{"id":17610,"date":"2025-12-09T16:17:35","date_gmt":"2025-12-09T15:17:35","guid":{"rendered":"https:\/\/tenstarsimulation.com\/?page_id=17610"},"modified":"2025-12-10T10:13:07","modified_gmt":"2025-12-10T09:13:07","slug":"data-processing-agreement","status":"publish","type":"page","link":"https:\/\/tenstarsimulation.com\/de\/data-processing-agreement\/","title":{"rendered":"Data Processing Agreement"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"17610\" class=\"elementor elementor-17610\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-761540c e-flex e-con-boxed e-con e-parent\" data-id=\"761540c\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7762367 elementor-widget elementor-widget-spacer\" data-id=\"7762367\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c0c56c9 elementor-widget elementor-widget-heading\" data-id=\"c0c56c9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Data Processing Agreement<span style=\"font-size: 2rem\"><\/span><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-aeceeb9 e-flex e-con-boxed e-con e-parent\" data-id=\"aeceeb9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7fd35f4 elementor-widget elementor-widget-spacer\" data-id=\"7fd35f4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-824e4f4 elementor-widget__width-auto elementor-widget elementor-widget-text-editor\" data-id=\"824e4f4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This Data Processing Agreement (the \u201c<strong>DPA<\/strong>\u201d) is made between Tenstar Simulation AB, registration no. 556786-5570, a company organized under the laws of Sweden, with its registered address at Storemyrsv\u00e4gen 2, 457 31 Tanumshede (the \u201c<strong>Data Processor<\/strong>\u201d); and the Customer, as defined in the Main Agreement (the \u201c<strong>Data Controller<\/strong>\u201d).<\/p><p>\u00a0<\/p><p>The parties listed above are hereinafter referred to as the \u201c<strong>Parties<\/strong>\u201d and each of them separately as a \u201c<strong>Party<\/strong>\u201d.<\/p><p><strong>\u00a0<\/strong><\/p><h5><strong>1 BACKGROUND<\/strong><\/h5><p>1.1 The Parties have entered into an agreement where the Data Processor shall provide the service defined in <span style=\"text-decoration: underline;\">Appendix 1<\/span> of this DPA to the Data Controller (the \u201c<strong>Main\u00a0<\/strong><strong>Agreement<\/strong>\u201d).<\/p><p>\u00a0<\/p><p>1.2 In connection with the Data Processor\u2019s performance of its obligations under the Main Agreement, the Data Processor may from time to time and on behalf of the Data Controller Process Personal Data, as further detailed in <span style=\"text-decoration: underline;\">Appendix 1<\/span>. In consideration hereof the Parties enter into this DPA.<\/p><p>\u00a0<\/p><p>1.3 This DPA, as attached as an appendix to the Main Agreement or as published on the Data Processor\u2019s website, is incorporated by reference into, and forms a binding integral part of, the Main Agreement concluded between the Parties.<\/p><p>\u00a0<\/p><p>1.4 The Parties agree that this DPA outlines their respective obligations concerning to Processing of Personal Data in connection with the Data Processor\u2019s provision of the service to the Data Controller. In case of any conflicting terms between the Main Agreement and this DPA, this DPA shall prevail. The Data Processor may update and amend this DPA in accordance with the Data Processor\u2019s from time-to-time applicable routines.<\/p><p><span style=\"color: inherit; font-family: inherit; font-size: 1.25rem;\">\u00a0<\/span><\/p><h5><strong>2 DEFINITIONS<\/strong><\/h5><p>In this DPA, capitalized terms shall have the same meaning ascribed to them under the GDPR. In addition, the following capitalized terms shall have the meanings ascribed to them below, and references to the singular shall include the plural and vice versa.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1e840cd elementor-widget elementor-widget-spacer\" data-id=\"1e840cd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-f592431 e-flex e-con-boxed e-con e-parent\" data-id=\"f592431\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fef5bd4 elementor-widget elementor-widget-html\" data-id=\"fef5bd4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<table style=\"width:100%; border-collapse: collapse; font-family: 'Ubuntu', sans-serif; color:#40505E;\">\n  <tr>\n    <td style=\"width:25%; border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>\u201dAdequacy Decision\u201d<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      means a decision adopted by the European Commission that a certain country outside the EU\/EEA, a territory or one och more specified sectors within that country ensures an adequate level of protection.