App Privacy & Terms

This Data Processing Agreement (“DPA”) is entered into by and between:

1. Sklls AS, a company incorporated in Norway with organization number 918 653 600, having its registered office at Grenseveien 21, 4313 Sandnes, Norway (“Sklls AS” or “Data Processor”); and

2. The Customer agreeing to Sklls AS’s terms of service or other written or electronic agreement for the provision of Sklls AS’s services (“Customer” or “Data Controller”).

(Sklls AS and Customer are hereinafter jointly referred to as the “Parties” and individually as a “Party”.)

This DPA outlines the terms for the processing of Personal Data by Sklls AS on behalf of the Customer in connection with the services provided under the main agreement between Sklls AS and the Customer (the “Service Agreement”).

1. Background and purpose of the agreement

This Data Processing Agreement, including its Appendixes, (the “DPA”), is entered into between the Data Controller and the Data Processor relating to personal data concerning employees, customers, suppliers or other individuals, as specified by the Data Controller and processed by the Data Processor in connection with the services the Data Processor provides for and to the Data Controller.

The Data Processor has committed to deliver the services to the Data Controller described in the Service Agreement.

The purpose of this DPA is to:

• a) regulate the Parties’ roles and responsibilities relating to the Processing (as defined below) of Personal Data pursuant to Data Protection Laws and the GDPR (as defined below) when fulfilling their duties according to the Service Agreement; and
• b) ensure that the Data Subjects’ Personal Data (as defined below) are not subject to unauthorized or unlawful processing.

In the event of conflict between this DPA and any other agreements between the Parties concerning the processing of Personal Data, the terms of this DPA shall prevail unless otherwise expressly agreed in writing between the Parties.

2. Definitions

The following definitions shall apply in relation to this DPA:

• “DPA” shall mean the provisions and appendixes of this Data Processing Agreement.
• “Personal Data” shall mean all types of data or information regarded as Personal Data pursuant to Data Protection Laws and the GDPR. Personal Data means any information relating to an identified or identifiable natural person. Personal Data may for example be names, addresses, phone numbers, e-mail addresses, IP addresses, car numbers, images, fingerprints, iris patterns, head shapes (for face recognition). This includes, but is not limited to, the data described in Appendix 1 of this DPA.
• “Processing” (of Personal Data) shall mean any use of Personal Data, such as collection, storage, organization, alteration or adaption, distribution and/or transfer.
• “GDPR” shall mean the Regulation (EU) 2016/679 of 27 April 2016 or equivalent UK regulations (as amended from time to time) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• “Data Protection Laws” shall mean national legislation in relevant EU/EEA member states implementing Regulation (EU) 2016/679 and similar UK regulations on the processing and distribution of Personal Data and legislation implementing the GDPR.
• “Sub-contractor” shall mean a Data Processor used by the Data Processor to process Personal Data. (Note: This is often referred to as a “Sub-processor”.)
• “Data Subjects” shall mean the persons who are the subjects of Personal Data.

3. Legal basis and purpose of the processing

The Parties shall process Personal Data in accordance with the Data Protection Laws, the GDPR and this DPA.

The Data Controller is responsible for ensuring that the Personal Data is processed lawfully and to ensure that the Data Subjects has been provided with sufficient information regarding the Processing.

The Data Processor collects, records, aligns, stores or in other ways processes Personal Data on behalf of The Data Controller in order to deliver the agreed-upon services in accordance with the Service Agreement.

Appendix 1 sets out which Personal Data the Data Processor Processes and the purpose of the processing. The Data Processor shall not Process Personal Data for other purposes than those set out hereunder, or as otherwise instructed by the Data Controller in writing, unless required by law.

4. The Data Controller’s right to access the Personal Data

The Data Controller is entitled to access the Personal Data being Processed and the systems used for this purpose by the Data Processor, unless otherwise agreed or provided for by law. The Data Processor shall provide necessary assistance if access is required by the Data Controller.

