Data Processing Agreement

1. The parties and conclusion of the agreement

This data processing agreement ("the Clauses") is entered into between

The controller: the company or organisation that has created an account with GoalCube and accepted GoalCube's terms and conditions ("the customer"),

and

The processor: Goalcube ApS, company registration (CVR) no. 44709805, Ahlmannsvej 19, st., 6400 Sønderborg, Danmark ("GoalCube").

The Clauses form part of GoalCube's terms and conditions and are concluded automatically when the customer creates an account or starts using GoalCube. No signature is required. The Clauses are based on the standard contract for data processing agreements of the Danish Data Protection Agency (Datatilsynet) (standard contractual clauses pursuant to Article 28(8) of Regulation (EU) 2016/679, "GDPR"). Where the standard contract offers options, the choices have been filled in in the Annexes.

2. Preamble

1. The Clauses set out the rights and obligations of the processor when processing personal data on behalf of the controller.
2. The Clauses have been designed with a view to the parties' compliance with Article 28(3) GDPR.
3. The processing takes place in connection with the provision of GoalCube (GoalCube AI Map, GoalCube Data Vault and GoalCube Human Decision) under the terms and conditions.
4. The Clauses take priority over any similar provisions contained in other agreements between the parties.
5. Four Annexes are attached to the Clauses and form an integral part of the Clauses:
   • Annex A contains details about the processing, including its purpose and nature, the type of personal data, the categories of data subjects and the duration.
   • Annex B contains the controller's conditions for the processor's use of sub-processors and a list of approved sub-processors.
   • Annex C contains the controller's instructions for the processing, the minimum security requirements and how the processor and sub-processors are supervised.
   • Annex D contains the parties' provisions on other matters.
6. The Clauses and the associated Annexes are retained electronically on goalcube.eu by both parties.
7. The Clauses do not exempt the processor from obligations to which the processor is subject under the GDPR or other legislation.

3. Rights and obligations of the controller

1. The controller is responsible for ensuring that the processing of personal data takes place in accordance with the GDPR (see Article 24), the data protection provisions of other Union law or the national law of the Member States, and the Clauses.
2. The controller has the right and obligation to make decisions about the purposes and means of the processing of personal data.
3. The controller is responsible for ensuring that there is a legal basis for the processing that the processor is instructed to carry out – including for the data the customer uploads and for the customer's use of AI services.
4. The controller chooses, and itself enters into an agreement with, the AI service the customer connects to GoalCube (for example ChatGPT, Claude, Microsoft 365 Copilot or Mistral). The AI service is not a sub-processor of GoalCube, and the processing there is covered by the customer's own agreement with the AI provider.

4. The processor acts according to instructions

1. The processor may process personal data only on documented instructions from the controller, unless required to do so by Union law or the national law of the Member States to which the processor is subject. The instructions are described in Annexes A and C. The customer's use of the features in GoalCube – for example uploads, the choice of protection per column, secret terms, confirmations and decisions – also constitutes documented instructions.
2. The processor shall immediately inform the controller if, in the processor's opinion, an instruction infringes the GDPR or the data protection provisions of other Union law or the national law of the Member States.

5. Confidentiality

1. The processor may only grant access to personal data to persons under the processor's authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only to the extent necessary. The list of persons with access is reviewed on an ongoing basis, and access is withdrawn when it is no longer necessary.
2. At the request of the controller, the processor shall be able to demonstrate that the persons concerned are subject to the above obligation of confidentiality.

6. Security of processing

1. The processor implements appropriate technical and organisational measures in accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks to the rights and freedoms of natural persons.
2. The processor independently assesses the risks and implements measures to mitigate them. The measures are described in Annex C.2.
3. The processor assists the controller in meeting the controller's obligation under Article 32 GDPR, among other things by making available the information necessary for the controller's own risk assessment.