\n    <\/td>\n  <\/tr>\n <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>\"Data Privacy Laws\"<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      means any law and regulation in force at any time concerning the Processing of Personal Data, including but not limited to the GDPR, other European Union legislation relating to the Processing of Personal Data, national legislation implemented under and in compliance with the GDPR and the decisions, advice, recommendations, and opinions of the Supervisory Authority.\n    <\/td>\n  <\/tr>\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>\"EU Model Clauses\"<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      means the Commission Implementing Decision (EU) 2021\/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016\/679 of the European Parliament and of the Council.\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>\"GDPR\"<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      means Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data and repealing Directive 95\/46\/EC (General Data Protection Regulation).\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>\"Sub-Processor\"<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      means a natural or legal person, public authority, agency or other body which Processes Personal Data as a subcontractor to the Data Processor on behalf of the Data Controller.\n    <\/td>\n  <\/tr>\n<\/table>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8442963 elementor-widget elementor-widget-spacer\" data-id=\"8442963\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a684030 elementor-widget__width-auto elementor-widget elementor-widget-text-editor\" data-id=\"a684030\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h5><b>3 THE RIGHTS AND OBLIGATIONS OF THE DATA CONTROLLER<\/b><\/h5><p>3.1 The Data Controller is responsible for ensuring that the Processing of Personal Data takes place in compliance with applicable Data Privacy Laws.<\/p><p>\u00a0<\/p><p>3.2 The Data Controller has the right and obligation to make decisions about the purposes and means of the Processing of Personal Data. The Data Controller shall be responsible, among other things, for ensuring that the Processing of Personal Data, which the Data Processor is instructed to perform, has a legal basis.<\/p><p>\u00a0<\/p><p>3.3 The Data Controller shall provide clear and documented instructions to the Data Processor. Updated instructions shall be communicated using the form in <u>Appendix 1<\/u> or as otherwise agreed by the Parties.<\/p><p><b>\u00a0<\/b><\/p><h5><b>4 PROCESSING OF PERSONAL DATA<\/b><\/h5><p>4.1 The Data Processor undertakes to comply with applicable Data Privacy Laws and recommendations by the Supervisory Authority or other competent authorities.<\/p><p>\u00a0<\/p><p>4.2 The Data Processor shall Process Personal Data only on documented instructions from the Data Controller, and only to the extent necessary to fulfil its undertakings under the Main Agreement, unless required to do so by Union or Member State law <br \/>to which the Data Processor is subject. Such instructions are listed in <u>Appendix 1<\/u>.<\/p><p>\u00a0<\/p><p>4.3 The Data Processor shall be entitled to de-identify by anonymisation any test results processed under this DPA and\/or data generated through the Data Subject\u2019s use of the service, to the extent such data constitutes Personal Data, provided that such de\u0002identification ensures that the data cannot, directly or indirectly, be attributed to an identified or identifiable natural person. Once de-identified, the Data Processor may use the resulting data set for statistical, analytical, research, and product or service development purposes, as well as for the improvement of its business operations. The Data Processor\u2019s use of such de-identified data shall not constitute Processing of Personal Data under this DPA.<\/p><p>\u00a0<\/p><p>4.4 The Data Processor shall inform the Data Controller if the Data Processor lacks an instruction on how to Process Personal Data in a particular situation or if it believes an instruction provided under this DPA contravene applicable Data Privacy Laws.<\/p><p>\u00a0<\/p><p>4.5 If the Data Processor Processes Personal Data in addition to or in violation of the Data Controller\u2019s instructions, due to being required to do so by Union or Member State law to which the Data Processor is subject, the Data Processor shall inform the Data Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.<\/p><p>\u00a0<\/p><p>4.6 If Data Subjects, Supervisory Authorities, or any other third parties request information from the Data Processor regarding the Processing of Personal Data covered by this DPA, the Data Processor shall refer such request to the Data Controller as soon as possible after receipt of such request. Taking into account the nature of the Processing, the Data Processor shall assist the Data Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligations to respond to requests from Supervisory Authorities and Data Subjects to exercise their rights under Chapter III of the GDPR.