5. Obligations of the Data Processor

The Data Processor shall:

• a) only Process Personal Data in accordance with documented instructions from the Data Controller;
• b) ensure that persons authorized to Process Personal Data have committed themselves to confidentiality;
• c) fulfil all security measures requirements required by the Data Protection Laws and the GDPR, including implementing appropriate technical and organizational security measures as described below in Appendix 2 to achieve a level of safety appropriate to the risk;
• d) assist the Data Controller in ensuring compliance with the requirements for establishing an appropriate level of security in accordance with the GDPR Articles 32 – 36, including implementing necessary measures for notification of security breaches (personal data breaches), assessing privacy implications and conducting preliminary discussions; and
• e) at the choice of the Data Controller, erase and/or return the Personal Data and any copies of the Personal Data i) upon termination of this DPA in accordance with section 13 below, or ii) when this is required by the Data Controller (unless the Data Protection Laws or the GDPR requires that the Personal Data shall be stored).

The Data Processor shall make available to the Data Controller all information necessary to demonstrate compliance with the Data Processor’s obligations.

The Parties shall immediately notify each other if either Party is of the opinion that instructions or requirements from the other Party is in violation with the Data Protection Laws or the GDPR.

6. Use of Sub-contractors

The Sub-contractors used by the Data Processor in relation to the Service Agreement are described in Appendix 3. The Data Controller accepts that the Data Processor uses these Sub-contractors.

The Data Processor shall ensure that all Sub-contractors are familiar with the contractual and statutory obligations of the Data Controller and that the Sub-contractors act in accordance with these obligations by imposing equivalent data protection obligations on them as set out in this DPA.

The Data Controller approves that the Data Processor may use other Sub-contractors than those set out in Appendix 3 during the term of this DPA. A list of Sub-contractors being used by the Data Processor is at all times kept updated and can be received on request. The Data Controller may oppose to changes being made on this list, however, the Data Controller shall not withhold such changes without objective and reasonable grounds related to data protection. The Data Processor shall inform the Data Controller of any intended changes concerning the addition or replacement of other Sub-contractors, thereby giving the Data Controller the opportunity to object to such changes.

7. The Data Processor’s transfer of Personal Data to third countries

The Data Processor may transfer and store Personal Data Processed by the Data Processor on behalf of the Data Controller to countries where the Data Processor and its Sub-contractors operate.

The Data Controller is familiar with and accepts such transfer and storage as long as it is necessary to complete the agreed deliveries under the Service Agreement. However, the Data Processor shall not transfer Personal Data to countries outside the EEA area without ensuring that the transfer is based on a lawful basis for transfer, cf. the GDPR Article 44 – 46 and Article 49 (e.g., an adequacy decision, Standard Contractual Clauses, or other appropriate safeguards). The Data Controller provides general authorization for such transfers provided these conditions are met.

8. The Parties’ responsibility to comply with the rights of the Data Subjects

The Data Controller shall act as the Data Subject’s contact point and provide all necessary information regarding the processing.

The Data Controller is responsible for the handling of the Data Subjects requests for access, rectification, erasure, restriction, data portability etc., as well as ensuring that such requests are met.

The Data Processor shall assist the Data Controller in fulfilling its obligations relating to ensuring the rights of the Data Subjects, taking into account the nature of the processing.

9. The Parties’ responsibility in relation to Personal Data breach management and notification

Any Personal Data breach shall be handled as a deviation, including use of IT systems that violates with the Data Processor’s fixed routines, instructions from the Data Controller, Data Protection Laws or the GDPR.

The Parties shall establish and maintain routines and systematic measures for the follow-up of personal data breaches, including measures for restoring normalcy, removing the cause for the breach as well as prevent repetition.

Once a Party becomes aware of the deviation, including possible personal data breaches affecting the Personal Data processed under this DPA, that Party shall notify the other party without undue delay and immediately effectuate all necessary and appropriate measures to restore normalcy.

The Data Controller is responsible for notifying the Data Protection Authority and the Data Subjects, where required. If necessary, the Data Processor shall assist the Data Controller in the notification.

10. Security audits

The Data Controller has the right to conduct regular audits of the Data Processor’s technical and organizational measures, including but not limited to routines, security measures and systems used to Process Personal Data on behalf of the Data Controller. Such audits may be carried out by a third party appointed by the Data Controller.

