Data processing agreement

This data processing agreement (the Agreement) applies between

• the controller (the Customer): the business that is party to the quote, order or agreement with the Supplier (the Main Agreement), including where the order was placed in the App
• the processor (the Supplier): Wonder Technologies AS, org. no. 929 267 834 MVA, Oreliveien 8, 0580 Oslo, Norway, hello@heyroes.com. The Supplier provides its services under the name Heyroes

The Agreement meets the requirements of Article 28 of the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven), and equivalent requirements in the UK GDPR and the Swiss Federal Act on Data Protection where they apply. It applies from the time the Main Agreement is concluded and for as long as the Supplier processes Personal Data on the Customer's behalf. The Agreement forms part of the Main Agreement and the terms of service and applies without a separate signature. In the event of conflict concerning the Processing of Personal Data, the Agreement takes precedence.

Purpose

The Supplier processes Personal Data on behalf of the Customer in order to deliver the Services under the Main Agreement:

• websites and online stores, including development, hosting, operations, maintenance and backups
• growth packages and add-on services in the App, where the Heroes and the team work on ads, search visibility, content, design, social media, enquiries and reports
• support and advice

The data is used only for these purposes and not for the Supplier's own purposes, except for anonymised insights under clause 7.8.

Definitions

• Personal Data: any information relating to an identified or identifiable natural person
• Processing: any use of Personal Data, such as collection, storage, alteration, transfer and erasure
• Services: the services the Customer has ordered under the Main Agreement, including the App
• App: the Supplier's app, where AI agents (the Heroes) work together with the Supplier's team and the Customer
• Subprocessor: a provider used by the Supplier that processes Personal Data on the Customer's behalf

Roles and instructions

The Customer is the controller and determines the purpose of the Processing. The Supplier is the processor and processes the Personal Data only on the Customer's documented instructions. The instructions are the Agreement, the Main Agreement, the settings the Customer chooses in the App and the suggestions the Customer approves there. If the Supplier considers that an instruction infringes data protection rules, the Supplier will inform the Customer immediately.

The Customer is responsible for

• ensuring that the Processing has a lawful basis and that the data subjects receive information, for example in a privacy notice on the website and next to the forms
• ensuring that consent to cookies and tracking on the website is obtained where the law requires it, including for the Heyroes plugin and the tracking script, see clause 5
• ensuring that contact lists uploaded for ads have been collected lawfully, and that the individuals have received information and given consent where required. When the App uploads a list to Google, it confirms to Google that consent has been given, and the Customer warrants that this is correct
• ensuring that persons shown in images and video the Customer uploads have consented to the material being used in marketing
• ensuring that the Customer has accepted the terms of Google, Meta and other platforms for its accounts
• who is given access to the App, and what is shared with the Heroes

Data sent to Google, Meta and other advertising platforms is sent to the Customer's own accounts and processed there under the Customer's agreements with the platforms. The platforms are not the Supplier's Subprocessors for that part.

Data subjects and categories of Personal Data

The Processing may concern these categories of data subjects:

• people who contact the Customer through the website, lead forms on Google and Meta or in other ways
• visitors to the Customer's website
• the Customer's customers, when the Customer connects a CRM or online store
• people who comment on the Customer's social media pages
• people in contact lists the Customer uploads
• people shown in images and video the Customer uploads
• the Customer's users and employees
• other people mentioned in content the Customer shares with the Heroes

The Processing may include the following data:

• Enquiries: name, company, email, phone, location, website, the message and the answers in the form
• Tracking: which campaign, ad and page the enquiry came from, click IDs from Google and Meta, and IP address and browser data. IP address and browser data are deleted once the conversion has been sent to Meta
• Sales from the Customer's CRM: order value, status, dates, postcode, customer group, and email and phone in hashed form, to link sales to enquiries. Hashing is pseudonymisation, and the data is still regarded as Personal Data
• Contact lists for ads: email and phone, which are hashed before they are sent to Google and Meta. The file itself is not stored
• Social media comments: the name and platform ID of the person commenting, the text and the link. Name and ID are not sent to the language models
• Images and brand: product images, logos and other material the Customer uploads, which may show people, and the images and videos the Heroes create from them
• Statistics: only aggregated figures are retrieved from Google Analytics and Search Console, and no data about individuals
• Conversations with the Heroes: what the Customer writes and the files the Customer uploads
• Websites: the database and files on websites operated by the Supplier, which may contain users, orders and form submissions, and backups of them

The Processing consists of, among other things, receiving, storing and sorting enquiries, notifying the Customer by email, sending conversions to the Customer's ad accounts, retrieving sales data from the Customer's CRM, uploading audiences, retrieving and sorting comments, creating content, images, video and ads that the Customer approves, operating and backing up websites, and providing support.

