Data PROCESSING AGREEMENT

This data processing agreement (the ”DPA”) has today been entered into between:

Liber AB, Reg. No. 556000-1975, a company with the registered address at
113 98 Stockholm (“Liber”); and

[INSERT NAME OF CUSTOMER] Reg. No [INSERT REG NO] a [company/municipality] with a registered address at [INSERT ADRESS] (the ”Customer”).

Customer and Liber are referred to alone as “Party“ or jointly as “Parties“.

General

This DPA is entered into between the Parties in connection with the separate (license) agreement between the Parties regarding the Customer’s access to the products and/or services of Liber (the ”Agreement”) between Liber and the Customer.

Under this DPA, Liber will Process Personal Data on behalf of the Customer in capacity of the Customer’s Processor and in connection with Liber’s provision of services under the Agreement. The Customer is the Controller for the Processing of the Personal Data.

Definitions

”Agreement”	means as defined in Section 1.1.
”Controller”	has the meaning as set out in article 4 of the GDPR.
”Customer”	means the party defined above and acting as the Controller.
”Data Protection Laws”	means the laws and regulations, applicable from time to time, in respect of Processing of Personal Data, including but not limited to, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (the “GDPR”), replacing the Swedish Personal Data Act (1998:204), as well as the Supervisory Authority’s binding decisions, regulations and recommendations and supplementary local adaptions and regulations in respect of data protection.
“DPA”	means this Data Processing Agreement.
”Data Subject(s)”	has the meaning as set out in article 4 of the GDPR.
”Personal Data”	has the meaning as set out in article 4 of the GDPR.
”Process/-ing”	has the meaning as set out in article 4 of the GDPR.
”Processor”	has the meaning as set out in article 4 of the GDPR.
“Liber”	means the party defined above and acting as the Processor.
”Supervisory Authority”	means the supervisory authority/supervisory authorities authorised to conduct supervision of processing of Personal Data or considered to be a supervisory authority concerned under the Data Protection Laws.
”Sub-processor”	has the meaning as set out in article 28(4) of the GDPR.
“Term”	means as defined in Section 11.1
“Third Country”	means a country outside the European Economic Area.
”Personal Data Breach”	has the meaning as set out in article 4 of the GDPR.

Any other terms or concepts used in capitalized letters in this DPA shall, unless otherwise stated, have the meaning provided for under the Data Protection Laws and otherwise under the Agreement, unless otherwise obviously required from the circumstances.

Responsibilities and instructions

The type(s) of Personal Data to be Processed under this DPA, the purpose and duration of the Processing and categories of Data Subjects are set out in Appendix 1 (Instructions regarding the Processing of Personal Data).

Liber shall only Process Personal Data on documented instructions from the Customer as set out in Appendix 1. Additional Processing may also be performed provided that Union or Member State law to which Liber or a Sub-processor is subject to requires such Processing. In such case of additional Processing, Liber shall inform the Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

Liber undertakes to provide written instructions to persons acting under the authority of Liber, who have access to Personal Data, obliging such persons only to Process the Personal Data only according to documented instructions from the Customer, unless required to do so by Union or Member State law.

Security of Processing

Liber shall instead take all measures required pursuant to article 32 of the GDPR in accordance with its security policy as available on the webpage ‘Integritestspolicy’ on www.liber.se.

Liber shall notify the Customer without undue delay after becoming aware of a Personal Data Breach.

Liber shall, taking into account the nature of Processing and the information available to Liber and assist the Customer in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR.

Confidentiality

Liber undertakes to keep the Personal Data confidential, except with respect to information that the Supervisory Authority communicates to Liber should be disclosed, or which is disclosed subject to the Data Protection Regulations or another legal binding obligation, including under the provisions of applicable public access to information acts.

Liber undertakes to ensure that persons authorised to Process Personal Data have undertaken confidentiality obligations or are subject to appropriate statutory obligation of confidentiality.

Disclosure of Personal Data and information

In the event Liber receives a request for information from a Data Subject, Supervisory Authority or other third party regarding the processing of Personal Data, Liber shall, without undue delay, forward such request to the Customer. Liber, Liber’s employees, or Sub-processors may not disclose Personal Data or any other information about the Processing of Personal Data without instructions from the Customer, unless such disclosure is required under the Data Protection Laws.

