1. Parties

This Data Processing Agreement ("Agreement") is entered into between:

• Processor: Actnation ApS, CVR 43734342, Havnegade 53 A 3, 1058 København K, Denmark
• Controller: The Customer — the entity subscribing to Actnation's services

This Agreement constitutes an integral part of the agreement between the parties and governs the processing of personal data carried out by the Processor on behalf of the Controller.

2. Subject Matter & Purpose

This Agreement governs Actnation's processing of personal data on behalf of the Customer to provide SaaS payroll donation and corporate giving services in compliance with the GDPR and applicable Danish data protection law.

3. Data Processing Scope

• Categories of Data: Employee names, email addresses, CPR numbers, donation details, employer details, and invoicing information.
• Data Subjects: Employees of the Customer, company representatives.
• Processing Purpose: Facilitation of payroll and/or corporate donations, tax receipt generation, invoicing, and reporting.
• Processing Duration: For the term of the subscription agreement and as required by applicable legal obligations.

4. Controller Responsibilities

The Customer, as the data controller, is responsible for:

• Ensuring that personal data is collected lawfully and that appropriate legal bases exist for each category of processing.
• Ensuring that required consents from data subjects have been obtained where applicable.
• Issuing documented instructions to the Processor regarding the processing of personal data.
• Ensuring the accuracy and relevance of personal data provided to the Processor.
• Complying with applicable data protection legislation as the data controller.

5. Processor Responsibilities

Actnation, as data processor, will:

• Process personal data only on documented instructions from the Controller.
• Implement appropriate technical and organisational security measures to protect data.
• Not engage additional sub-processors without the prior written consent of the Controller.
• Assist the Controller in fulfilling obligations under Articles 32–36 of the GDPR.
• Notify the Controller without undue delay upon becoming aware of a personal data breach.
• At the Controller's choice, delete or return all personal data upon termination of the Agreement.
• Make available to the Controller all information necessary to demonstrate compliance with this Agreement.

6. Data Transfers

Data is processed within the EU/EEA. If data is transferred outside the EU/EEA, appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission will be implemented prior to such transfer.

7. Security Measures

Actnation implements the following technical and organisational measures to protect personal data:

• Encryption of personal data in transit and at rest.
• Role-based access controls and authentication mechanisms.
• Data minimisation and pseudonymisation where applicable.
• Regular testing, assessment, and evaluation of the effectiveness of security measures.
• Procedures for regularly restoring availability of and access to personal data following incidents.

8. Data Breach Notification

In the event of a personal data breach, Actnation will notify the Controller without undue delay and within 72 hours of becoming aware of the breach, providing:

• A description of the nature of the breach including, where possible, categories and approximate number of data subjects and records concerned.
• The name and contact details of the Data Protection Officer or other contact point.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach, including measures to mitigate its adverse effects.

9. Sub-Processors

Actnation may engage sub-processors for service provision. The Controller grants general written authorisation for the engagement of sub-processors, subject to the conditions in this clause.

A current list of approved sub-processors is available upon request from support@actnation.io. Actnation will inform the Controller of any intended changes to sub-processors with reasonable notice, giving the Controller the opportunity to object.

Actnation ensures that each sub-processor is bound by data protection obligations equivalent to those in this Agreement.

9.1 Zenegy Integration

When the Controller's organisation connects to Actnation via Zenegy, the Controller authorises Actnation to receive necessary employee and payroll deduction data through Zenegy's secure API. This data transfer is initiated only after the Controller has explicitly approved the connection within Zenegy. Actnation processes data only for active employees, and no personal data is used until the individual employee has consented to participate.

10. Audit Rights

11. Data Subject Rights Assistance

Actnation will assist the Controller in responding to requests from data subjects exercising their rights under Chapter III of the GDPR (Articles 15–22), including rights of access, rectification, erasure, restriction, portability, and objection. Such assistance will be provided taking into account the nature of the processing and within a timeframe that allows the Controller to meet applicable legal deadlines.

12. Confidentiality

Actnation ensures that all personnel authorised to process personal data on behalf of the Controller are bound by appropriate confidentiality obligations, whether by contract or applicable statutory duty. Access to personal data is limited to those personnel who require it for the performance of their duties in connection with this Agreement.

13. Term & Termination

This Agreement remains in effect for as long as Actnation processes personal data on behalf of the Controller. Upon termination of the Agreement:

• Actnation will, at the Controller's election, either delete or return all personal data processed under this Agreement.
• Actnation will delete existing copies of personal data unless EU or Member State law requires continued storage.
• Actnation will confirm in writing to the Controller that deletion or return has been completed.