Data that must not be processed. The Agreement does not cover special categories of Personal Data (GDPR Article 9), data relating to criminal convictions (Article 10), national identity numbers or data about children. The Customer shall not ask for such data in forms or lead forms and shall not share it with the Heroes. The tracking script filters out fields that resemble national identity numbers and card numbers, but this is a safety net and does not relieve the Customer of its responsibility.

Tracking on the Customer's website

The Heyroes plugin for WordPress and the tracking script send form submissions from the Customer's website to the App, so that enquiries are collected in one place and can be linked to the ads that generated them. The script sends all fields in the form, but not passwords, hidden fields, files, card numbers or values that resemble national identity numbers. It also sends the IP address and browser data of the person submitting the form.

The plugin also reads Meta's cookies _fbp and _fbc when they are present. None of these cookies are necessary for the website to work. The Customer shall therefore include them in the cookie banner and the privacy notice on the website, and obtain consent before they are set. The Supplier is happy to help with the setup.

Legal basis for Processing

The Customer is responsible for ensuring that the Processing is lawful, for example by obtaining consent where required. The Supplier processes the data on the basis of the Customer's instructions.

The Supplier's obligations

7.1 Instructions

The Supplier processes Personal Data only within the Agreement and the Customer's instructions, unless the law requires otherwise. If the law so requires, the Supplier will inform the Customer before the Processing, unless the law prohibits this.

7.2 Confidentiality

Everyone at the Supplier and its Subprocessors who has access to the Personal Data is bound by a duty of confidentiality.

7.3 Security

The Supplier has technical and organisational measures appropriate to the risk, in accordance with GDPR Article 32, including

• encryption of data in transit and at rest
• access credentials for the Customer's services, such as Google Ads and Meta, are stored encrypted with AES-256-GCM
• each customer sees only its own data, with row-level security in the database, and access is controlled by role
• access to the App by invitation only, and access that is withdrawn stops at once
• logins and changes are logged
• private storage areas for files, with links that expire
• changes to the Customer's accounts require the Customer's approval by default
• daily database backups

The measures are described in more detail on the security page (in Norwegian). The Supplier reviews and improves them regularly.

7.4 Subprocessors

By entering into the Agreement, the Customer authorises the Supplier to use the Subprocessors listed in clause 16. The Supplier enters into a written agreement with them imposing the same obligations as in the Agreement, and is liable to the Customer for their Processing. Before a new Subprocessor is engaged or an existing one is replaced, the Supplier notifies the Customer at least 30 days in advance, by email or in the App. The Customer may object on objective grounds. If the parties do not find a solution, the Customer may terminate the affected service with effect from the change.

7.5 Personal Data breaches

The Supplier notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a breach affecting the Customer's data. The notification describes, as far as is known, what has happened, which data and persons are affected, the possible consequences and what has been done. The Supplier assists the Customer in notifying the Norwegian Data Protection Authority (Datatilsynet) and the persons affected.

7.6 Assistance

The Supplier assists the Customer in responding to requests from data subjects, such as access, rectification, erasure, restriction and data portability, and with data protection impact assessments and prior consultations with Datatilsynet. Requests from data subjects that reach the Supplier are forwarded to the Customer. Assistance beyond the ordinary may be invoiced on a time basis, see clause 6.6 of the terms of service.

7.7 Artificial intelligence

The Heroes use language models from Anthropic, and images, video and speech from OpenAI, Higgsfield and ElevenLabs, see clause 16. The models receive only the data needed for the task. Under the terms of the services the Supplier uses, the Customer's data is not used to train the models. The Heroes make no decisions that have legal effects for the data subjects or that similarly significantly affect them.

Under the EU Artificial Intelligence Act (AI Act), the Supplier is the provider of the Heroes and marks images, video and speech they create as AI-generated. The Customer uses the content and is responsible for labelling what the Customer publishes where the AI Act requires it, see clause 21.10 of the terms of service.

7.8 Anonymised insights

The Supplier may use anonymised and aggregated data, which cannot be linked to the Customer or to individuals, to improve the Services and the Heroes.