Such audits shall be subject to prior notification (e.g., 30 days) and must be agreed in advance. Audits shall be conducted during normal business hours and in a manner that minimizes disruption to the Data Processor’s operations. The Data Processor shall provide all necessary assistance to the Data Controller or a third party auditor in conducting the audits. The Data Processor is entitled to charge reasonable costs accrued by audits initiated by the Data Controller if such audits require effort beyond the provision of standard documentation or certifications.

11. Confidentiality

The Data Processor shall keep the Personal Data which it access in relation to this DPA confidential. This obligation shall continue after termination.

The Data Processor’s employees and other persons with access to the Personal Data shall be subjected to a non-disclosure agreement or be under an appropriate statutory obligation of confidentiality.

The Data Processor shall not disclose or provide access to the Personal Data to anyone other than the employees of the Data Processor, the employees of the Data Controller (as authorized), or the Sub-contractors engaged by the Data Processor, without prior written consent of the Data Controller or if this follows by laws, regulations, etc.

12. Term

This DPA shall remain in force as long as the Data Processor is Processing Personal Data on behalf of the Data Controller under the Service Agreement.

13. Termination

Upon termination of the Service Agreement, or earlier at the Data Controller’s request, the Data Processor shall, at the choice of the Data Controller, return or erase and/or destruct all Personal Data comprised by this DPA.

The Personal Data shall only be erased and/or destructed following written instructions from the Data Controller.

The Parties shall agree on how the transfer or erasure and/or destruction of the Personal Data shall take place.

The Data Processor shall document in writing that the erasure and/or destruction has been carried out without undue delay upon termination of this DPA or receipt of such instruction. This obligation shall not apply to the extent the Data Processor is required by applicable law to retain some or all of the Personal Data.

14. Governing law and legal venue

This DPA shall be governed by and in accordance with the laws of Norway. The Stavanger City Court is the legal venue for any disputes between the Parties relating to this DPA.

Appendixes to the DPA

Appendix 1: Description of the Personal Data and the purpose of the Processing

• Employee data (e.g., names, contact details, user IDs, roles, activity data within the services). Data subjects: persons being employed by or otherwise authorized by the Data Controller to use the services. Purpose: to provide and manage user access to the Sklls AS platform and services, facilitate communication, ensure service functionality, and fulfill obligations under the Service Agreement.
• Customer data (e.g., names, contact details, user interactions, data inputted by users into the Sklls AS platform). Data subjects: persons who are customers, clients, or other end-users of the Data Controller, whose Personal Data is processed by the Data Controller using Sklls AS’s services. Purpose: to enable the Data Controller to use the Sklls AS platform for its intended business purposes, such as managing customer relationships, university interactions, or other activities supported by the Sklls AS services.
• Supplier data (e.g., names, contact details of supplier representatives). Data subjects: persons who are representatives or employees of suppliers to the Data Controller, whose Personal Data is processed within the Sklls AS services. Purpose: to enable the Data Controller to manage interactions with its suppliers via the Sklls AS platform, if applicable, or for communication related to the services provided by such suppliers that are relevant to the Sklls AS services.
• Other Personal Data as determined and submitted by the Data Controller into the Sklls AS services during its use of the platform. Data subjects: individuals whose Personal Data is provided by the Data Controller to the Data Processor for Processing in connection with the services. Purpose: as instructed by the Data Controller and necessary for the provision of the services under the Service Agreement.

Appendix 2: Description of technical and organizational measures

The Data Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risks presented by the processing. These measures include:

• Access control: The Data Processor shall on its own, or by engaging a third party, implement necessary measures to prevent unauthorized physical access. This includes, but is not limited to, hiring security personnel and only use safe buildings and locations where Personal Data is being processed.
• System access control: The Data Processor shall implement appropriate measures to prevent that Personal Data are processed unlawfully. The measures may vary in regards to specific processing procedures, but shall as a minimum include, authorization by way of username and password, two-factor authentication, documented authorization procedures, documented change management processes and logging at several levels.
• Transfer control: The Data Processor shall use its best endeavors to implement appropriate measures to ensure that it is possible to transfer Personal Data to the correct person without the possibility of the data being read, copied, modified or deleted by any unauthorized means during the transfer.
• Backup: Backup shall be conducted in accordance with the Service Agreement. The Data Controller is responsible for backup of data in regards to services that is not covered by the Service Agreement.
• Logical separation of data: Personal Data from different Data Subjects or Data Controllers, if applicable, shall be logically separated in the Data Processor’s systems to ensure that Personal Data that are processed for different purposes may be processed separately and individually.

