Data processing agreement
English translation of the Norwegian agreement. Translation dated 15 October 2026.
This is an English translation provided for convenience. The Norwegian version (databehandleravtale) is the binding agreement, and if the two differ, the Norwegian text applies. The Norwegian agreement is a preliminary version under legal review; the final agreement will be published before the service opens for production use.
Applies to employers who use Søknadsbasen for recruitment. Accepted when an employer account is set up.
1. The parties
Data processor: Søknadsbasen. Data controller: the employer (the Customer) that creates an account and uses the employer services.
2. Roles
For the candidates' account and profile data on the platform, Søknadsbasen is the data controller (see the privacy policy). For the Customer's recruitment processing (candidates the Customer searches for, contacts, unlocks, assesses and communicates with), the Customer is the data controller and Søknadsbasen the data processor. This agreement governs the latter.
3. Purpose
Søknadsbasen processes personal data on behalf of the Customer only to deliver the employer services: job ads, application handling, anonymised candidate search, contact requests, unlocking after consent, ATS, AI screening and messages.
4. Categories
Data subjects: job seekers/candidates and applicants, and the Customer's own team members. Data: name, contact details, CV content, cover letters, notes/assessments and messages. The platform does not ask for sensitive personal data, and the Customer must not enter such data in free text.
5. Instructions
Søknadsbasen processes personal data only on the Customer's instructions as they follow from the agreement and the use of the service.
6. Sub-processors
- Hetzner Online GmbH (operation of the app, database, storage and login), one server in Helsinki, Finland (EU)
- Stripe Payments Europe, Limited (payment), no candidate CVs
- Plus Five Five, Inc. (Resend, email), USA, see section 9
- Anthropic Ireland, Limited (AI), stores the data in the USA, see section 9
- PostHog, Inc. (usage analytics, only with the user's consent), storage in Frankfurt, see section 9
- Functional Software, Inc. (Sentry, error tracking), USA, see section 9
The data processing agreements with Hetzner, PostHog and Sentry are being concluded. With Stripe, Resend and Anthropic, the data processing agreement that accompanies their terms applies.
7. Security
Database and files in the EU, encryption in transit, role-based access, anonymisation by default in the candidate base, and an access/action log of who has viewed, contacted and unlocked which candidate.
8. The candidates' rights
Søknadsbasen assists with access, rectification, erasure, data portability and objection. The candidate controls visibility and can delete their profile at any time.
9. Transfers to third countries
The database, storage and operation of the app are in the EU, on one server at Hetzner Online GmbH in Helsinki, Finland. Some sub-processors are US companies or have operations in the USA: Anthropic stores the text from the AI features in the USA, and Resend, Stripe, PostHog and Sentry may process data there. For Anthropic, Resend and Stripe the transfers are based on the EU standard contractual clauses (SCC), and for Resend and Stripe also on the EU-US Data Privacy Framework. For PostHog and Sentry they are based on the EU-US Data Privacy Framework. We are open about this and do not claim that all processing takes place in the EU.
10. Breaches
Søknadsbasen notifies the Customer without undue delay in the event of a personal data breach.
11. Deletion
On termination, personal data processed on behalf of the Customer is deleted or returned, unless storage is required by law.
12. Governing law
Norwegian law.