<\/p><p>\u00a0<\/p><p>4.7 The Data Processor shall, upon the Data Controller\u2019s reasonable request, assist the Data Controller with carrying out Data Protection Impact Assessment(s) where required under applicable Data Privacy Laws, taking into account the nature of the Processing and the information available to the Data Processor.<\/p><p>\u00a0<\/p><p>4.8 Upon the Data Controller\u2019s request, the Data Processor shall assist the Data Controller with carrying out prior consultations with the Supervisory Authority, where such consultations are required under applicable Data Privacy Laws, taking into account the nature of the Processing and the information available to the Data Processor.<\/p><p><b>\u00a0<\/b><\/p><h5><b>5 CONFIDENTIALITY<br \/><\/b><\/h5><p>5.1 The Data Processor undertakes not to disclose or reveal the Personal Data or other\u00a0<span style=\"font-size: 1rem;\">information received by the Data Processor as a result of this DPA, to third parties\u00a0<\/span><span style=\"font-size: 1rem;\">other than Sub-Processors that have been engaged in accordance with this DPA.<\/span><\/p><p><span style=\"font-size: 1rem;\">\u00a0<\/span><\/p><p>5.2 The Data Processor shall only grant access to the Personal Data being Processed on behalf of the Data Controller to persons that directly require access to Personal Data in order to fulfil the Data Processor\u2019s obligations in accordance with this DPA. The Data Processor shall ensure that such personnel are bound by a confidentiality obligation to the same extent as the Data Processor in accordance with this DPA and that they are informed how they may process the Personal Data.<\/p><p>\u00a0<\/p><p>5.3 The obligations set out in this section 5 do not include information disclosed in accordance with the instructions of the Data Controller or that the Data Processor is required to disclose pursuant to law, enactment, court\u2019s or other governmental authority&#8217;s decision or stock exchange regulation. The Data Processor shall promptly and in writing notify the Data Controller if the Data Processor is required to disclose such information.<\/p><p><b>\u00a0<\/b><\/p><h5><b>6 PERSONAL DATA BREACHES <br \/><\/b><\/h5><p>6.1 Taking into account the nature of the Processing and the information available to the Data Processor, the Data Processor shall assist the Data Controller in fulfilling the Data Controller\u2019s obligations under Articles 33 and 34 of the GDPR.<\/p><p>\u00a0<\/p><p>6.2 The Data Processor shall without undue delay (and in no case later than forty-eight (48) hours) upon becoming aware of a Personal Data Breach notify the Data Controller in writing thereof. Such notification shall include information on at least the following matters, taking into account the nature of the Processing and the information available to the Data Processor:<\/p><p>\u00a0<\/p><p>I. the nature of the Personal Data including, where possible, the categories and approximate number of Data Subjects concerned, and the categories and approximate number of Personal Data records concerned;<\/p><p>\u00a0<\/p><p>II. the likely consequences of the Personal Data Breach;<\/p><p>\u00a0<\/p><p>III. the measures taken or proposed to be taken by the by Data Processor, to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.<\/p><p>\u00a0<\/p><p>6.3 Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.<\/p><p>\u00a0<\/p><p>6.4 The Data Processor shall thereafter implement all such measures as soon as possible and provide any and all reasonable cooperation requested by the Data Controller.<\/p><p><b>\u00a0<\/b><\/p><h5><b>7 SUB-PROCESSORS<br \/><\/b><\/h5><p>7.1 The Data Processor is given a general authorisation to engage Sub-Processors for the performance of the Data Processor\u2019s Processing of Personal Data under the DPA. The Data Processor shall notify the Data Controller in writing of the intention to engage\u00a0<span style=\"font-size: 1rem;\">new Sub-Processors, giving the Data Controller at least fourteen (14) days to object to such changes. The Data Controller gives its approval to the Data Processor\u2019s current Sub-Processors as listed in <u>Appendix 1<\/u> (to be updated in case of changes).<\/span><\/p><p>\u00a0<\/p><p>7.2 In the event the Data Processor wishes to engage a Sub-Processor that the Data Controller has objected to, each Party shall be entitled to terminate the Main Agreement and this DPA, unless a suitable work around is identified.<\/p><p>\u00a0<\/p><p>7.3 The Data Processor shall ensure that all Sub-Processors are bound by written agreements that require them to comply with corresponding data Processing obligations to those contained in this DPA and that meet the requirements of Article 28(3) of the GDPR.