1. Terms and conditions

These are the Terms and Conditions (“Conditions”) for SKLLS AS, a company incorporated and registered in Norway with company number 918 653 600, whose registered office is Grenseveien 21, 4313 Sandnes, Norway (“Supplier”) in relation to Customer use of its HiSklls IT-platform.

2. Definitions

2.1. Definitions used in the Confirmation will have the same meaning when used in these Conditions.

2.2. The following definitions apply to these Conditions and to the Confirmation and the other Parts of this Schedule unless otherwise defined therein.

Additional Services: means where applicable, the available library of earlier intents and scenarios on the Platform that may be included ref. clause 6.3, and the development and configuration services to be provided by the Supplier in relation to the use of the Services by the Customer, as described in the Additional Services Specification as included in Schedule 2 part 1.

Additional Services Specification: means where Additional Services are being provided, the description of such services as may be set out in Schedule 2 part 1 and Service Level Agreement in part 2 of the Schedule as the parties may agree to amend in writing from time to time.

Agreement: has the meaning provided in the Confirmation.

Authorised User: any person who is authorised by the Customer to use the Services and Documentation in accordance with the Agreement and who has set up a Digital ID to enable such use.

Business Day: any day that is not a Saturday, Sunday or public holiday in Norway.

Confidential Information: information that is proprietary or confidential and is either clearly labelled as such or is reasonably identified as Confidential Information as set out in clause 11.

Confirmation: means the confirmation document to which the Schedule is attached.

Customer Data: the data inputted by the Customer, or Authorised Users, for the purpose of using the Platform and the Services.

Customer System: the Customer’s secure, private data network made available by the Customer in relation to the Services where applicable.

Data Protection Legislation: means the Norwegian Data Protection Act 2018 and related subordinate legislation, as may be amended, updated or re-enacted from time to time.

Digital ID: means the unique Platform identity file for each individual and corporate user of the Platform.

DVT: means the digital, vocal and training platform using artificial intelligence for training and real time scenarios in the relevant DVT Sector.

DVT Sector: means any performance or implementation activity that is sector specific for a DVT which is developed and managed via the Platform as such sector is specified in the Confirmation.

Documentation: the document(s) made available to the Customer by the Supplier on the Platform, or such other web address notified by the Supplier to the Customer from time to time which sets out a description of the Services and the user instructions for the Services and the Platform.

Effective Date: the date upon which the Agreement is signed by both the Customer and the Supplier, or, in the event that the Parties sign on different dates, the date upon which the last Party to sign has signed the Agreement.

Fees: the fees payable by the Customer as set out in Schedule 3 the Fees Table.

Fees Table: the table of fees in the Schedule 3.

Individualized Customer Data: means such Customer Data that can either identify the Customer or the Authorized Users by reference to logos, company names, trademarks, individual names, addresses, e-mails, webpages, telephone numbers, voices, pictures or any other form of information that can be used to identify a person or a company.

Intellectual Property Rights: patents, utility models, rights to inventions, copyright and related rights, trade marks and service marks, trade names and domain names, rights in get-up, goodwill and the right to sue for passing off or unfair competition, rights in designs, rights in computer software, database rights, rights to preserve the confidentiality of information (including know-how and trade secrets) and any other intellectual property rights, including all applications for (and rights to apply for and be granted), renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist, now or in the future, in any part of the world.

Platform: means the Supplier’s digital and artificial intelligence interactive learning software as a service platform, made available to the Customer for the DVT Sector via an Azure cloud access solution consisting of HiSklls Trainer, HiSklls Admin and HiSklls Course Developer.

Schedule: means the schedule in 3 Parts attached to the Confirmation and forming part of the Agreement.

Services: means the Supplier granting the Customer access to the Platform and any Additional Services attached to and included in the Platform, and corresponding consulting and maintenance service for the Platform as more particularly described in the Documentation.

