This is a translation. If the English and Norwegian versions differ, the Norwegian version applies. Read the Norwegian version.
The purpose of the Agreement is to regulate the parties’ rights and obligations under applicable data protection legislation, including the Norwegian Personal Data Act of 15 June 2018 No. 38 and the EU’s General Data Protection Regulation 2016/679 (“GDPR”).
The Agreement shall ensure that personal data about data subjects is not used unlawfully or comes into the possession of unauthorised persons. The Controller determines the purpose of the processing of personal data and which means are to be used. It is the Controller who is responsible for personal data being processed in accordance with the requirements set out in data protection legislation.
The Controller shall ensure that a valid legal basis exists for the processing of the personal data processed by the Processor.
The Agreement regulates the Processor’s processing of personal data on behalf of the Controller, including processing as defined in GDPR Article 4(2)
Any information relating to an identified or identifiable natural person (“the data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by EU law or the national law of the member states, the Controller, or the specific criteria for its nomination, may be determined by EU law or the national law of the member states.
A natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
Any natural or legal person, public authority, agency or other body other than the data subject, the Controller, the Processor and the persons who, under the direct authority of the Controller or the Processor, are authorised to process personal data.
The Processor processes personal data on behalf of the Controller in connection with the provision, operation and further development of the Hoopit platform.
The processing takes place to enable the administration of memberships, communication, activities, events, payments, financial follow-up and other functions included in Hoopit’s services, as these are described from time to time in the Service Agreement or cooperation agreement between the parties.
The processing includes, among other things, collection, recording, storage, structuring, use, disclosure, transfer, compilation, erasure and other processing necessary to provide the services.
The processing may cover personal data about:
-Members
-Parents or guardians
-Coaches
-Employees, volunteers and officials
-Other persons associated with the Controller
The processing takes place for as long as the Service Agreement between the parties remains in effect, and for the period necessary to fulfil the purpose of the Agreement or legal obligations.
If the Controller chooses to activate integration with the Norwegian Olympic and Paralympic Committee and Confederation of Sports (NIF), this is regarded as an instruction to the Processor to exchange information necessary for the validation and synchronisation of membership. This typically includes name, date of birth, postcode, gender and membership status, as well as technical identifiers for matching against the Sports Central Database (Idrettens Sentrale Database). NIF receives this information as an independent controller.
This Agreement, together with the Service Agreement and the Solution’s standard functionality as it exists from time to time, constitutes the Controller’s complete documented instructions to the Processor
The following categories of personal data may be processed in the Processor’s solutions:
The list above indicates categories of personal data that may be processed and is not exhaustive.
Limitation: Processing of special categories of personal data (GDPR Art. 9), including health data or data relating to criminal convictions and offences, is not permitted in the Solution without a separate written supplementary agreement. The Controller is responsible for ensuring that such information is not uploaded in breach of this prohibition.
This Agreement, together with the Service Agreement and the Solution’s standard functionality as it exists from time to time, constitutes the Controller’s complete documented instructions to the Processor
The Processor shall ensure that persons authorised to process personal data have committed themselves to confidentiality or are subject to a statutory duty of confidentiality.
The Processor shall give the Controller access to relevant security documentation and assist the Controller so that it can fulfil its obligations under applicable data protection legislation.
Unless otherwise follows from law or agreement, the Controller has the right to access the processing of personal data and the systems used under this Agreement. The Processor shall provide the necessary assistance for this within a reasonable time.
The Processor shall, without undue delay, notify the Controller if, in the Processor’s assessment, an instruction is contrary to applicable data protection legislation.
The Processor is bound by a duty of confidentiality regarding personal data and documentation processed under this Agreement. The duty of confidentiality also applies after the Agreement ends. The Processor shall ensure that everyone given access to the information is bound by equivalent confidentiality obligations.
The Processor shall meet the security measure requirements imposed by Norwegian data protection legislation as it applies from time to time. If changes are introduced to service-level requirements and solutions that result in an increase in costs and resource use for the Processor beyond what could reasonably be expected at the time the Data Processing Agreement was established, the Processor may require such costs to be covered by the Controller through an adjustment of the remuneration for delivery of the service.
The level of security shall take into account the nature of the personal data and the risk of a breach of data security for the data subject. For this reason, the Processor and the Controller shall carry out a risk review to ensure satisfactory data security. The risk assessment and identified security measures will be based on the risk assessment template, as attached, or by using the Controller’s own risk assessment template.
The Processor shall, on request and as needed, document routines and other measures to meet these requirements. The documentation shall be made available at the Controller’s request.
The Processor shall ensure confidential processing of personal data and shall not disclose information to third parties or process it for its own purposes, unless this is necessary for the provision of the service in accordance with this Agreement or follows from documented instructions from the Controller, applicable legislation or the use of approved sub-processors. The information shall only be processed to the extent necessary to provide the services to the Controller, and shall only be made available to persons under the Processor’s authority who have an operational need for access.
