Data Processing Agreement (template)
Last updated: November 2, 2026
This Data Processing Agreement ("the agreement") governs LingoStudio Dabrowski's (enkeltpersonforetak) processing of personal data on behalf of the client ("the data controller"), in connection with translation, Norwegian courses and related services ordered via mylingostudio.com/en/for-businesses. The agreement applies automatically when the client sends us material containing personal data, and can also be filled in and signed as a separate document, as shown in the template below.
01 Purpose and scope
The agreement governs the processor's (LingoStudio's) processing of personal data on behalf of the data controller (the client), in accordance with GDPR Article 28. Processing takes place only to deliver the services the data controller has ordered (translation, quality check, Norwegian/HSE Norwegian courses, translation of information notices), as described in the Terms of Sale for Businesses.
02 What data, and who it concerns
Processing may include personal data in documents to be translated or quality-checked (for example names, contact details, and in some cases sensitive data such as health information in HSE documents), as well as the names and contact details of employees taking part in courses. The data subjects are normally the data controller's employees, students, residents or parents/guardians, depending on the job.
The client must inform us in advance if the material contains special categories of personal data, such as health information, and is responsible for there being a lawful basis for processing.
03 Instructions
The processor processes personal data only on documented instructions from the data controller, as set out in the order and this agreement. The processor will inform the data controller if, in the processor's view, an instruction conflicts with the GDPR or other data protection legislation.
04 Confidentiality
The processor ensures that everyone with access to the personal data (including the processor itself and any sub-processors) is bound by a duty of confidentiality.
05 Security
The processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: two-factor authentication on services used for storage and email, restricted access to documents (only the person carrying out the job), and deletion in accordance with point 09.
06 Sub-processors
The processor may use the following sub-processors for storing and handling documents and communication:
- Dropbox – secure document storage
- Email provider (WordPress.com/Titan) – email and communication
- Google (Google Meet) – online courses
- ________________________________ (to be filled in as needed)
The processor will inform the data controller of changes to the list of sub-processors, and the data controller may object to a new sub-processor on reasonable grounds.
07 Assistance
The processor assists the data controller, to the extent reasonable, in fulfilling its obligations under the GDPR, including with requests from data subjects regarding access, correction or deletion, and with data protection impact assessments (DPIA) where relevant to the job.
08 Breaches
If the processor becomes aware of a breach (security incident) involving personal data processed under this agreement, the processor will notify the data controller without undue delay, and no later than 48 hours after becoming aware of the breach, with the information available at that time.
09 Deletion and return
Documents containing personal data are deleted no later than 12 months after the service is delivered, unless the data controller requests in writing an earlier deletion or the return of the documents. On termination of the agreement, all personal data the processor has received under the agreement is deleted or returned, unless the law requires retention (for example accounting records, which follow their own statutory deadlines).
10 Audit
The data controller may request documentation showing that the processor fulfills its obligations under this agreement, and may, following prior notice and at its own cost, carry out or have carried out an audit of the processor's relevant procedures.
11 Duration and governing law
The agreement applies for as long as the processor processes personal data on behalf of the data controller in connection with services delivered, and is governed by Norwegian law. Disputes will be sought resolved amicably; if not resolved, the governing law and dispute resolution provision of the Terms of Sale for Businesses applies.