Attenta
Data Processing Agreement
Version 2026-10-07. This agreement forms part of the Customer Terms. The customer is controller and Glimtheim AS is processor for personal data stored by the customer in Attenta. This version applies when accepted with the corresponding Customer Terms; publication does not replace an existing company's accepted agreement.
Scope and instructions
Processing lasts while Attenta provides the service and covers hosting, organising, displaying, exporting, supporting, securing, backing up and deleting data on documented customer instructions in the Customer Terms, product settings and support requests. If an instruction appears unlawful, we will notify the customer unless prohibited.
People and data
Data subjects may include employees, contractors, customer users and business contacts. Data may include identity and contact details, account links, employment-related profile data, roles, projects, working dates and times, notes, approvals, exports, audit events and technical identifiers. Customers must not intentionally store special-category data unless separately agreed and legally permitted.
Confidentiality and security
People authorised to process customer data must be bound by confidentiality or an appropriate statutory duty and access it only for authorised purposes. We implement technical and organisational measures appropriate to the risk as required by applicable law. Current technical controls include HTTPS browser-to-service transport, framework-managed password hashing and sessions, email confirmation for password accounts, login lockout, request-rate controls, application-level membership and role checks, and change histories for supported operations. Company data is logically separated in a shared database. The primary database is hosted in Germany with Hetzner, and operational database backups are maintained. These measures are not a guarantee of uninterrupted service, invulnerability or recovery of every record. The free service has no contractual uptime or fixed recovery objective; that does not waive our legal security duties or this agreement.
Subprocessors and transfers
The customer gives general written authorisation for subprocessors needed to provide Attenta. Current material subprocessors include Hetzner Online GmbH for hosting in Germany and Resend for email, including export attachments sent at the customer's request, with stored email data in the United States. Resend identifies its onward providers in its published subprocessor list. We impose the required data-protection obligations on subprocessors and remain responsible for their performance as required by law. We notify the customer in advance of intended additions or replacements and give a meaningful opportunity to object on data-protection grounds before the new processing starts. International transfers must follow documented instructions and applicable law, using a valid adequacy decision or appropriate safeguards, with any required assessment and supplementary measures. A general authorisation is not itself a transfer safeguard.
Assistance and incidents
Taking account of the processing, we assist the customer with data-subject requests, security duties, breach notification, impact assessments and regulator consultations. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and provide available information needed for the customer's duties.
Deletion, return and audit
At the end of processing, at the customer's choice, we return or delete customer personal data and delete existing copies unless applicable law requires storage. Any temporary retention in backups must be justified, restricted to permitted purposes and addressed in the deletion arrangements, including after a recovery. We follow documented lawful retention instructions; a product default does not override them. We make available the information necessary to demonstrate compliance and allow and contribute to audits and inspections required under applicable law. Practical arrangements may address timing, confidentiality and reasonable costs, without preventing necessary oversight. No annual audit limit overrides statutory rights.
Contact and precedence
Privacy and processor questions may be sent to support@attenta.io. If this agreement conflicts with the Customer Terms on personal-data processing, this agreement controls. Mandatory GDPR and Norwegian data-protection requirements always apply.
Previous version — 6 October 2026Resend subprocessorsPrivacy Notice and current retention practices
Company and contact
Glimtheim AS, located in Norway. Norwegian organisation number: 835890112. D‑U‑N‑S® number: 348225941. Contact: support@attenta.io.
Effective 7 October 2026 — draft for legal review
Contact and company-identification details updated 7 October 2026; other provisions are unchanged.
Back to Attenta