Data Processing Addendum (DPA)

Version 1.1.1 — content locked 7 August 2026.

This Data Processing Addendum ("DPA") supplements the Prelog Terms of Service between the customer identified in the applicable order ("Customer") and Agdir Drift AS, a company registered in Norway (EEA) under organisasjonsnummer [Norwegian organisation number pending] in the Foretaksregisteret (Brønnøysundregistrene), with registered office at [Norwegian registered office pending] and MVA number [Norwegian MVA number pending] ("Prelog"), and applies to the extent Prelog processes personal data on Customer's behalf as a processor under the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") as incorporated into Norwegian law via the EEA Agreement.

For consumer end-users, Prelog acts as a data controller under the Privacy Policy and does not need this DPA — the Privacy Policy governs. This DPA is provided for business customers, or where a Customer's applicable law requires a written processor agreement satisfying GDPR Art. 28(3).

By using the Service, Customer is deemed to have entered into this DPA on the effective date. A countersigned copy is available on request to [email protected].

1. Definitions

Terms used in this DPA have the meanings given in the GDPR. In particular:

• "Personal Data" — data covered by the GDPR that Prelog processes on Customer's behalf.
• "Sub-processor" — a third party engaged by Prelog to process Personal Data on Customer's behalf under Art. 28(2).
• "SCCs" — the Standard Contractual Clauses in Commission Implementing Decision 2021/914, Module Two (Controller-to-Processor).
• "Applicable Data Protection Law" — the GDPR (as incorporated into Norwegian law via the EEA Agreement), the Norwegian personopplysningsloven, and equivalent national data-protection laws applicable to Prelog's processing.

2. Roles

Customer is the controller and Prelog is the processor of Personal Data submitted to the Service by Customer or on Customer's behalf. Each party shall comply with its respective obligations under Applicable Data Protection Law.

3. Scope, subject-matter, and duration of processing

• Subject-matter: provision of the Prelog Service, a nutrition tracking web application.
• Duration: the term of the Customer's paid subscription plus any legally-required retention thereafter.
• Nature and purpose: hosting; account authentication; storage and retrieval of user-submitted nutrition and body-metric data; language-model parsing of user-submitted text and label photos; billing; analytics (only where the end user has consented).
• Categories of data subject: end users authorised by Customer.
• Categories of Personal Data: identifiers (email); authentication material (hashed passwords); user-submitted body-metric data (weight, height, sex, age); food and meal entries; chat messages; optional food-label photos; billing metadata; technical metadata (IP, user agent, request timestamps).
• Special-category data: body-weight metrics combined with height, sex, and age may be data concerning health under GDPR Art. 9(1); an optional eating-disorder self-declaration is also health data. See the Privacy Policy §2 for how these are processed and constrained.

4. Prelog's obligations

Prelog shall:

1. Process only on documented instructions from Customer (Art. 28(3)(a)).
2. Notify Customer if, in Prelog's opinion, an instruction infringes the GDPR (Art. 28(3)(h)).
3. Ensure confidentiality of persons authorised to process Personal Data (Art. 28(3)(b)).
4. Implement appropriate technical and organisational measures (Art. 28(3)(c), Art. 32) as set out in Annex II.
5. Engage sub-processors only under conditions of §5.
6. Assist Customer in responding to data-subject requests, in demonstrating compliance, in DPIAs, and in security-incident response.
7. On end of provision of services, at Customer's choice, delete or return all Personal Data — subject to the legally-required retention noted in the Privacy Policy §6.
8. Make available all information necessary to demonstrate compliance with Art. 28 obligations, and allow for and contribute to audits, subject to §7.
9. Not process Personal Data outside the EEA except as permitted under §6.

5. Sub-processors

Customer grants Prelog a general written authorisation to engage sub-processors, subject to the following.

5.1 Current sub-processor list

Prelog will provide 30 days' prior notice of any addition or replacement of a sub-processor that processes Personal Data. If Customer reasonably objects on data-protection grounds, Customer may terminate the affected part of the Service with a pro-rated refund of any prepaid unused fees.

5.2 Flow-down

Prelog will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA (Art. 28(4)).

6. International transfers

Where Prelog transfers Personal Data outside the EEA to a country without an adequacy decision, Prelog relies on the EU Standard Contractual Clauses, Module Two (Controller-to-Processor) as set out in Commission Implementing Decision 2021/914, incorporated by reference into this DPA. Docking clause (Clause 7) is applicable.

