Data Processing Agreement
Our standard agreement for processing personal data under GDPR Article 28.
This Data Processing Agreement ("DPA") is entered into between the customer identified in the customer agreement ("Customer"), as controller, and Jenz AS, org. no. 938 033 110 ("Jenz"), as processor (together, the "Parties"). It is signed together with, or incorporated by reference into, the customer agreement.
1. Background and Purpose
The Parties have entered into an agreement for the delivery of the Jenz AI agent service (the "Main Agreement"). To deliver the service, Jenz processes personal data on behalf of the Customer. This DPA governs that processing and meets the requirements of Article 28 of the General Data Protection Regulation (GDPR), as it applies in Norway through the Personal Data Act (personopplysningsloven).
Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in GDPR Article 4. A "sub-processor" is a third party engaged by Jenz to process personal data on behalf of the Customer.
2. Nature and Scope of the Processing
The personal data processed, the data subjects, the purpose and the duration are described in Annex A. Jenz does not process personal data on behalf of the Customer beyond what is necessary to deliver the service under the Main Agreement.
The Customer is responsible for having a legal basis for the personal data it provides to the service or gives the agent access to, and for informing data subjects. The Customer shall not provide special categories of personal data (GDPR Article 9) or data relating to criminal convictions (Article 10) without the Parties first agreeing to it in writing.
3. Instructions
Jenz processes personal data only on documented instructions from the Customer. The Main Agreement, this DPA and the Customer’s use of the service, including the tasks the Customer gives the agent and the systems the Customer chooses to connect, constitute the Customer’s instructions. The Customer may give further instructions in writing.
If Jenz considers that an instruction infringes data protection law, Jenz shall inform the Customer immediately. If Jenz is required by law to process personal data beyond the instructions, Jenz shall inform the Customer before the processing begins, unless the law prohibits it.
Jenz does not use the Customer’s personal data for its own purposes, including training AI models, profiling, marketing or improving services for other customers. Jenz may record operational data about the service, such as usage, response times and errors, to the extent necessary for operation, billing and troubleshooting. Such operational data does not contain the content of the Customer’s messages or files.
4. Confidentiality and Access
Only Jenz personnel who need it to operate, troubleshoot and support the service have access to the personal data. They are bound by confidentiality through their employment contract or a separate confidentiality undertaking. The duty of confidentiality continues after this DPA ends.
Where the service is delivered in a Slack workspace that Jenz creates and operates for the Customer, Jenz personnel have access to that workspace for operation and support. The Customer may ask for a workspace in which Jenz personnel are not members, and Jenz will set one up.
5. Security
Jenz shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with GDPR Article 32. The measures are described in Annex B. Jenz may change the measures, provided the level of security is not reduced.
6. Sub-processors
The Customer gives general prior authorisation for Jenz to engage the sub-processors listed in Annex C.
Jenz shall give notice at least 14 days before engaging a new sub-processor or replacing an existing one, by updating the sub-processors page and emailing everyone subscribed to sub-processor updates on that page. Jenz subscribes the Customer’s contact person when this DPA is signed. The Customer is responsible for keeping at least one subscribed address, and a notice sent to the subscribed addresses counts as notice to the Customer. The Customer may object in writing within 10 days of the notice on reasonable data protection grounds. If the Parties cannot resolve the objection, the Customer may terminate the Main Agreement with effect from the date the change takes effect, without notice period or minimum term, and is refunded any prepaid fees for the period after termination.
Jenz shall impose on each sub-processor written obligations providing at least the same level of protection as this DPA, including security requirements. Jenz remains liable to the Customer for its sub-processors’ performance of their obligations.
If the Customer connects the agent to its own systems, such as its online store, email or accounting system, data in that system is processed by the Customer’s own provider under the Customer’s agreement with it. That provider is not a sub-processor of Jenz.
7. Transfers Outside the EU/EEA
Some sub-processors are established in, or may process data in, the United States or other countries outside the EU/EEA. Such transfers take place only on a valid transfer mechanism under GDPR Chapter V: an adequacy decision by the European Commission, including the EU-US Data Privacy Framework for certified recipients, or the European Commission’s Standard Contractual Clauses (2021/914), with supplementary measures where necessary. Annex C states the location of each sub-processor.
If a transfer mechanism ceases to be valid, Jenz shall inform the Customer without undue delay, and the Parties shall cooperate to put a new valid mechanism in place or stop the transfer.
8. Assistance to the Customer
Taking into account the nature of the processing and the information available to it, Jenz shall assist the Customer with:
- responding to requests from data subjects exercising their rights under GDPR Articles 15 to 22, including access, rectification, erasure and data portability. If Jenz receives such a request directly, it forwards it to the Customer without undue delay and does not respond to the data subject without the Customer’s consent;
- meeting the requirements on security, breach notification and data protection impact assessments under GDPR Articles 32 to 36.
Assistance requiring significant resources beyond what is normal for the service may be invoiced as agreed in advance.
9. Personal Data Breaches
Jenz shall notify the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the Customer’s personal data. The notification shall, as far as known, describe what happened, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information not known at the first notification is provided as it becomes available.
Jenz shall assist the Customer so that the Customer can notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours and, where required, inform data subjects, in accordance with GDPR Articles 33 and 34.
