Data processing agreement

Version 1.0 · October 27, 2026

This is a translation of the Norwegian original. If the two differ, the Norwegian version applies.

1. Parties

The agreement is entered into between the organization that uses Tavleo (the “Customer”) as controller and Margareto Software AS, org. no. 931 338 811, Malvik (the “Processor”). It governs the Processor’s processing of personal data on behalf of the Customer in the delivery of Tavleo (the “Service”), in accordance with Article 28 of the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

The agreement is part of the terms for Tavleo and applies from the time the Customer starts using the Service. In the event of conflict, this agreement takes precedence with regard to personal data. The limitations of liability in section 8 of the terms also apply to this agreement.

2. Nature, purpose and duration of the processing

2.1. Purpose: to deliver, operate and provide user support for the Service, including setting up and changing the screen according to the Customer’s instructions.

2.2. Categories of data subjects: persons mentioned in calendars, files and messages that the Customer connects, uploads or sends, for example meeting participants, customers and employees.

2.3. Categories of personal data: the content of calendars the Customer connects, such as titles, times, rooms and participants, and the content of files and messages the Customer sends to the AI assistant.

2.4. The screens: From the TV, the last contact, the type of TV and the screen size are stored. The screen does not set cookies and collects no information about those who look at it.

2.5. Outside the agreement: Margareto Software AS is an independent controller for data about the Customer’s contact persons and users (name, email address, sign-in and payment details), for messages the Customer’s users send in “Help” or with “Could the assistant have done this better?”, and for event data from public sources, see the privacy policy.

2.6. Improvement of the Service: The Customer permits Margareto Software AS to use the messages the Customer’s users write to the AI assistant in daily and weekly summaries of requests that the Service has not been able to carry out or has misunderstood. Email addresses, phone numbers, web addresses and business names are removed before the summaries are made, and the content of calendars and files is not used. The summaries are sent to Margareto Software AS by email and are deleted after 12 months. For this processing, Margareto Software AS is an independent controller. The legal basis is legitimate interests in improving the Service (Article 6(1)(f) of the GDPR). The Customer may opt out of such use in the app.

2.7. Duration: for as long as the Customer has an account, see section 9.

3. Obligations of the parties

The Processor must:

1. process personal data only on documented instructions from the Customer, as set out in this agreement and the functionality of the Service, including with regard to transfers to third countries, unless the processing is required under Norwegian law;
2. notify the Customer of such a legal requirement before the processing, unless the law prohibits such notice;
3. ensure that persons with access are subject to a duty of confidentiality;
4. implement appropriate technical and organizational measures under Article 32, see section 6;
5. assist the Customer in responding to requests from data subjects (Articles 12–23) and with obligations under Articles 32–36;
6. notify the Customer immediately if, in the Processor’s opinion, an instruction infringes the GDPR;
7. delete or return the data upon termination, see section 9;
8. keep a record of the processing under Article 30(2).

The Customer is responsible for ensuring that there is a legal basis for the data the Customer connects, uploads or sends, and for informing the data subjects, for example that meetings are shown on a screen.

4. Sub-processors

The Customer gives general prior authorization for the use of sub-processors. Current list:

Notice of changes to the list is given at least 30 days before a new sub-processor is first used. The Customer may object on reasonable grounds (saklig innsigelse). If the parties find no solution, the Customer may terminate the Service with effect from the date of the change and be refunded advance payments for time not used. The same obligations are imposed on the sub-processors, and the Processor is fully liable to the Customer for their fulfillment of those obligations.

5. Transfers to third countries

The Customer’s personal data is stored and processed primarily in the EU/EEA. Where sub-processors outside the EEA are used (see the table), transfers take place only on a valid basis for transfer under Chapter V of the GDPR.

6. Security measures

Among other things: encryption in transit and at rest, access control on a need-to-know basis, logging of administrative events, ongoing security updates, automatic backups and separate environments for production and development. Calendar links are never shown on the screen, and entries the Customer hides are never sent to the TV.

7. Personal data breach

The Processor notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a breach. The notice must, as far as possible, describe the nature of the breach, the categories of data subjects and personal data concerned, the likely consequences and the measures taken, so that the Customer can report the breach to the Norwegian Data Protection Authority (Datatilsynet) under Article 33 and inform the data subjects under Article 34.

8. Audit

Once a year, with reasonable notice, the Customer may require documentation that the agreement is being complied with, primarily in the form of written self-reporting and third-party attestations from sub-processors. If the documentation is not sufficient, the Customer may require an on-site audit, carried out by the Customer or by an independent auditor appointed by the Customer. The Customer covers its own costs.

9. Duration and termination

The agreement applies for as long as the Processor processes personal data on behalf of the Customer. The Customer may ask to have the data returned before deletion. With “Delete everything” in the app, the Customer can itself delete its account, screens and files immediately. Otherwise, the Customer’s personal data is deleted within 90 days after the customer relationship has ended, unless storage is required by law. Backups are deleted in line with their ordinary rotation.

10. Changes, governing law and supervision

Notice of changes to the agreement is given by email at least 30 days before they take effect. The agreement is governed by Norwegian law, with Trøndelag District Court as the agreed venue (verneting). The supervisory authority is the Norwegian Data Protection Authority. The agreement is written in Norwegian and translated into English. If the two differ, the Norwegian version applies.

Data protection contact: pablo@margaretosoftware.no · Margareto Software AS, org. no. 931 338 811, Malvik.