Service’s Start Date: means the date when the use of the Services commences as set out in the Confirmation, or where Additional Services are being provided, the date described in clause 5.3.

Software: the software applications provided by the Supplier as part of the Services.

Term: means the period stated in the Confirmation starting on the Effective Date.

Virus: any thing or device (including any software, code, file or programme) which may: prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; prevent, impair or otherwise adversely affect access to or the operation of any programme or data, including the reliability of any programme or data (whether by re-arranging, altering or erasing the programme or data in whole or part or otherwise); or adversely affect the user experience, including worms, trojan horses, viruses and other similar things or devices.

3. Licence

3.1. The Supplier grants to the Customer from the Services Start Date a non-exclusive, non-transferable right to permit the Authorised Users to use the Platform, the Services and the Documentation during the Term of the Agreement solely for the Customer’s internal training and teaching operations.

3.2. In relation to the Authorised Users, the Customer undertakes that:

• the maximum number of Authorised Users that it authorises to access and use the Services shall not exceed the number set out in the Confirmation or otherwise agreed with the Supplier in writing from time to time;
• it shall use reasonable commercial efforts to ensure that each Authorised User shall keep a secure password or two factor licence key (as applicable) for his or her use of the Services and that each Authorised User shall keep any password or licence key provided to him confidential;
• it shall permit the Supplier or the Supplier’s designated auditor to audit the use of the Services in order to check compliance with the Agreement. Each audit may be conducted no more than once per year at the Supplier’s expense, and this right shall be exercised with reasonable prior notice, in such a manner as to not substantially interfere with the Customer’s normal conduct of business; and
• if any of the audits referred to above reveal non-compliance with the Agreement, then the Customer shall promptly do what is reasonably requested by the Supplier, including disabling passwords or license keys that have been given to individuals who are not Authorised Users or, subject to clause 11 of these Conditions, paying an amount equal to any underpayment for the Fees.

3.3. The Customer shall not access, store, distribute or transmit any Viruses, or any material during the course of its use of the Services that is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing or racially or ethnically offensive, and the Supplier reserves the right, without liability or prejudice to its other rights to the Customer, to disable the Customer’s access to any material that breaches the provisions of this clause.

3.4. The Customer shall not (except to the extent expressly permitted under the Agreement), attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Services and/or Documentation in any form or media or by any means; or

• attempt to reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Services and/or Documentation; or
• access all or any part of the Software in order to build a product or service which competes with the Services;
• attempt to obtain, or assist third parties in obtaining, access to the Services and/or Documentation, other than as provided under this clause 3;
• use the Services to provide services to third parties other than as part of the normal business practices of the Customer; or
• subject to clause 16.4, licence, sell, rent, lease, transfer, assign, distribute, display, disclose, or otherwise commercially exploit, or otherwise make the Services and/or Documentation available to any third party.
• Notwithstanding the terms of this clause 3, the Customer shall have the right to use the Services for the Platform within the DVT Sector to whom the Customer provides teaching and learning services as a part of their normal course of business.

3.5. Customer shall use reasonable efforts to prevent any unauthorised access to, or use of, the Services and/or Documentation and, in the event of any such unauthorised access or use, promptly notify the Supplier.

4. Services

4.1. The Supplier shall provide the Services and make available the Documentation to the Customer on and subject to the terms of the Agreement.

4.2. The Customer shall complete, and shall ensure that each Authorised User completes, a Digital ID to log into the Platform. Full use of the Services is not possible without such Digital IDs being completed.

4.3. The Supplier shall use all reasonable efforts to complete any Additional Services within any timescales stated in the Additional Services Specifications, unless prevented or delayed by the Customer.

4.4. The Supplier shall use commercially reasonable efforts to make the Services available as set out in the Service Level Agreement in Schedule 2 part 2 appended to this Agreement.

4.5. The Supplier will provide the Customer with the Supplier’s customer support services in accordance with the terms and costs specified in the Service Level Agreement appended to this Agreement. The Supplier may adjust its standard Service Level Agreement in its sole and absolute discretion from time to time. The Supplier shall however inform the Customer of any such adjustments prior to such becoming effective. Any amendments that negatively impacts the Customer shall be agreed with the Customer in writing before becoming effective. The Customer may purchase enhanced support services separately at the Supplier’s then current rates.