10. Information and Audits
Jenz shall make available all information necessary to demonstrate compliance with this DPA and GDPR Article 28. The Customer may send written questions to contact@jenz.ai, and Jenz will respond within 30 days.
If written answers are insufficient, the Customer may, itself or through an independent auditor bound by confidentiality, carry out an audit of Jenz. An audit shall be notified in writing at least 30 days in advance, carried out during normal business hours without undue disruption, and paid for by the Customer unless it reveals a material breach of this DPA. An audit does not extend to other customers’ data. This section does not limit the rights of supervisory authorities.
11. Term, Termination and Deletion
This DPA applies for as long as Jenz processes personal data on behalf of the Customer, and ends without separate notice when the Main Agreement ends and deletion under this section is complete.
On termination, Jenz shall, if the Customer requests it in writing within 30 days, return the Customer’s personal data in a common machine-readable format. Jenz shall then, and no later than 60 days after termination, delete the Customer’s personal data from its own systems and those of its sub-processors, unless the law requires storage. Backups are deleted in line with normal rotation and are not used for operations in the meantime. Jenz confirms deletion in writing on request.
12. Liability
Liability and limitation of liability between the Parties follow the Main Agreement. The limitation of liability does not apply to liability towards data subjects under GDPR Article 82, or to loss caused by wilful misconduct or gross negligence.
13. Precedence, Governing Law and Venue
In case of conflict between this DPA and the Main Agreement, the Terms of Service or the Privacy Policy, this DPA prevails in matters concerning the processing of personal data.
This DPA is governed by Norwegian law. Disputes shall be resolved amicably where possible. The agreed venue is Oslo District Court (Oslo tingrett).
Annex A. Description of the Processing
| Item | Description |
|---|---|
| Purpose | Delivering the AI agent service under the Main Agreement: receiving and answering messages from the Customer’s users, performing the tasks the Customer gives the agent, running scheduled tasks, creating reports, files and small web applications, and retrieving data from systems the Customer connects. |
| Processing activities | Collection, storage, structuring, combination, analysis, text and code generation, transfer to sub-processors under Annex C, disclosure to the Customer, and erasure. |
| Data subjects | (1) The Customer’s employees and other users in the Slack workspace or Microsoft Teams tenant where Jenz is used. (2) People mentioned in what the Customer provides to the service, such as the Customer’s own customers, suppliers and contacts. (3) People in systems the Customer connects, typically end customers of the online store. (4) People mentioned in public sources the agent retrieves on the Customer’s instruction. |
| Personal data | Names, usernames and user IDs in Slack or Microsoft Teams, email addresses, message content, files and images the Customer uploads, and personal data held in connected systems, such as names, contact details, delivery addresses and order history. Jenz does not store payment card data. |
| Special categories | Not intended, see Section 2. |
| Duration | For as long as the Main Agreement runs, followed by deletion under Section 11. |
| Storage during the agreement | Conversation history, tasks, files and the agent’s working memory are kept while the Customer uses the service, so the agent can follow up on earlier work. The Customer may ask for individual items to be deleted at any time. Data retrieved from connected systems is not stored beyond what the task requires, unless the Customer asks the agent to keep the result. |
| Contact | Jenz: contact@jenz.ai. Customer: as stated in the customer agreement. |
Jenz as independent controller. For data Jenz processes for its own purposes, such as contact details of the Customer’s contact persons, contract and invoicing records and accounting, Jenz is itself the controller under its Privacy Policy. This DPA does not apply to that processing.
Privacy Policy: Read the Jenz Privacy Policy
Annex B. Security Measures
- Encryption: all traffic to and from the service, and between the service and its sub-processors, is encrypted (TLS 1.2 or later). Slack access tokens are encrypted in the application with AES-256 before storage.
- Customer separation: each customer’s data is tied to the customer’s workspace, and every request is scoped to it. Code and files the agent works with run in an isolated environment with a separate storage area per customer.
- Access control: access to production systems is limited to Jenz personnel with a business need, using personal accounts and two-factor authentication. Keys and secrets are kept in a password vault and environment variables, never in source code.
- Connected systems: the Customer chooses which systems the agent is connected to and can revoke access at any time. Credentials for the Customer’s systems are held by the integration provider in Annex C and are not given to the AI model.
- No training: requests to AI models are sent with the requirement that the content is not stored or used for training by the model provider.
- Usage and abuse limits: the service limits spend per run and per workspace, and the number of requests, so that an error or misuse cannot grow without bound.
- Logging and monitoring: errors and events are logged and monitored. Secrets are removed from logs before storage.
- Change control: changes to the service are reviewed and tested before release, and production releases require approval by the technical lead.
- Deletion: when the service is uninstalled or the agreement ends, the Customer’s data is deleted under Section 11. The Customer may ask for individual items to be deleted during the agreement.
- Incident handling: Jenz has a routine for detecting, handling and notifying personal data breaches, see Section 9.
- Confidentiality: all personnel with access are bound by confidentiality, see Section 4.
Annex C. Sub-processors
The sub-processors Jenz uses, what each one does and where it processes data are listed on our sub-processors page, which forms Annex C to this DPA. Changes are notified under Section 6.