Rights of the Data Subject

Liber shall taking into account the nature of the Processing under this DPA, assist the Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the Data Subject’s rights laid down in Chapter III of the GDPR.

Transfer of Personal Data outside of the European Economic Area

Liber shall only be allowed to transfer Personal Data to a Third Country or an international organisation with the Customer’s written approval. Transfer of Personal Data to a Third Country or an international organisation may also take place provided that Union or Member State law to which Liber or Sub-processor is subject to requires such transfer. In such case of legal requirement for transfer to a Third Country, Liber shall inform the Customer of that legal requirement before transferring Personal Data to a Third Country, unless that law prohibits such information on important grounds of public interest.

Demonstration of compliance

Liber shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for, and contribute to audits, including inspections, conducted by an independent third party auditor mandated by the Customer.

With regard to Section 9.1 above Liber shall immediately inform the Customer if, in Liber’s opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

Sub-processors

The Customer hereby grants Liber a general authorization to engage Sub-processors. Liber shall inform the Customer of any intended changes concerning the addition or replacement of Sub-processors, thereby giving the Customer the opportunity to object to such changes if to the extent the conditions set forth in Section 10.2 are not fulfilled.

Subject to the Customer’s prior specific or general written authorization, Liber may engage Sub-processors, provided that the same data protection obligations as set out in this DPA as referred to in article 28.3 of the GDPR, are imposed on such Sub-processor by way of a written contract. Liber must ensure that only Sub-processors are engaged who provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of the Data Protection Laws.

The Sub-processors listed in Appendix 2 are pre-approved by the Customer to be used as Sub-processors by Liber under this DPA.

Term and termination

This DPA enters into force on the day of signing by both Parties and remains in force for as long as Liber Processes Personal Data on behalf of the Customer under the Agreement (the “Term”). The Customer may however terminate this DPA at any time effective as of the date chosen by the Customer, without prejudice to the term of the Agreement.

After the end of Liber’s provision of services relating to Processing under the Agreement, Liber shall, at the choice of Liber, upon the Customer’s written request delete or return all the Personal Data to Liber and delete existing copies unless Union or Member State Law requires storage of the Personal data. If the Customer does not provide Liber with such written request, Liber shall permanently delete the Personal Data at the latest 180 days from the expiry of the Term and cause any Sub-processor to do the same.

Compensation

Liber shall have the right to invoice the Customer for any work performed by Liber or a Sub-processor under sections 4.3, 7 and 9.1 according to Liber’s or the Sub-processors reasonable fees.

Liability

The Parties shall be liable towards each other for any direct damages, costs and losses, including administrative sanctions incurred due to the breaching Party’s violation of this DPA and the breaching Party shall compensate the other Party for any such damage, cost or loss.

The Parties agree to indemnify and hold each other harmless from any claim of damages or loss suffered by a third party as a result from either Party’s breach of its obligations under this DPA.

In the event a Data Subject, the Data Protection Authority or other third party submits a claim against Liber due to Liber’s processing of Personal Data, the Customer shall indemnify and hold Liber harmless from such claims; provided that Liber has Processed such Personal Data in compliance with the Agreement and this DPA.

Notwithstanding the above, the “Limitations and exclusions of liability” under the Agreement (Section 13 and 11.3 of the General terms and conditions) shall apply correspondingly under this DPA.

Changes

If, during the Term, Data Protection Laws are changed, or new guidelines, rulings or regulations are published by the Supervisory Authority causing this DPA to be non-compliant with such law, guidelines, rulings or regulations, each of the Parties shall have the right to request appropriate amendments to this DPA to satisfy the new requirements.

The Customer may continuously submit new or changed written instructions regarding Liber’s Processing of Data. In case such instructions materially hinders Liber from providing its services, or increases Liber’s costs of delivering its services to the Customer, Liber has the right to, with continued obligation for the Customer to pay all agreed fees, abort and restrict all Processing of Personal Data, and cause all Sub-processors to do the same, until the Parties have reached a mutually agreeable understanding on how to proceed.

