1. Introduction
This Data Processing Agreement governs Envra AS’s processing of personal data on behalf of the customer.
The Data Processing Agreement forms part of the Terms of Service available at /en/terms.
2. Parties and roles
The customer is the controller for personal data processed through the customer’s use of Envra. The customer determines the purposes of the processing, must have a valid legal basis, provide the necessary information to data subjects and ensure that its instructions to Envra are lawful.
Envra AS is the processor and processes personal data only on documented instructions from the customer.
3. Nature and purpose of the processing
Envra processes personal data on behalf of the customer to provide features activated or requested by the customer, including:
- analytics, tracking, attribution, reporting and insights
- administration of websites, users and access rights
- processing, storage and publication of customer content
- AI-based text, image, audio and video features
- processing through integrations activated by the customer
- technical operations, security, abuse prevention, support, error correction and performance improvement
4. Categories of personal data
Depending on the features activated, the processing may include:
- IP addresses and visitor and session identifiers
- browser, device, page-view, event, attribution and geographical data
- contact, user, account and access information
- customer content, including text, documents, images, audio, video, instructions and generated results
- marketing, advertising, publishing and communication data from integrations activated by the customer
- technical logs, security logs, error messages and performance data
- personal data contained in material uploaded, imported, connected or otherwise made available through the Service by the customer
The Service is not intended for the processing of special categories of personal data unless this has been expressly agreed and lawfully configured.
5. Categories of data subjects
The processing may include:
- visitors to and users of the customer’s websites and services
- the customer’s employees, users and representatives
- the customer’s contacts, recipients, leads and end customers
- individuals who submit forms or perform actions that the customer has chosen to record
- individuals who are included or mentioned in content uploaded, imported or processed by the customer
- other individuals whose data the customer makes available through activated integrations or features
6. Instructions
Envra processes personal data only on the customer’s instructions, unless processing is required by law.
The customer’s instructions are set out in:
- this Agreement
- the Terms of Service
- the customer’s configuration of the platform
- any written instructions agreed between the parties
The instructions also cover any transfer of personal data to countries outside the EEA. If processing is required by law, Envra shall inform the customer before the processing, unless the law prohibits such information.
Envra shall inform the customer without undue delay if Envra considers that an instruction infringes the GDPR or other applicable data protection law.
7. Security
Envra uses organisational and technical security measures, including:
- role-based access control
- site isolation
- company isolation
- CSRF protection
- rate limiting
- security logging
- password hashing
- access control
- monitoring and abuse prevention
8. Confidentiality
Persons with access to personal data at Envra shall be subject to confidentiality obligations or an equivalent statutory duty of confidentiality.
9. Subprocessors
Envra may engage subprocessors to operate the Service.
An up-to-date list is available at /en/subprocessors.
Envra is responsible for ensuring that subprocessors are subject to data protection obligations equivalent to those set out in this Agreement.
10. Transfers outside the EEA
Any transfers outside the EEA shall be carried out in accordance with applicable law and with the necessary safeguards.
11. Assistance to the customer
To the extent reasonable and relevant, Envra shall assist the customer with:
- handling data subject access requests
- erasure or rectification
- assessment of personal data breaches
- documentation of technical and organisational measures
- compliance with applicable GDPR obligations
12. Personal data breaches
In the event of a personal data breach affecting the customer’s data, Envra shall notify the customer without undue delay after becoming aware of the breach.
The notification shall contain relevant information to the extent available.
13. Deletion and return
Upon termination of the customer relationship, data may be deleted, anonymised, deactivated or returned in accordance with the applicable agreement, retention policy and statutory requirements.
Envra may maintain a time-limited grace period of 30 days after the subscription ends, during which historical data and settings are temporarily retained to allow possible reactivation of the Service.
Tracking and new data collection may be disabled or restricted during the grace period.
If the subscription is not reactivated before the grace period expires, Envra may anonymise identifiers, analytics associations and associated resources in accordance with the applicable lifecycle policy.
Aggregated and anonymised analytics data may be retained to the extent permitted by applicable law.
Backup data may continue to exist for a limited period before being permanently overwritten.
14. Audits
Envra shall make relevant documentation available to demonstrate compliance with this Agreement.
Any audit or inspection shall be agreed in advance and conducted in a manner that does not compromise security, operations or other customers’ data.
15. Term
This Data Processing Agreement remains in effect for as long as Envra processes personal data on behalf of the customer.