Personal data processed by the Processor on behalf of the Controller may be transferred to, stored in and processed in countries where the Processor or its approved sub-processors operate.
Transfer of personal data to countries outside the EEA shall only take place if the conditions in Chapter V of the General Data Protection Regulation are met. The Processor shall ensure that a valid transfer basis exists before such transfer takes place, including by using the European Commission’s Standard Contractual Clauses, an adequacy decision or other approved transfer mechanisms.
The Processor shall, on request, be able to document which transfer basis is used.
The Processor is given general permission to engage subcontractors. An overview of approved subcontractors used to provide the service is set out in Appendix 1.
The Processor shall notify the Controller in writing at least 30 days before new sub-processors are put into use. The Controller may, within this deadline, object to the change if there is reasonable grounds to do so.
The Processor is responsible for carrying out a security analysis of the subcontractor’s ability to meet the requirements set out in this Data Processing Agreement and other statutory requirements for the processing of personal data.
The Processor shall ensure that all subcontractors are bound by the same requirements for information security and use as set out in this Data Processing Agreement. The Processor is fully liable to the Controller for any breach of the requirements and guidelines that apply under this Data Processing Agreement.
The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. This includes any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
The notification shall at least contain:
The Controller is responsible for ensuring that a breach notification is sent to the Norwegian Data Protection Authority (Datatilsynet) and, where applicable, to the data subjects, in accordance with the applicable deadlines (72 hours).
The Processor shall regularly carry out security audits and assessments of the systems and processes covered by this Agreement. The audits shall include an assessment of organisation, security measures and use of suppliers, and shall be adapted to the requirements of applicable data protection legislation. Documentation from such audits shall be made available to the Controller on request.
The Controller may, with reasonable prior notice, no more than once a year, request that an audit be carried out of the Processor’s compliance with this Agreement. The audit shall be carried out in a manner that does not unduly disrupt the Processor’s business or security.
If the Controller wishes an audit to be carried out by a third party, the auditor shall be independent, subject to a duty of confidentiality and approved by both parties. Such approval shall not be withheld without reasonable grounds.
Unless otherwise follows from law or agreement, the Controller shall cover reasonable documented costs associated with carrying out an audit under this provision.
The Processor shall, as far as possible and within the scope of the processing, assist the Controller in fulfilling its obligations to safeguard the rights of data subjects under applicable data protection legislation.
Such assistance includes, among other things, handling requests for access, rectification, erasure, restriction of processing, data portability, objection and other rights under the legislation.
If the Processor receives an enquiry directly from a data subject regarding the processing of personal data covered by this Agreement, the enquiry shall, without undue delay, be forwarded to the Controller, unless otherwise follows from law.
Assistance provided by the Processor in connection with the rights of data subjects, security audits or assistance with incidents not caused by the Processor’s default shall be invoiced to the Controller at the Processor’s hourly rates in effect from time to time.
This Agreement applies for as long as the Processor processes personal data on behalf of the Controller.
Upon termination of the Service Agreement, the Processor shall, without undue delay, cease processing personal data and delete or return the information to the Controller, unless further storage is required under applicable legislation.
In the event of a breach of this Agreement or applicable data protection legislation, the Controller may require the Processor to stop processing personal data with immediate effect, to the extent this is practically possible.
Upon termination of this Agreement, the Processor shall, following instructions from the Controller and without undue delay, either return or securely delete all personal data and related documentation processed under the Agreement. This also applies to any backup copies and information stored with sub-processors.
Deletion shall not be carried out if further storage is required under applicable legislation. In such cases, the information shall continue to be processed in accordance with this Agreement and applicable data protection legislation.
The Processor shall document in writing to the Controller that deletion and/or destruction has been carried out in accordance with this provision within a reasonable time after the Agreement ends.
The Processor is not liable for indirect losses or consequential damages arising from a breach of this Agreement, unless the loss is due to gross negligence or wilful misconduct on the part of the Processor.
The Processor’s total liability for direct losses under this Agreement is limited to an amount equivalent to the total remuneration paid by the Controller for the services during the twelve (12) months preceding the event giving rise to liability.
The limitations of liability in this provision do not apply to the extent otherwise follows from mandatory law.
The Controller shall indemnify the Processor against claims from third parties to the extent the claim is due to circumstances for which the Controller is responsible.
Amendments or additions to this Agreement shall be in writing and approved by both parties.
Updates made within the scope of the Agreement, including changes to sub-processors, technical solutions or security measures, are not regarded as amendments to the Agreement as long as the terms of the Agreement continue to be met. Such updates shall be notified or made available to the Controller in accordance with the other provisions of the Agreement.
This Agreement is governed by Norwegian law.
Any disputes arising in connection with the Agreement shall be settled by Romerike and Glåmdal District Court as exclusive legal venue. This provision also applies after the Agreement ends.
Last updated: 30.09.2026