Changes to this DPA shall, in order to be effective, be made in writing and signed by both Parties. Signatures may be made by electronic means and shall have the same force and effect as original signatures.

Miscellaneous

With regard to the Processing of Personal Data, the regulations in the DPA shall have priority over conflicting regulations in any other agreement between the Parties.

This DPA shall be governed by the substantive laws of Sweden.

Any dispute, controversy or claim arising out of or in connection with this DPA shall be settled in accordance with the dispute regulations laid down in the Agreement.

* * * *

This DPA may be executed by electronic means or in two or more counterparts, each of which shall be deemed an original, but all of which shall together constitute one Customer Agreement. Signatures to this DPA made by electronic means or delivered by facsimile or other electronic means shall have the same force and effect as originals.

Place: Stockholm Date:	Place: Date:
LIBER AB Anna Settman	Customer: Name:

Appendix 1 – Instructions regarding the Processing of Personal Data

The following instructions apply for the Processing of Personal Data for which the Customer is responsible as Controller. In addition to what is already stated in this DPA, Liber shall adhere to the instructions below.

Processing

Purposes Please specify all the purposes for which the Personal Data will be Processed for by Liber.	The storage of learning and test results; The customer receiving learning and test results (back); An assessment of learning and test results in order to obtain test materials which are geared to the specific learning needs of an student/user, in order to enable adaptive learning materials and personalised training or learning paths (‘adaptivity’); An assessment of the learning and test results of one student/user compared to a norm group, in order to gain an insight into the performance of an student/user compared to this group; Delivery of the digital learning solutions and the ability to use them; Gaining access to the digital learning solutions offered, including identification, authentication and authorisation; The security, control and prevention of abuse and misuse, as well as preventing inconsistency and unreliability of the personal data processed; Converting data into fully anonymised data in order to improve the quality of the learning solution; Providing learning and test results to end user through file export of data, upon request. The storage of customer data for financial purposes, customer service including ticketing system and chat as well as marketing activities.
Categories of Personal Data Please specify the categories/types of Personal Data that will be Processed by Liber.	Educational: Name(s), email, user name, information on access rights, licenses to educational tools, time used educational tools and results. Financial: Name(s), email, user name, password, address, personal identity number, telephone number, organisation name, organisation number, type of organisation, orders by organisation, credit information. Marketing: Name(s), email, address, telephone number, information on access rights, licenses to educational tools, role, profession as well as campaign information gathered from events, newsletters and forms.
Categories of Data Subjects Please specify the Categories of Data Subjects who’s Personal Data will be Processed by Liber.	Students, pupils, teachers and administrators.
Retention time Please specify the time and requirements for retention of Personal Data that are being Processed by Liber.	Educational: Personal data of users will be anonymized and aggregated after account or subscriptions are inactive for fifteen months, or removed 60 days after receipt of a written request of Customer/upon termination of this DPA by the Customer. Financial: Personal data of users will be removed according to applicable Swedish law. Marketing: Personal data will be saved for as long as we see that our products/offers/activities are of relevance to the customer.
Processing operations Please specify all processing activities to be conducted by Supplier	See Purposes above. Personal data may be transmitted to partners and systems as specified by the Controller. Collection of data on use from tools connected to Liber. Collection of data on use of the Liber platform. Display and amendment of personal data in Liber.
Location of Processing Please specify the locations where Personal Data will be Processed by Liber.	The storage and processing of personal data will take place within the EU.

_____________________________

Appendix 2 – Approved Sub-processors

Below are listed the Sub-processors that have been approved by the Customer for use by Liber to Process Personal Data under this DPA.

SUB-PROCESSOR Please specify below the full name of Approved Sub-processors	LOCATION OF PROCESSING Please specify below the locations where Personal Data will be Processed by each Sub-processor.	LEGAL BASIS FOR TRANSFERS TO A THIRD CONTRY (if applicable)
Klopotek Software & Technology Services GmbH	Germany
Salesforce	Holland
Selligent	Holland
ZenDesk	EU
SAP	Sweden
Pagero	EU
Förlagssystem	Sweden
Discovery Education	Holland
Skolon	Sweden
Sowiso	Holland
Qnova	Sweden
Cention	EU

_____________________________