Databehandleravtale (DPA)
Meets the requirements for data processing agreements in GDPR.
This data processing agreement ("Agreement") is entered into between:
The legal entity that has entered into a subscription agreement with NordicPulse for use of the Service.
NordicPulse, which processes personal data on behalf of the Customer in connection with the delivery of the Service.
This Agreement governs NordicPulse's processing of personal data on behalf of the Customer in connection with the delivery of the NordicPulse platform.
Customer's employees and users of the Service · Customer's customers (if data is uploaded to the Service) · Visitors to websites analyzed via the Service.
Contact information (name, email) · Usage data and analysis results · Integration data from third-party services (GA4, GSC) · IP addresses and device data (anonymized)
NordicPulse commits to: Only process personal data according to Customer's documented instructions · Ensure that persons processing personal data are subject to confidentiality · Implement appropriate technical and organizational security measures · Assist Customer in fulfilling obligations to data subjects · Delete or return all personal data upon termination · Make available all information necessary to demonstrate compliance.
NordicPulse shall assist Customer in fulfilling data subject requests (access, rectification, erasure, restriction, portability, objection) by providing: Technical measures:, Self-service tools in the platform for Customer to export or delete data · Manual assistance:, If Customer cannot fulfill a request via the platform, NordicPulse will assist within 5 business days · Documentation:, NordicPulse will provide documentation about data processing necessary to respond to data subject requests. Customer is responsible for verifying the identity of data subjects and determining appropriate responses to requests.
Customer hereby grants general prior approval for the use of sub-processors. NordicPulse shall inform Customer of planned changes at least 30 days in advance.
Customer has the right to object to new sub-processors on reasonable data protection grounds. If Customer objects: NordicPulse will not use the sub-processor for Customer's data, OR · Customer may terminate the agreement without penalty within 30 days.
Supabase, Database and authentication, EU (Frankfurt) · Vercel, Hosting, EU region · Google Vertex AI, AI services (Gemini 3 Flash), EU (Netherlands) · Stripe, Payment processing, EU (Ireland) · DataForSEO, Keyword and SERP data (live API), EU (SCCs) · Perplexity, AI-powered web research, US (SCCs) · Anthropic (Claude), AI text generation (humanizer), US (SCCs + DTIA) · Serper.dev, SERP data and search results, US (SCCs) · OpenAI / Azure OpenAI, AI services (GPT, embeddings), EU (West Europe) / US (SCCs) · ElevenLabs, Text-to-speech, US (SCCs) · Brevo, Email delivery, EU (France) Complete list of sub-processors is available on our.
Use of these models is in line with the EU's Artificial Intelligence Act (Regulation (EU) 2024/1689). See our. for details on AI-generated content and Article 50 labeling.
Region: EU (Netherlands, europe-west4) · Latest generation with 2M token context · 4-tier redundancy (99.9% uptime) · No special category data processed · Compliant with GDPR Art. 5 (data minimization)
Gemini 2.5 Pro, Premium tasks · Gemini 2.5 Flash, High-volume fallback · Gemini 1.5 Pro, Legacy fallback · Azure OpenAI GPT-5.1, Vision and EU backup. Automatic failover ensures business continuity. All models are EU or SCC-protected.
NordicPulse has implemented the following technical and organizational measures: Encryption, TLS 1.3 for data in transit, AES-256 for data at rest. Access control, Role-based access, MFA for administrators. Backup, Daily backup with 30-day retention. Logging, Comprehensive logging of all data access.
In case of a security breach affecting personal data, NordicPulse will notify Customer without undue delay, and no later than 48 hours after the breach was discovered. The notification shall include: Description of the nature and scope of the breach · Categories and number of affected data subjects · Likely consequences · Measures taken or proposed.
This Agreement applies as long as NordicPulse processes personal data on behalf of Customer. Upon termination of the main agreement, NordicPulse shall: Delete all personal data within 30 days, or · Return all personal data to Customer upon request · Confirm deletion in writing.
Customer has the right to: Request compliance documentation · Conduct audits with 30 days notice (at Customer's expense)
NordicPulse shall: Provide all information necessary to demonstrate compliance · Submit to audits by Customer or third-party auditor · Provide SOC 2 Type II reports when available.
Maximum once per year, except after a security breach.
For questions about this Agreement or to request a signed copy:
Personal data is processed as a result of NordicPulse providing SEO analysis services to Customer pursuant to the Subscription Agreement.
Processing continues for the duration of the Subscription Agreement, plus 30 days after termination to allow for data export or deletion.
Processing includes: Collection and storage of customer data · Analysis and processing via AI models · Generation of reports and insights · Storage of usage data for service improvement.
NordicPulse processes the following personal data on behalf of Customer: Name and email address (user account) · Company name and role · Usage data (features used, timestamps) · Integration data from Google Analytics and Search Console (if enabled) · IP address and device type (anonymized after 30 days)
Customer's employees and users of the Service · Visitors to websites being analyzed (anonymized)
Supabase, EU (Frankfurt), Database, auth, storage, Name, email, usage data · Vercel, EU region, Hosting, CDN, IP (transit) · Azure, EU (West Europe), Backup, Key Vault, Encrypted data · Brevo, EU (France), Email delivery, Email address · Stripe, EU (Ireland), Payment processing, Card number (PCI-DSS) Azure OpenAI, EU Data Boundary, AI embeddings, Keywords, domains · Google Gemini, Global (EU/US), AI text generation, Keywords, content · OpenAI, US, AI text generation, Keywords, content · Anthropic, US, AI text generation, Keywords, content. Serper.dev, US, SERP data, Domains, keywords · Google APIs, Global, Search Console, Analytics, Web data (with consent) ElevenLabs, US, Text-to-speech, Text content · Pexels, Public, Stock images, None.
NordicPulse will notify Customer at least 30 days before new sub-processors are engaged. Notification occurs via: Email to Customer's registered contact person. Update of this list at. Customer may object to new sub-processors within 30 days by contacting.