<\/p><p>\u00a0<\/p><p>7.4 If the Sub-Processor fails to perform its obligations, the Data Processor shall be fully liable to the Data Controller for the due performance of the Sub-Processor\u2019s obligations.<\/p><p><b>\u00a0<\/b><\/p><h5><b>8 TECHNICAL AND ORGANISATIONAL MEASURES <br \/><\/b><\/h5><p>8.1 The Data Processor has implemented and, during the term of this DPA, will continue to implement and maintain appropriate technical and organizational measures to ensure that the Data Processor\u2019s Processing of the Personal Data under this DPA meets the requirements of the Data Privacy Laws (such as Article 32 of the GDPR) and ensures that the rights of Data Subjects can be upheld. The measures implemented by the Data Processor shall provide a level of security appropriate to the risk, taking into account the art technology, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.<\/p><p>\u00a0<\/p><p>8.2 The security measures agreed between the Parties are set out in <u>Appendix 1<\/u>.<\/p><p>\u00a0<\/p><p>8.3 Furthermore, the Data Processor shall assist the Data Controller in ensuring compliance with the Data Controller\u2019s obligations pursuant to Article 32 of the GDPR.<\/p><p><b>\u00a0<\/b><\/p><h5><b>9 DATA LOCALISATION <br \/><\/b><\/h5><p>9.1 The Data Processor may not, without the prior written consent of the Data Controller, transfer Personal Data outside the EU\/EEA. If the Data Controller approves of the transfer, the Parties shall ensure that there is a valid transfer mechanism in place (including additional safeguards, if necessary), before the transfer commence.<\/p><p>\u00a0<\/p><p>9.2 If, subject to the approval of the Data Controller, the Data Processor will transfer Personal Data to a third party outside the EU\/EEA, which is not subject to an applicable Adequacy Decision, the Data Processor shall enter into the applicable EU Model Clauses with the data importer \u2013 if this is identified as the most appropriate transfer mechanism.<\/p><p>\u00a0<\/p><p>9.3 The Data Controller shall, at any time, have the right to revoke its consent to third\u00a0country transfers in accordance with sections 9.1 &#8211; 9.2. In such event, the Data Processor shall immediately cease with transfer and shall, at the request of the Data Controller, provide written confirmation that the transfer has ceased.<\/p><p>\u00a0<\/p><p>9.4 If the Data Controller does not approve of the transfer or revokes its consent to third country transfers in accordance with this section 9, the Data Processor shall be entitled to terminate the Main Agreement and this DPA, unless a suitable work around is identified.<\/p><p><b>\u00a0<\/b><\/p><h5><b>10 AUDIT AND INSPECTION <br \/><\/b><\/h5><p>10.1 Upon the Data Controller\u2019s request, the Data Processor shall make available to the Data Controller all information necessary to demonstrate compliance with this DPA and applicable Data Privacy Laws.<\/p><p>\u00a0<\/p><p>10.2 The Data Controller may request audit of the Data Processor\u2019s Processing of Personal Data one (1) time per calendar year \u2013 unless the previous audit identified deviations from this DPA or applicable Data Privacy Laws. If so, the Data Controller may request additional audits until such deviations have been managed and the Data Processor provides sufficient evidence that it is in full compliance with this DPA and applicable Data Privacy Laws.<\/p><p>\u00a0<\/p><p>10.3 The Data Processor will, during normal business hours and upon reasonable notice (whereby a notice period of twenty (20) business days shall always be deemed reasonable), provide to the Data Controller\u2019s personnel or its hired consultants, its internal or external auditors, inspectors, and regulators reasonable access to data and records (including tools and procedures) relating to the Processing covered by this DPA. The Data Controller\u2019s auditors and other representatives shall comply with the Data Processor\u2019s reasonable work rules, security requirements and standards when conducting site visits.<\/p><p>\u00a0<\/p><p>10.4 The Data Controller shall reimburse the Data Processor for any costs incurred by the Data Processor during an audit performed at the request of the Data Controller, unless a deficiency is found.<\/p><p><b>\u00a0<\/b><\/p><h5><b>11 COMPENSATION<br \/><\/b><\/h5><p>The Data Processor shall be entitled to reasonable compensation for all work carried out and all costs incurred by the Data Processor due to the Data Controller issuing instructions that go beyond the functions and levels of protection necessary in relation to the services that the Data Processor normally offers its customers, e.g., if the Data Controller requires the Data Processor to make changes in its systems, or if the Data Processor for any other reason is forced to make special adjustments for the Data Controller.<\/p><p><b>\u00a0<\/b><\/p><h5><b>12 LIABILITY <br \/><\/b><\/h5><p>12.1 Breaches of this DPA shall be treated as breaches of the Main Agreement. Any limitation of liability in the Main Agreement shall apply.