5. Additional Services

5.1. The Supplier shall provide the Additional Services with all reasonable care and skill and as described in Schedule 2 part 1 of the Schedule.

5.2. The Supplier shall use all reasonable efforts to complete the Additional Services within any timescales stated in Schedule 2 part 1, however any such timescales are estimates only and time shall not be of the essence in relation to completion of the Additional Services.

5.3. On completion of the Additional Services, the Supplier shall promptly demonstrate the successful completion of the Additional Services and operation of the Services. The date of such demonstration shall be the Services Start Date for such Additional Services.

5.4. The Customer is solely responsible for the Customer System and the Customer Data and shall ensure that the Customer System complies with the relevant specifications provided by the Supplier from time to time (provided the Supplier provides at least 30 days’ written notice to any forced upgrades or changes which may be incompatible with existing infrastructure) and be solely responsible for procuring and maintaining the same. All problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to the Customer System are the sole responsibility of the Customer.

6. Customer Data and data library

6.1. The Customer shall own all right, title and interest in and to all of the Customer Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data used in the Platform for training purposes. The Customer shall also have the sole responsibility for the legality, reliability, integrity, accuracy and quality for any libraries included as part of the Additional Services, used in the Platform for training purposes. The Supplier does not monitor or control any libraries included as Additional Services, or Customer Data inserted in the Platform posted by the Customer in relation to the use of the Services.

6.2. All Intellectual Property Rights conceived, originated, devised, developed or created by the Customer in or to any Customer Data (whether such Customer Data be supplied to the Supplier or in the possession of the Supplier) shall remain vested solely in the Customer and, save for as set out in clause 6.3, the Supplier shall not obtain any rights in the Customer Data as a result of the Agreement. In the event that the Supplier is permitted under the Agreement to subcontract any part of its obligations, the Supplier shall ensure that none of its subcontractors (or agents) obtain any rights to the Customer Data as a result of performing any part of the Agreement.

6.3. Customer hereby grants to the Supplier an unlimited, irrevocable, royalty free, transferrable and exclusive licence to copy and use the training modules, intents and scenarios developed in the Platform for the Customer based on the received Customer Data and reuse anonymized Customer Data as part of the Platform’s available library of use cases, however Supplier shall not use any Individualized Customer Data directly in its Platform, without express consent from the Customer or its individual Authorized Users appearing in such Customer Data.

6.4. If the Supplier processes any personal data on the Customer’s behalf when performing its obligations under the Agreement (“Personal Data”), the parties record their intention that the Customer shall be the data controller and the Supplier shall be a data processor and in any such case:

• the Supplier shall process the Personal Data only in accordance with the terms of the Agreement and any lawful instructions reasonably given by the Customer from time to time;
• the duration of the processing will be concurrent with the Term, the scope, nature and purpose of the processing is to enable the use of the Services in accordance with the Agreement, the types of personal data processed will be such personal data as contained in the Platform and the categories of data subject will be individuals identified by their Digital ID in the Platform.
• all individuals involved in the provision of the Services on behalf of the Supplier shall be subject to appropriate obligations of confidentiality;
• the Supplier warrants that the provision of the Services includes the implementation of sufficient technical and organisational measures to ensure an appropriate level of security in relation to the processing of Personal Data as required by the Data Protection Legislation;
• the Supplier shall as far as is possible and proportionate in relation to the nature of the processing, implement technical and organisation measures that assist the Customer with its obligations in relation to the exercise of data subject’s rights as described by the Data Protection Legislation;
• the Customer acknowledges that the Supplier is authorised to transfer Personal Data to a third party technology partner which the Supplier has engaged, or may engage, in relation to any discrete element which is comprised within the Services (a “Third Party Provider”) on condition that any such transfer and engagement will be in accordance with Data Protection Legislation;
• the Supplier shall ensure that any engagement of a Third Party Provider shall be on terms which are no less protective of the Personal Data than the terms of the Agreement, and the Supplier shall remain fully liable to the Customer for the performance of a Third Party Provider’s obligations;
• the Supplier shall notify the Customer within 48 hours of becoming aware of any breach of Data Protection Legislation relating to the Personal Data. Such notification shall:
  • include information on the nature of the breach and the data involved;
  • describe the categories and approximate number of individuals concerned and the likely consequences;
  • describe the measures taken or proposed to be taken to address the issue; and
  • provide contact detail for the Customer to obtain more information on the issue;
• the Supplier shall, at the choice of the Customer, delete or return all Personal Data to the Customer when the provision of the Services has been concluded, except where the Supplier is required to retain any such Personal Data under any separate legal obligation;
• the Supplier shall make available to the Customer such information as the Customer may reasonably request in relation to demonstrating compliance with Data Protection Legislation, and shall participate in audits and inspections where reasonably requested by the Customer in relation to the demonstration of such compliance;
• the Supplier will ensure that the Personal Data will not be processes, accessed, transferred or stored outside of the EU or the country where the Customer and the Authorised Users are located in order to carry out the Services and the Supplier’s other obligations under the Agreement subject to appropriate safeguards being in place as required under Data Protection Legislation;
• the Customer shall ensure that the Customer is entitled to transfer the relevant Personal Data to the Supplier so that the Supplier may lawfully use, process and transfer the Personal Data in accordance with the Agreement on the Customer’s behalf; and
• the Customer shall ensure that the relevant third parties have been informed of, and have given their consent to, such use, processing, and transfer as required by Data Protection Legislation.

