The purpose of this section is to govern rights and obligations by applicable Norwegian regulations, including the Personal Data Act. Further applications are made through this section to safeguard GDPR regulations that became law in July 2018 in Norway.

GreatPeople will, in some contexts, need to act as the data processor for our clients. This may e.g., be collecting personal data about clients, external candidates and references for the person to be hired, or personal data about internal candidates.

The personal data that GreatPeople may need to process is contact information including name, e-mail address, postal address and telephone number, information about education and work experience including positions, places of work, duration of employment, conditions, and any recommendations – as well as preferences for future work. GreatPeople does not process sensitive personal data.

The purpose of GreatPeople’s processing of personal data on behalf of our clients as a data controller is to provide the service as agreed. Personal data transferred to GreatPeople will not be used for any purpose other than that stated in this section. In order to carry out the agreed service delivery, GreatPeople may need to collect, register, compile, store and transfer personal data on behalf of the client.

GreatPeople shall follow the procedures and instructions for the processing that the client and GreatPeople have jointly decided shall apply at all times, including concerning the transfer of personal data to a third state or an international organization in a third state.

Unless otherwise agreed or provided by law, the client has the right to access the personal data processed and the systems used for this purpose. GreatPeople is obligated to provide the necessary assistance to this. In the event of inquiries to the client with claims from individuals covered by this section, the client will be able to contact the contracting party named below for assistance in complying with such a claim.

GreatPeople has a duty of confidentiality regarding documentation and personal data that it accesses under this agreement. This provision also applies after the termination of the agreement. All persons who, on behalf of GreatPeople, carry out assignments where the use of the personal data in question is included shall be familiar with GreatPeople’s contractual and regulatory obligations and fulfil the terms thereof. GreatPeople is responsible for educating employees and subcontractors about the processing of personal data, and the risks of processing and handling nonconformities. GreatPeople is responsible for any breach of this clause caused by employee or subcontractor’s actions.

The client accepts that GreatPeople makes use of subcontractors for the processing of personal data. At the present time, the subcontractors who have access to personal data are Protekt IT, Microsoft, RecMan and Assessio.

The client and GreatPeople shall implement appropriate technical and organizational measures to achieve a level of safety appropriate to the risk.

GreatPeople is obligated to provide the client with access to its security documentation and assist in this so the client can fulfil his or her own responsibilities in accordance with the regulations. GreatPeople shall comply with the security measures laid out in the Privacy Policy and shall, at the request of the client, be able to disclose this. If necessary, security audits shall be carried out. If a breach of this clause has taken place, both the Client and GreatPeople are obligated to inform the other party of this.

This section applies as long as GreatPeople processes personal data on behalf of the client. When the processing no longer takes place, GreatPeople is obligated to relinquish or delete all personal data received pursuant to this section and – at the written request of the client – within a reasonable time.