<\/p><p>\u00a0<\/p><p>12.2 Each Party shall be liable for its own breaches of applicable Data Privacy Laws and shall indemnify the other Party accordingly in case the other Party suffers damage following such breach. For the avoidance of doubt, the Parties shall be liable for administrative fines in relation to their acts and omissions imposing the fine.<\/p><p><b>\u00a0<\/b><\/p><h5><b>13 DELETION AND RETURN OF DATA<br \/><\/b><\/h5><p>Upon expiry of this DPA, the Data Processor shall, at the choice of the Data Controller, delete or return all Personal Data to the Data Controller and shall ensure that any Sub-Processor does the same, unless it is required to keep copies of the data under Union or Member State law to which the Data Processor is subject.<\/p><p><b>\u00a0<\/b><\/p><h5><b>14 TERM<br \/><\/b><\/h5><p>This DPA shall take effect as of the date of the Parties\u2019 conclusion of the Main Agreement and remain effective as long as the Data Processor Processes Personal Data on behalf of the Data Controller, unless terminated in accordance with the Main Agreement and\/or this DPA.<\/p><p><b>\u00a0<\/b><\/p><h5><b>15 APPLICABLE LAW AND DISPUTES <br \/><\/b><\/h5><p>This DPA shall be governed by the laws of Sweden. Any dispute shall be processed in accordance with the Main Agreement.<\/p><p><b>\u00a0<\/b><\/p><h5><b>APPENDIX 1 &#8211; INSTRUCTION REGARDING PROCESSING<br \/><\/b><\/h5><p>This <u>Appendix 1<\/u> specifies the Processing of Personal Data carried out by the Data Processor on behalf of the Data Controller under the DPA. The purpose is to clarify the Processing and Personal Data that is covered by the Main Agreement and to comply with the GDPR&#8217;s requirements.<\/p><p><b>\u00a0<\/b><\/p><h5><b>1 DETAILS OF PROCESSING<\/b><\/h5>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-7bcc966 e-flex e-con-boxed e-con e-parent\" data-id=\"7bcc966\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2f61cd3 elementor-widget elementor-widget-html\" data-id=\"2f61cd3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<table style=\"width:100%; border-collapse: collapse; font-family: 'Ubuntu', sans-serif; color:#40505E;\">\n  <tr>\n    <td style=\"width:25%; border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>Service<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      Tenstar Management Tool (TMT)\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>Purpose of the Processing and Processing activities<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      The Personal Data is processed for the purpose of providing the service and learning tool, which allows the teacher\/admin to easily manage user accounts and settings for the simulator, accessing exercise results, scoring reports and statistics, as well as giving feedback to users.\n      <br><br>\n      To achieve the purpose the Data Processor will perform the following activities with the data:\n      <br><br>\n      \u2612 Storage<br>\n      \u2612 Administration<br>\n      \u2612 Access in connection with support<br>\n      \u2612 Anonymisation\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>Categories of Personal Data<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      <ul style=\"margin:0 0 0 18px; padding:0;\">\n        <li>First and last name<\/li>\n        <li>Email address (which is also the user\u2019s username)<\/li>\n        <li>Password for user accounts<\/li>\n        <li>Exercise result reports<\/li>\n        <li>Scoring reports<\/li>\n        <li>Exercise replay data<\/li>\n        <li>Other Personal Data contained in feedback (if provided by the Data Subject)<\/li>\n      <\/ul>\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>Sensitive Personal Data \u2013 if any<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      N\/A.\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>Categories of Data Subjects<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      Users and administrators, including teachers and students.\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>Location<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      Personal Data is stored locally on the simulator and synchronised with Microsoft-provided cloud storage, see list of Sub-Processors.\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\"><strong>Duration of Processing and erasure procedures<\/strong><\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top; word-break: break-word;\">\n      During the term of this DPA. However, [xx] will be deleted every 30 days in accordance with the Data Processor\u2019s backup routines.