7. Use of sub-processors

1. The processor shall meet the conditions set out in Article 28(2) and (4) GDPR in order to engage another processor (a sub-processor).
2. The processor has the controller's general authorisation to engage sub-processors. The processor shall inform the controller in writing of any intended changes concerning the addition or replacement of sub-processors at least 14 days in advance. Notification is given by email to the account's contact person and at goalcube.eu/da/databehandleraftale/ (also at goalcube.eu/en/data-processing-agreement/). The controller may object within the notice period. If the controller objects and the parties cannot find a solution, the controller may terminate the agreement with effect before the change takes effect. The list of approved sub-processors is set out in Annex B.
3. The processor imposes on the sub-processor, by way of a contract, the same data protection obligations as those set out in the Clauses, in particular sufficient assurances of appropriate technical and organisational measures.
4. The processor ensures that the sub-processor's agreement gives the controller the right, as a third-party beneficiary, to assert its rights against the sub-processor in the event of the processor's bankruptcy, to the extent the sub-processor's standard terms allow this.
5. If the sub-processor fails to fulfil its data protection obligations, the processor remains fully liable to the controller for the performance of the sub-processor's obligations, subject, however, to the limitation of liability in Annex D.

8. Transfer of data to third countries or international organisations

1. The processor may only transfer personal data to third countries (countries outside the EU/EEA) or international organisations on documented instructions from the controller and in accordance with Chapter V GDPR.
2. The instructions on transfers are set out in Annex C.6. Within the framework of the Clauses, the controller cannot instruct the processor to carry out other transfers.
3. When the customer itself connects an AI service to GoalCube and asks it to retrieve data, GoalCube discloses only pseudonymised data to the AI service, on the customer's instructions. Any transfer to a third country within the AI service takes place under the customer's own agreement with the AI provider, cf. clause 3.4.

9. Assistance to the controller

1. Taking into account the nature of the processing, the processor shall, as far as possible, assist the controller by appropriate technical and organisational measures in fulfilling the controller's obligation to respond to requests for exercising the data subjects' rights under Chapter III GDPR (information, access, rectification, erasure, restriction, data portability, objection and automated individual decision-making). The assistance is provided primarily through the features in GoalCube, cf. Annex C.3.
2. In addition, the processor assists the controller with:
   • notifying personal data breaches to the supervisory authority without undue delay and, where feasible, not later than 72 hours after the controller has become aware of the breach, unless the breach is unlikely to result in a risk to the rights of natural persons,
   • communicating breaches to the data subjects when the breach is likely to result in a high risk to their rights,
   • carrying out data protection impact assessments (DPIA) and any prior consultations with the supervisory authority.
3. Assistance beyond the features in GoalCube and the information GoalCube publishes is charged in accordance with Annex D.

10. Notification of personal data breach

1. The processor notifies the controller without undue delay after becoming aware that a personal data breach has occurred at the processor or a sub-processor.
2. Where possible, the notification is made no later than 48 hours after the processor has become aware of the breach, so that the controller can meet its 72-hour deadline.
3. The notification contains, to the extent the information is available: a description of the nature of the breach, including the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Where it is not possible to provide the information at the same time, it is provided in phases without undue delay.

11. Erasure and return of data

1. On termination of the personal data processing services, the processor is obliged to erase all personal data processed on behalf of the controller and to confirm to the controller that the data has been erased. Erasure takes place no later than 30 days after termination, cf. Annex C.4.
2. Before termination, the controller can itself view data, download reports and save documentation from GoalCube (for example the report for supervisory authorities and auditors) for as long as the account is active.
3. The processor may not retain the personal data any longer unless Union law or national law requires it.

12. Audit, including inspection

1. The processor makes available to the controller all information necessary to demonstrate compliance with Article 28 GDPR and the Clauses, and allows for and contributes to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
2. The procedures for the controller's audits of the processor and sub-processors are set out in Annexes C.7 and C.8.
3. The processor gives supervisory authorities which, under applicable legislation, have access to the facilities of the controller and the processor access upon presentation of appropriate identification.

13. The parties' agreement on other matters

1. The parties may agree other clauses concerning the service, for example on liability, as long as they do not directly or indirectly contradict the Clauses or prejudice the fundamental rights of the data subject. They are set out in Annex D and the terms and conditions.

