Attenta
Data Processing Agreement
Version 2026-10-06. This agreement forms part of the Customer Terms. The customer is controller and Glimtheim AS is processor for personal data stored by the customer in Attenta.
Scope and instructions
Processing lasts while Attenta provides the service and covers hosting, organising, displaying, exporting, supporting, securing, backing up and deleting data on documented customer instructions in the Customer Terms, product settings and support requests. If an instruction appears unlawful, we will notify the customer unless prohibited.
People and data
Data subjects may include employees, contractors, customer users and business contacts. Data may include identity and contact details, account links, employment-related profile data, roles, projects, working dates and times, notes, approvals, exports, audit events and technical identifiers. Customers must not intentionally store special-category data unless separately agreed and legally permitted.
Confidentiality and security
People authorised to process customer data are bound by confidentiality and receive access only as needed. Measures include encrypted transport, controlled production access, tenant separation, authentication controls, audit logging, backups, patching, monitoring and incident procedures. Measures may evolve without reducing overall protection.
Subprocessors and transfers
The customer gives general authorisation for subprocessors needed to run Attenta. Current material subprocessors include Hetzner Online GmbH in Germany for hosting and Resend and its providers for transactional email. We will provide notice of a material new subprocessor and allow reasonable, data-protection-based objections. Transfers outside the EEA use an applicable adequacy decision or approved safeguards such as standard contractual clauses.
Assistance and incidents
Taking account of the processing, we assist the customer with data-subject requests, security duties, breach notification, impact assessments and regulator consultations. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and provide available information needed for the customer's duties.
Deletion, return and audit
At the end of service, on documented request and subject to legal retention and backup cycles, we will return or delete customer personal data. We provide information reasonably necessary to demonstrate compliance and permit proportionate audits no more than annually unless an incident or authority requires more. The customer bears audit costs unless material non-compliance is found.
Contact and precedence
Privacy and processor questions may be sent to support@attenta.io. If this agreement conflicts with the Customer Terms on personal-data processing, this agreement controls. Mandatory GDPR and Norwegian data-protection requirements always apply.
Company and contact
Glimtheim AS, located in Norway. Norwegian organisation number: 835890112. D‑U‑N‑S® number: 348225941. Contact: support@attenta.io.
Effective 6 October 2026 — first-release draft for legal review
Contact and company-identification details updated 7 October 2026; other provisions are unchanged.
Back to Attenta