Data processing agreement

1. The parties

The controller is the customer that has entered into an agreement for hosted relaii (“you”). The processor is Oclin Home AS, org. no. 916 749 724, Sjukehusvegen 6A, 6103 Volda, Norway (“we”).

2. The processing

Purpose

Running the customer’s relaii Space: storing and delivering content, taking backups, monitoring, fixing faults and providing support.

Nature

Storage, transfer, backup, restore, troubleshooting and deletion.

Data subjects

Users and guests in the Space, people on servers you share channels with, and people mentioned in the content.

Personal data

Account details (name, username, email address, profile picture, role, password hash, two-factor setup), content (messages, files, reactions, searches), technical data (IP addresses, sessions, devices, push registrations, timestamps) and the audit log. Audio and video in meetings pass between the participants and are not stored.

Duration

For as long as the agreement for hosted relaii runs, and then until the data is deleted under section 9.

The service is not specifically designed for special categories of personal data, such as health data. Whether such data should be shared in the Space is your assessment.

3. Instructions

We process the data only on documented instructions from you. The agreement for hosted relaii, this agreement and the settings you choose in the Space are such instructions. Other instructions are given in writing. If we believe an instruction breaks data protection law, we tell you straight away. We do not use the data for our own purposes.

We only go into the Space when operations, security or troubleshooting require it, or when you ask us to. We read no more content than the task requires.

4. Confidentiality

Only people at Oclin who need access to deliver the service get it. They are bound by confidentiality, also after they leave.

5. Security

We have measures that ensure a level of security appropriate to the risk, as required by GDPR Article 32:

• A virtual server of its own for each customer. The database and files are not shared with other customers.
• All traffic to the Space goes over TLS.
• Message text is encrypted in the database with AES-256-GCM. The key is on the server, and the search index is not encrypted.
• Passwords are stored only as Argon2 hashes. Users can turn on two-factor authentication (TOTP), and sign-in is rate-limited against guessing.
• Administrative access to the servers is only over SSH with personal keys, for named people at Oclin.
• An encrypted and signed backup every night, stored off the server in the EU and kept for 30 days.
• Security updates to relaii and the operating system are installed as soon as it is safe to do so.
• Uploaded files are scanned for viruses.
• Administrative actions in the Space are written to an audit log that you can read.

6. Subprocessors

You give general authorisation for us to use subprocessors. These are used today:

Hetzner Online GmbH, Germany

Servers and storage. The Space is in Helsinki, Finland. The backups are in another data centre in the EU.

Apple Inc. and Google LLC

Only if push notifications are on: they deliver notifications to devices. They receive a device address and, if previews are on, a preview that is encrypted before it leaves the Space. This may involve a transfer to the United States.

Our notification service at notifications.relaii.app is run by us and is not a subprocessor. The provider you choose for email from the Space is under your own agreement with them.

We notify you in writing at least 30 days before we add or replace a subprocessor. If you have reasonable grounds to object and we cannot find a solution, you can cancel the agreement before the change takes effect. Subprocessors are bound by the same obligations as we are, and we are responsible for them.

7. Transfers outside the EEA

The data in the Space and the backups are stored in the EU. Data is transferred outside the EEA only as described in section 6, and only on a valid transfer basis, such as the EU adequacy decision for the EU–US Data Privacy Framework or the EU standard contractual clauses.

8. Assistance and notification

We help you respond to requests from data subjects, such as access and erasure. Much of this you can do yourself in the Space’s administration. We also help with security, data protection impact assessments and prior consultation with the supervisory authority, as set out in GDPR Articles 32 to 36.

If we discover a personal data breach, we notify you without undue delay and no later than 48 hours after we became aware of it. The notice describes, as far as we know, what happened, which data and people are affected, the likely consequences and what we are doing. This gives you time to notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours.

9. When the agreement ends

If you ask before the end date, we give you a full backup of the Space. We then delete the server within 30 days. Backups are deleted as they become older than 30 days, so everything is gone no later than 60 days after the end date. You receive written confirmation when the deletion is complete.

10. Documentation and audits

We give you the information needed to show that this agreement is followed. With at least 30 days’ notice, and at most once a year unless there has been a breach, you can carry out an audit or have an independent auditor do so. An audit must not give access to other customers’ data. Each party covers its own costs.

11. Other provisions

This agreement applies for as long as we process personal data for you. Liability is governed by the agreement for hosted relaii and GDPR Article 82. Norwegian law applies. Questions about data protection go to privacy@oclin.no.