14. Commencement and termination

1. The Clauses take effect when the customer creates an account or starts using GoalCube.
2. Both parties may require the Clauses to be renegotiated if changes to the law or inexpediencies in the Clauses give rise to this. GoalCube may amend the Clauses with at least 14 days' notice if the amendment does not reduce the protection of personal data; otherwise the customer's acceptance is required.
3. The Clauses apply for as long as the personal data processing service lasts and cannot be terminated unless the main agreement (the terms and conditions) is terminated at the same time.
4. If the provision of the services ends and the personal data has been erased in accordance with clause 11, the Clauses may be terminated by either party.

15. Contact persons

1. The processor's contact: contact@goalcube.eu.
2. The controller's contact: the account's contact person. The customer keeps the contact details up to date in GoalCube.

Annex A – Information about the processing

A.1. The purpose of the processor's processing of personal data on behalf of the controller: To provide GoalCube: an inventory of the customer's use of AI with classification under the AI Act, an AI policy and a course in AI literacy (AI Map); to store the customer's data in the EU and disclose it in pseudonymised form to the AI service the customer has connected, and to display responses with the real values at GoalCube (Data Vault); and to let a human decide cases about individuals, with a log and timestamps (Human Decision).

A.2. The processor's processing of personal data on behalf of the controller mainly concerns (the nature of the processing): Storage, structuring, pseudonymisation (replacing identifiers with codes), generalisation (for example date of birth to age group), disclosure of pseudonymised data to the customer's AI service on the customer's instructions, translation of codes back into real values at GoalCube, logging of actions and decisions, sending of emails from the system, and erasure.

A.3. The processing includes the following types of personal data about the data subjects: The data the customer itself uploads or enters in GoalCube, for example name, contact details, ID numbers (including Danish civil registration (CPR) numbers), customer and account numbers, addresses, employment data, CVs, customer enquiries, contracts and decisions. Depending on the customer's data, this may include special categories of personal data (Article 9 GDPR) and personal data relating to criminal convictions and offences (Article 10 GDPR). In addition, data about the customer's users: name, email address, role, passkeys and actions in the system.

A.4. The processing includes the following categories of data subjects: The customer's employees, applicants, customers, members, suppliers and their contact persons, and other persons whom the customer's data concerns, as well as the customer's users of GoalCube.

A.5. The processor's processing of personal data on behalf of the controller may begin when the Clauses take effect. The processing has the following duration: For as long as the customer has an account with GoalCube, and until the data has been erased in accordance with clause 11 and Annex C.4.

Annex B – Sub-processors

B.1. Approved sub-processors When the Clauses take effect, the controller has approved the use of the following sub-processors:

B.2. Notice for the approval of sub-processors The processor gives notice of the addition or replacement of sub-processors at least 14 days in advance, cf. clause 7.2.

Services without personal data. The system also uses these services, which do not receive personal data and are therefore not sub-processors:

Annex C – Instructions on the processing of personal data

C.1. The subject matter of the processing/instructions The processor's processing is carried out by GoalCube storing the customer's data in the EU, pseudonymising it according to the choices the customer makes (for example protection per column and secret terms), disclosing it in pseudonymised form to the AI service the customer has connected when the customer or a user requests it, displaying the AI's responses with the real values at GoalCube, and logging confirmations and decisions. GoalCube does not use the customer's data for other purposes, does not sell it and does not use it to train AI models.

C.2. Security of processing The level of security reflects that the processing may include special categories of personal data and data relating to employment. The processor has implemented the following measures:

• Data is encrypted in transit (HTTPS/TLS).
• Customer data is stored in the EU with Clever Cloud. In production, the system will not start without persistent storage in the EU.
• AI services the customer connects receive only pseudonyms – never names, emails, ID, phone or account numbers, addresses or the customer's secret terms.
• Uploaded files are not stored; only the extracted text that the customer has chosen to save as a dataset.
• Decisions, confirmations and changes are recorded in an audit log with checksums (hash chain) and independent timestamps.
• Secret terms are never stored in the audit log.
• The pages load no files from third parties (e.g. fonts from Google), and the system sets no tracking cookies.
• Emails to GoalCube that need a human reply are read and answered in GoalCube. The staff member only gets a notification, without the content, in their own inbox.
• Access keys are not written to the server log.
• Only GoalCube staff who need it have access to operations and data, and they are bound by confidentiality.

On every change to the system, GoalCube's compliance check verifies that the code maintains the measures and lists set out in this agreement.