Audits and inspections

The Supplier provides the Customer with the information needed to demonstrate compliance with the Agreement. The Customer may also carry out an audit once a year with 30 days' notice, either itself or through an independent auditor bound by confidentiality. The audit shall not unduly disrupt operations, and the Customer bears the costs unless the audit reveals material breaches of the Agreement.

Deletion and return of data

• The Customer may at any time get the Personal Data out of the App as JSON, and websites as a full copy of WordPress with files and database. Until the Customer can do this in the App, the Supplier delivers the export within 10 working days of the Customer's request.
• When the Main Agreement ends, the Customer has 30 days to export the data. No later than 30 days after that, the Supplier deletes or anonymises it, including at the Subprocessors, unless the law requires longer storage.
• When Personal Data is deleted, the copies in the audit log are also deleted. Security and audit logs are otherwise stored for up to two years to document what has been done, and are then deleted.
• Database backups are deleted after seven days. Website backups are locked for 30 days at Google Cloud and then deleted.
• If the Customer disconnects its CRM, the sales data is deleted unless the Customer chooses to keep it.
• Data already sent to the Customer's accounts with Google, Meta or other platforms is governed by the Customer's agreements with them.
• The Supplier confirms in writing that the deletion has been carried out when the Customer requests it.

Transfers to countries outside the EEA

Data is mainly stored in the EEA: the database in Ireland, error monitoring in Frankfurt and website backups in Finland. The App runs on servers in Stockholm. The websites are hosted by Hostinger in the United Kingdom, which the EU has recognised as providing an adequate level of protection.

Some of the Subprocessors in clause 16 are US companies, process data in the United States or have access from there for support and operations. The Customer accepts the transfers on condition that they have a valid basis under GDPR Chapter V. The basis for each Subprocessor is set out in clause 16: the European Commission's decision on the EU-US Data Privacy Framework for certified companies, or the EU standard contractual clauses (SCCs), Module 3, with supplementary measures following a transfer impact assessment. The Customer may request a copy of the standard contractual clauses. If the Data Privacy Framework falls away, the Supplier will switch to standard contractual clauses or to a Subprocessor in the EEA and notify the Customer.

Liability and damages

Each party is liable for breaches caused by its own acts or omissions. The Supplier's liability under the Agreement is subject to the limitations in clause 16 of the terms of service, and liability under the Agreement and the terms of service counts together towards the limit there. The exceptions in clause 16.6 of the terms of service also apply here. Each party bears any administrative fine imposed on it. The limitations do not apply to data subjects' claims under GDPR Article 82.

Term and termination

• The Agreement applies for as long as the Supplier processes Personal Data on the Customer's behalf under the Main Agreement.
• When the Agreement ends, clause 9 on deletion and return of data applies.
• In the event of a material breach, the other party may terminate the Agreement with immediate effect.

Confidentiality

The parties shall keep Personal Data and other confidential information secret, including after the Agreement ends, see clause 24 of the terms of service.

Governing law and disputes

The Agreement is governed by Norwegian law. Disputes are resolved as set out in clause 20 of the terms of service: by Oslo District Court (Oslo tingrett) for customers in Norway, the EU, the EEA and Switzerland, and by arbitration in Oslo for other customers.

Changes

The Supplier may change the Agreement when the Services or the rules change, with 30 days' notice by email or in the App. If the Customer disagrees, the Customer may terminate the affected service before the change takes effect. New Subprocessors are governed by clause 7.4. This version applies to new customers from the date of their order, and to existing customers from 1 January 2027.

Subprocessors

The Supplier uses the following Subprocessors when processing Personal Data for the Customer:

US state privacy laws

This clause applies when the Personal Data is subject to the California Consumer Privacy Act (CCPA) or another US state privacy law. The Customer is then the business or controller, and the Supplier is its service provider or processor.

The Supplier shall

• process the Personal Data only for the limited and specified purposes in clause 1, which is to deliver the Services to the Customer
• not sell or share the Personal Data, as those laws use the words
• not retain, use or disclose the Personal Data outside the direct business relationship with the Customer, and not combine it with data from other sources, except as those laws allow
• comply with the obligations that apply to the Supplier under those laws, and give the data the level of privacy protection they require
• tell the Customer if the Supplier can no longer meet these obligations

The Customer may take reasonable steps, including under clause 8, to ensure that the Supplier uses the data in line with these obligations, and to stop and remedy unauthorised use.