customer before processing, unless that law forbids it,
- tell the Customer if it believes an instruction breaks data protection law,
- make sure everyone with access is bound by confidentiality,
- not use Customer Data to train AI models,
- not sell Customer Data or use it for its own purposes.
Security Measures
Rogue keeps appropriate technical and organisational measures in place under Article 32 of the GDPR, including:
- encryption in transit and at rest,
- logical separation of each customer’s data,
- access control based on least privilege, with multi-factor authentication,
- logging and monitoring of access,
- backups and recovery.
More detail is available to customers on request, under confidentiality.
Subprocessors
The Customer gives Rogue general authorisation to use subprocessors. The current subprocessors are listed at rogue.no/legal/subprocessors.
Rogue will notify the Customer’s account admins by email at least 30 days before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the affected part of the Service and receive a refund of prepaid fees for it.
Rogue puts each subprocessor under written data protection terms at least as protective as this DPA and remains responsible for their work.
International Transfers
Rogue processes Customer Data in the EU/EEA. Where a subprocessor processes personal data outside the EU/EEA, Rogue makes sure the transfer is covered by an adequacy decision, the EU–US Data Privacy Framework or the Standard Contractual Clauses, with supplementary measures where needed.
Assistance
Taking into account the nature of the processing and the information available to it, Rogue helps the Customer, as far as it reasonably can, to:
- answer data subject requests,
- meet its security obligations under Article 32 of the GDPR,
- notify personal data breaches to supervisory authorities and data subjects,
- carry out data protection impact assessments and consult supervisory authorities.
Rogue passes any request it receives directly from a data subject to the Customer without answering it.
Personal Data Breaches
Rogue notifies the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice describes what happened, the data and people affected, likely consequences and the steps taken, and Rogue updates it as it learns more.
Audits
Rogue makes available the information needed to show compliance with this DPA. It answers reasonable security questionnaires and shares available third-party audit reports or certifications, under confidentiality.
If that information is not enough to show compliance, or after a personal data breach, the Customer may audit Rogue, or appoint an independent auditor bound by confidentiality, once per year with 30 days’ notice. Audits take place during business hours, do not disrupt the Service and do not give access to other customers’ data. Each party bears its own costs of an audit, unless the audit shows that Rogue has materially breached this DPA, in which case Rogue bears the Customer’s reasonable audit costs.
Return and Deletion
The Customer can ask Rogue to return a copy of its Customer Data at any time before the Terms of Service stop applying and up to 30 days after. Rogue then deletes Customer Data, including copies held by subprocessors, within 60 days, unless law requires it to keep it. If the Customer deletes its organisation in the Service, Rogue deletes Customer Data at once. Backups are overwritten on their normal cycle.
Liability and Precedence
Liability under this DPA follows the limits in the Terms of Service. If this DPA conflicts with the Terms of Service, this DPA takes precedence on data protection matters. Where Standard Contractual Clauses apply, they take precedence over both.