C.3. Assistance to the controller The processor assists the controller under clauses 9.1 and 9.2 as follows:

• In GoalCube, the customer can itself view its data and the real values behind each pseudonym, delete uploaded datasets, remove secret terms and download the report for supervisory authorities and auditors.
• The audit log and the history (for example decisions, reports and removed secret terms) cannot be changed or deleted entry by entry, because they must be able to prove what has happened. They are deleted when the agreement ends. If anything needs to be deleted earlier, for example following a request from a data subject, this is done by agreement with GoalCube.
• Requests that the customer cannot resolve itself in the system are sent to contact@goalcube.eu, and GoalCube responds without undue delay.
• In the event of a personal data breach, GoalCube provides the information referred to in clause 10.3.

C.4. Storage period/erasure procedure

• The customer's data is stored until the customer deletes it or the agreement ends.
• When the customer deletes an uploaded dataset in GoalCube, the dataset is deleted immediately. Reports made on the dataset contain only pseudonyms and are kept as part of the history until the agreement ends.
• Uploaded files (for example PDF and Word) are not stored; only the text the customer chooses to save as a dataset is stored.
• The history and the audit log are kept for as long as the agreement runs, cf. C.3.
• When the agreement ends, all of the customer's data, including the audit log, is deleted no later than 30 days after termination, unless legislation requires it to be retained. Copies in the hosting provider's backups are deleted when the backups expire at the provider.
• Emails that the customer or the customer's users send to GoalCube's support are not covered by the deadline above. They are deleted automatically 24 months after receipt – or earlier if the customer requests it.

C.5. Location of processing Processing of the personal data covered by the Clauses may not, without the controller's prior written authorisation, take place at locations other than: Clever Cloud SAS, Paris region (Clever Cloud zone "par"), France and at the sub-processors in Annex B at the locations stated there.

C.6. Instructions on the transfer of personal data to third countries The processor does not transfer the customer's personal data to third countries, with this one exception: if the customer or the customer's users send an email to GoalCube, the email may contain personal data. Before GoalCube's mail assistant writes a draft reply, GoalCube automatically replaces, in the EU, names, email addresses, phone, ID and account numbers and company names with codes. Names in free text are detected using name lists and patterns, so a rare name may exceptionally slip through. Only the pseudonymised text is sent to Anthropic in the USA on the basis of the EU standard contractual clauses. Enquiries about legal matters, complaints, payment and rights are answered by a human.

Transfers that take place because the customer itself asks its AI service to retrieve data from GoalCube take place on the customer's instructions and under the customer's own agreement with the AI provider, cf. clause 8.3.

If the controller does not, in the Clauses or subsequently, provide documented instructions on the transfer of personal data to a third country, the processor is not entitled to carry out such transfers within the framework of the Clauses.

C.7. Procedures for the controller's audits, including inspections, of the processing of personal data entrusted to the processor At the controller's request, and no more than once a year, the processor prepares a written statement on compliance with the Clauses (self-assessment). In addition, the controller may, at its own expense, carry out an inspection or have an independent auditor carry one out if there is a specific reason to do so, with at least 30 days' notice and no more than once a year. The inspection is organised so that it does not give access to other customers' data. The processor's time spent is charged in accordance with Annex D.

C.8. Procedures for audits, including inspections, of the processing of personal data entrusted to sub-processors At least once a year, the processor reviews the sub-processors' own documentation of security of processing (for example certifications, audit reports, data processing agreements and lists of sub-processors) and assesses whether they continue to fulfil their obligations. The result is included in the statement under C.7.

Annex D – The parties' provisions on other matters

1. Liability. The parties' liability under the Clauses is subject to the limitation of liability in the terms and conditions, to the extent this is compatible with Articles 82 and 83 GDPR.
2. Payment for assistance. Assistance that can be provided through the features in GoalCube, and notification of breaches, are free of charge. Other assistance under clause 9 and audits under clause 12 are charged for the time spent at GoalCube's current hourly rate, which is stated in advance.
3. Order of precedence. In the event of conflict, the Clauses take precedence over the terms and conditions as regards the processing of personal data.
4. Governing law and venue follow the terms and conditions.

See also: Privacy policy · Terms and conditions · Cookie policy