\n    <\/td>\n  <\/tr>\n<\/table>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-64e8dc6 elementor-widget elementor-widget-spacer\" data-id=\"64e8dc6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-95eefe3 e-flex e-con-boxed e-con e-parent\" data-id=\"95eefe3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-640d9ee elementor-widget__width-auto elementor-widget elementor-widget-text-editor\" data-id=\"640d9ee\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h5><b>2 TECHNICAL AND ORGANIZATIONAL MEASURES<\/b><\/h5><p>The following instructions on technical and organizational measures are supplementary instructions to what is otherwise stated in the DPA and the follows from applicable Data Privacy Laws. These instructions are not in any way intended to limit the Data Processor\u2019s responsibilities and obligations under the applicable Data Privacy Laws. All Personal Data collected and Processed by the Data Processor is protected by access control, data security in transit and at rest, and data redundancy.<\/p><p>\u00a0<\/p><p>2.1 Access control <br \/>Users access TMT Online by logging in to their accounts with a username and password. Different access levels are used to protect user data. Multi-factor authentication (MFA) is available and encouraged for all users and password reset is handled securely. User data in the cloud can be accessed by a limited number of authorised personnel at Tenstar. The Data Processor authorise as few people as necessary to access this data. Strong passwords are enforced for all Tenstar employees. MFA is strongly encouraged for all users.<\/p><p>\u00a0<\/p><p>2.2 Data in transit <br \/>All traffic between the Data Processor\u2019s simulators and cloud storage is protected by SSL encryption.<\/p><p>\u00a0<\/p><p>2.3 Data at rest <br \/>All cloud data is kept in data centres located in Sweden and encrypted with 256-bit encryption. Local simulator data is stored physically on the simulator unit.<\/p><p>\u00a0<\/p><p>2.4 Data redundancy <br \/>All data is protected with geographically redundant backups.<\/p><p>\u00a0<\/p><h5><b>3 LIST OF SUB-PROCESSORS APPROVED BY DATA CONTROLLER<\/b><\/h5>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-55ec95c e-flex e-con-boxed e-con e-parent\" data-id=\"55ec95c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-06f706f elementor-widget elementor-widget-html\" data-id=\"06f706f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<table style=\"width:100%; border-collapse: collapse; font-family: 'Ubuntu', sans-serif; color:#40505E;\">\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; font-weight:600;\">\n      Name and\/or reg. no\n    <\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; font-weight:600;\">\n      Location of Processing\n    <\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; font-weight:600;\">\n      Types of Processing\n    <\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; font-weight:600;\">\n      Transfer mechanism for third country transfers\n    <\/td>\n  <\/tr>\n\n  <tr>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\">\n      Microsoft Azure\n    <\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\">\n      EU (Sweden)\n    <\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\">\n      Storage\n    <\/td>\n    <td style=\"border:1px solid #40505E; padding:10px; vertical-align: top;\">\n      N\/A\n    <\/td>\n  <\/tr>\n<\/table>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a9db6ff elementor-widget elementor-widget-spacer\" data-id=\"a9db6ff\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d4483da elementor-widget elementor-widget-text-editor\" data-id=\"d4483da\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em>Version: 1.0 (2025-12-09)<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Data Processing Agreement This Data Processing Agreement (the \u201cDPA\u201d) is made between Tenstar Simulation AB, registration no. 556786-5570, a company organized under the laws of Sweden, with its registered address at Storemyrsv\u00e4gen 2, 457 31 Tanumshede (the \u201cData Processor\u201d); and the Customer, as defined in the Main Agreement (the \u201cData Controller\u201d). \u00a0 The parties listed [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-17610","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/tenstarsimulation.com\/de\/wp-json\/wp\/v2\/pages\/17610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tenstarsimulation.com\/de\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/tenstarsimulation.com\/de\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/tenstarsimulation.com\/de\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/tenstarsimulation.com\/de\/wp-json\/wp\/v2\/comments?post=17610"}],"version-history":[{"count":70,"href":"https:\/\/tenstarsimulation.com\/de\/wp-json\/wp\/v2\/pages\/17610\/revisions"}],"predecessor-version":[{"id":17682,"href":"https:\/\/tenstarsimulation.com\/de\/wp-json\/wp\/v2\/pages\/17610\/revisions\/17682"}],"wp:attachment":[{"href":"https:\/\/tenstarsimulation.com\/de\/wp-json\/wp\/v2\/media?parent=17610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}