Where the UK GDPR applies, the UK International Data Transfer Addendum (IDTA) to the SCCs applies as issued by the Information Commissioner's Office. Where the Swiss FADP applies, the SCCs apply with references to the GDPR read as references to the FADP and the supervisory authority read as the FDPIC.

7. Audit rights

Prelog will make available all information necessary to demonstrate compliance with Art. 28(3)(h). At Customer's reasonable written request, and no more than once every 12 months unless a security incident or supervisory authority requires otherwise, Prelog will respond to a documented security questionnaire, share the results of independent audits or penetration tests where available, and, if strictly necessary, permit an on-site audit by Customer or a mutually-agreed third-party auditor bound by confidentiality — subject to reasonable notice, working hours, and cost-recovery.

8. Security-incident notification

Prelog will notify Customer of a personal-data breach affecting Customer's Personal Data without undue delay after becoming aware, and in any event within 72 hours, to the account-owner email on file. The notification will include the information required by GDPR Art. 33(3) to the extent then known.

9. Assistance with data-subject requests

Where a data subject exercises rights under GDPR Arts. 15–22 by contacting Prelog, Prelog will refer the request to Customer if the request concerns Personal Data processed for Customer. Prelog will provide reasonable assistance to Customer in fulfilling such requests.

10. Deletion or return on termination

Within 30 days of termination of the Service, Prelog will delete Personal Data processed on Customer's behalf, subject to:

• retention required by mandatory law (billing records under Norwegian bokføringsloven §13 — 5 years);
• backup rotation, with cascade deletion in the next backup cycle (max 30 days).

Prelog will confirm deletion to Customer in writing on request.

11. Liability

The parties' liability under this DPA is subject to the limitations in the Terms of Service, except that nothing in the Terms limits liability that cannot be limited under Applicable Data Protection Law, including liability under GDPR Art. 82.

12. Order of precedence

In the event of conflict:

1. The SCCs (where they apply);
2. This DPA;
3. The Terms of Service.

13. Term

This DPA takes effect on the effective date and continues for the term of the Terms of Service, plus the period during which Prelog retains Personal Data. Termination does not extinguish surviving obligations, including confidentiality, deletion, and audit.

14. Governing law

This DPA is governed by the laws of the Kingdom of Norway, without prejudice to any override under Applicable Data Protection Law or under the SCCs. Venue: Oslo tingrett.

Annex I — Description of processing (per SCCs Annex I)

A. See §1 of this DPA (parties). B. Categories of data subjects, categories of Personal Data, special-category data, frequency, nature and purpose, retention — as in §3. C. Competent supervisory authority: Datatilsynet (datatilsynet.no) — the supervisory authority of the EEA member state in which the data exporter (Agdir Drift AS) is established, per SCC (2021/914) Annex I.C.

Annex II — Technical and organisational measures

• Encryption in transit: TLS 1.3 for all client-facing traffic; TLS for backend and database connections.
• Encryption at rest: filesystem-level encryption on Hetzner servers; encrypted database backups.
• Access control: production access restricted to named personnel with two-factor authentication; role-based access; audit logging.
• Authentication: end-user passwords hashed with Argon2id / scrypt with per-user salt; sign-in supports one-time email codes.
• Segregation: production and non-production environments strictly separated; no user data in staging or development.
• Network isolation: database on a private network with no public ingress.
• Backups: encrypted 30-day rolling backups; erasure requests propagate to backups within 30 days.
• Incident response: documented breach-response procedure; 72-hour supervisory-authority notification (GDPR Art. 33).
• Vulnerability management: dependency scanning in CI; server patching cadence within seven days for high-severity CVEs.
• Data minimisation: only fields required for the Service are stored; body-weight logging is optional; ED self-declaration is optional and used only for the two purposes listed in the Privacy Policy §2.
• Session-replay masking: where PostHog session replay is enabled and consented to, password fields, body-weight numbers, and chat content are masked before capture.
• Change management: all deploys via reviewed pull requests from a private repository; signed commits; CI/CD without persistent access credentials.
• Training: personnel with access to Personal Data receive baseline privacy and security training annually.

Annex III — List of sub-processors

As per §5.1 of this DPA. The authoritative current list is at /legal/dpa and is identical to /legal/privacy §4.