Data Processing Agreement
How we process and protect your data in compliance with GDPR
Agreement Parties
Data Controller
The customer using the Ordne platform
Data Processor
Langlie AS (organization number 928 755 045)
A Norwegian-based company and legal entity behind https://ordne.io
1. Subject of the Agreement
This Agreement governs the processing of personal data on behalf of the Data Controller by the Data Processor in accordance with Article 28 of the General Data Protection Regulation (EU 2016/679).
2. Purpose of the Processing
The Data Processor processes personal data solely for the purpose of providing the Ordne platform - a SaaS solution for mapping and managing digital architecture, compliance, and risk.
3. Nature and Scope of Processing
The processing includes:
- Collecting and storing user-provided data
- Structuring system and process metadata
- Mapping roles, relationships, and compliance information
- Handling authentication, billing, and analytics
- Maintaining platform functionality and security
4. Categories of Data Subjects
- Employees or users from the Data Controller's organization
- Role owners and contributors identified in the system
5. Types of Personal Data
- Name
- Email address
- Organizational role
- Preferences and communication settings
- Compliance responsibility data (e.g., DPO status)
- Usage analytics and metadata (with consent)
- Device and browser information for analytics
- Payment metadata (via Stripe)
6. Duration
Processing continues for the duration of the contractual relationship between the parties. Upon termination, all personal data will be deleted or returned to the Data Controller upon request.
7. Sub-processors
The Data Processor uses the following sub-processors, all of which process data within the European Union (EU) or European Economic Area (EEA):
| Sub-processor | Purpose | Location / Compliance |
|---|---|---|
| Vercel | Hosting and performance management | EU – GDPR compliant |
| Clerk | Authentication and user management | EU – GDPR compliant |
| Stripe | Payment processing | EU – GDPR compliant |
| Neon | Database hosting | EU – GDPR compliant |
| PostHog | Product analytics (consent-based) | EU-hosted, GDPR compliant |
Each sub-processor provides GDPR-compliant data processing agreements.
The Data Processor shall inform the Data Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Data Controller the opportunity to object within a reasonable time.
8. Obligations of the Data Processor
The Data Processor shall:
- Process data only on documented instructions from the Data Controller
- Ensure that all personnel are bound by confidentiality
- Implement appropriate technical and organizational security measures
- Assist the Data Controller in fulfilling data subject rights
- Notify the Data Controller of any data breaches without undue delay (within 72 hours)
- Provide necessary information and allow audits upon request
9. Deletion and Return of Data
At the end of the service, all personal data shall be deleted or returned to the Data Controller unless legal obligations require retention. Automated deletion mechanisms ensure that user and organization data are securely removed, including related dependencies and backups.
10. International Data Transfers
All processing and storage of personal data occur within the European Economic Area (EEA).
No transfers of personal data to countries outside the EEA take place under this Agreement.
If such transfers become necessary in the future, they will only occur under an adequate legal mechanism in accordance with Chapter V of the GDPR, and the Data Controller will be notified in advance.
11. Technical and Organizational Measures (TOMs)
Langlie AS implements comprehensive Technical and Organizational Measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures demonstrate the company's commitment to safeguarding personal data processed through the Ordne platform.
Access Control & Authentication
- Authentication for all users via Clerk
- Role-based access control with organization-level data isolation
- Row Level Security (RLS) enforced in PostgreSQL
- Secure session handling with caching and automatic invalidation
Data Storage & Encryption
- Encryption in transit using HTTPS/TLS 1.2+ with HSTS enforcement
- Encryption at rest for user profiles and database storage
- Secure PostgreSQL hosting on EU-based infrastructure
- Environment variables protected with strict access controls
Data Retention & Deletion
- Automated data deletion triggered by account or organization removal
- Cascade deletion ensuring complete data removal
- Retention limited to active organizations
- Secure and automated disposal of backup data
Privacy & Consent Management
- Consent-based analytics using EU-hosted PostHog instance
- Cookie consent management with user control
- Data minimization principles applied to all data collection
- All analytics data processed and stored in the EU
Infrastructure & Network Security
- Hosting within the EU/EEA under secure infrastructure
- Firewall protection and segregated network environments
- Strict HTTPS enforcement and one-year HSTS configuration
- Isolated development, staging, and production environments
Data Validation & Protection
- Comprehensive server-side input validation
- SQL injection prevention through parameterized queries
- Cross-site scripting (XSS) protection via CSP and secure headers
- Automated dependency scanning and patching
Monitoring & Incident Response
- Continuous monitoring and performance tracking
- Infrastructure-level security monitoring and rate limiting
- Detailed error logging with contextual information
Security Headers & Policies
- Strict Content Security Policy (CSP) enforcement
- Use of standard security headers
- Secure cookie configuration
- Properly configured CORS and cross-origin resource policies
Data Processing Transparency
- Support for data subject rights (access, rectification, erasure)
- Records of processing activities maintained
- Publicly available documentation (Privacy Policy and DPA)
Backup & Recovery
- Automated encrypted database backups
- Secure backup storage with access control
- Documented recovery and restoration procedures
- Secure disposal of backup and residual data
Development & Maintenance
- Enforced coding and security standards
- Automated vulnerability scanning and dependency management
- Manual code reviews for security-sensitive changes
- Comprehensive testing across all environments
These TOMs reflect Langlie AS's continuous commitment to maintaining and improving a secure, compliant, and trustworthy data processing environment for users of the Ordne platform.
12. Governing Law
This Agreement is governed by and construed in accordance with the laws of Norway. Any disputes shall be subject to the exclusive jurisdiction of the courts of Oslo, Norway.
13. Contact and Questions
For questions about this Agreement or data protection, please contact:
Langlie AS
Email: legal@ordne.io
Organization number: 928 755 045
Registered in: Norway
Last updated: 27 October 2025