The short version
- The data about your customers is yours. We use it only to provide Humryk to you, on your instructions.
- We keep the data secure, and everyone at Humryk with access is bound by confidentiality.
- Our sub-processors are listed in the privacy policy, and we give 30 days' notice before adding a new one.
- We notify you within 48 hours at the latest if something goes wrong with the data, and help you answer your customers.
- When the agreement ends, you can export everything for 30 days, and we delete it within 90 days.
Contents
1. The parties
- Controller: the business that has an agreement to use Humryk («you»).
- Processor: Key-Tech AS, organisation number 932 472 112, Hans Tanks gate 19, 5008 Bergen, Norway («we»).
This agreement applies for as long as we process personal data for you. If anything in the terms conflicts with this agreement, this agreement prevails for personal data.
2. Purpose and instructions
We process personal data only to provide Humryk to you and only on your instructions. Your instructions are the terms, this agreement, the settings and connections you choose in Humryk, and written instructions you give us. If you turn on a connection to a carrier, for example, that is an instruction to send the recipient and address there.
If we believe an instruction infringes data protection law, we tell you immediately. If the law requires us to process the data in other ways, we tell you first, unless the law forbids it.
3. What we process
| Topic | Details |
|---|---|
| Data subjects | Your customers (consumers), contacts at your business customers, subscribers, newsletter recipients, visitors to your online store and your users. |
| Data | Names and contact details, delivery and billing addresses, orders and payment status (never card numbers), subscriptions, consents and unsubscribes, messages and notes, sign-in to the online store, use of the online store and newsletters, and anything else you enter. |
| Special categories | Humryk is not designed for health data or other special categories (GDPR Article 9). You must not request or enter such data. |
| Processing | Storing, displaying, searching, organising, sending email, calculating statistics, transferring to connections you turn on, exporting and deleting. |
| Duration | For as long as the agreement lasts, and then until the data is deleted under section 11. |
4. Confidentiality
Only those of us who need it for operations, development and support get access to the data, and they are bound by confidentiality. Confidentiality continues after the agreement ends.
5. Security
We have technical and organisational measures appropriate to the risk (GDPR Article 32), including:
- encryption of all traffic (HTTPS) and of the database and backups at the provider
- separation between stores, so each store sees only its own data
- role-based access for your users, and a log of who did what in the store
- encrypted access tokens for connections
- access to production data only for those of us who need it, and a log of what we do in the system administration
- regular backups and a recovery plan
- code review and automated tests before changes go live
6. Sub-processors
You give us general authorisation to use sub-processors. The sub-processors we use today are listed in the privacy policy. We give them the same obligations we have under this agreement, and we are responsible for their compliance.
Before we add or replace a sub-processor, we notify you by email at least 30 days ahead. If you have reasonable grounds to object, write to post@humryk.com. If we cannot find a solution, you can terminate the agreement before the change applies, and we refund what you paid for the time after.
Providers you connect yourself – for example Stripe, accounting software, carriers, Google, Meta and AI assistants – are not our sub-processors. You have your own agreements with them, and we send data to them on your instruction.
7. Transfers outside the EEA
We transfer data to countries outside the EEA only when the transfer has a valid basis under Chapter V of the GDPR, such as an adequacy decision, the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Where the sub-processors process data is listed in the privacy policy.
8. Help with data subjects' rights
In Humryk you can find, correct, export and delete customers and contacts yourself. If one of your customers contacts us, we forward the request to you without undue delay and do not answer it ourselves unless you ask us to. If you need more help to answer, we help.
9. Breaches and other assistance
If we discover a personal data breach affecting your data, we notify you without undue delay and within 48 hours at the latest. We tell you what happened, which data and how many people are affected, the likely consequences and what we are doing. If we do not have everything at once, we provide the rest as we learn it. You notify Datatilsynet and the data subjects when the law requires it, and we help with what you need.
We also help you with data protection impact assessments and prior consultations with Datatilsynet (GDPR Articles 35 and 36), based on what we know about the processing.
10. Documentation and audits
We give you the information you need to see that we comply with this agreement. You can audit us yourself or through an independent auditor bound by confidentiality, with 30 days' notice, normally once a year and otherwise after a breach or an order from the authorities. We answer with documentation first, which is often enough. Each party bears its own costs.
11. When the agreement ends
When the Humryk agreement has ended, you can export the data for 30 days. Within 90 days after the agreement ends, we delete the data from our systems and from our sub-processors, except what the law requires us to keep. Deleted data can remain in backups until they are overwritten on a fixed schedule. We confirm the deletion in writing when you ask.
12. Liability and governing law
Liability towards data subjects follows GDPR Article 82. Between us, the liability rules in the terms apply as far as the law allows. This agreement is governed by Norwegian law, with Bergen District Court as the agreed venue.
Send questions about this agreement to post@humryk.com.