7. Customer obligations

7.1. The Customer shall:

• provide the Supplier with all necessary co-operation in relation to the Agreement and all necessary access to such information as may be reasonably required by the Supplier in order to provide the Services;
• comply with all applicable laws and regulations with respect to its activities under the Agreement and shall carry out all other Customer responsibilities set out in the Agreement in a timely and efficient manner;
• use reasonable commercial efforts to ensure that the Authorised Users use the Services and Documentation in accordance with the terms of the Agreement and that no Authorized Users share Digital ID and shall be responsible for any Authorised User’s breach of the Agreement; and
• obtain and shall maintain all necessary licences, consents, and permissions necessary for the Supplier, its contractors and agents to perform their obligations under the Agreement.

8. Supplier obligations

8.1. The Supplier undertakes that the Services and the Platform will be performed in accordance with the Documentation and with reasonable care and skill.

8.2. The undertaking at clause 8.1 shall not apply to the extent of any non-conformance which is caused by use of the Services contrary to the Supplier’s instructions, or modification or alteration of the Services by any party other than the Supplier or the Supplier’s duly authorised contractors or agents. If the Services do not conform with the foregoing undertaking, Supplier will, at its expense, use all reasonable commercial efforts to correct any such non-conformance promptly, or provide the Customer with an alternative means of accomplishing the desired performance.

8.3. The Supplier does not warrant that the use of the Services will be uninterrupted or error-free or that the information obtained by the Customer through the Services will meet the Customer’s requirements and the Customer accepts responsibility for the selection of the Services on the Platform to achieve its intended results and acknowledges that the Services have not been developed to meet the individual requirements of the Customer.

8.4. The Supplier is not responsible for any delays, delivery failures, or any other loss or damage resulting from the transfer of data over communications networks and facilities, including the internet, and the Customer acknowledges that the Services and Documentation may be subject to limitations, delays and other problems inherent in the use of such communications facilities.

8.5. All other conditions, warranties or other terms which might have effect between the parties or be implied or incorporated into the Agreement or any collateral contract, whether by statute or otherwise, are hereby excluded, including the implied conditions, warranties or other terms as to satisfactory quality, fitness for purpose or the use of reasonable skill and care.

8.6. This Agreement shall not prevent the Supplier from entering into similar agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under the Agreement.

9. Rights in the Services

9.1. All Intellectual Property Rights in the Platform, the Services and the Documentation are owned by or validly licensed to the Supplier. Except as expressly stated herein, the Agreement does not grant the Customer any rights to, under or in, any patents, copyright, database right, trade secrets, trade names, trademarks (whether registered or unregistered) or any other rights or licences in respect of the Services or Documentation.

9.2. All Intellectual Property Rights created by the Supplier in relation to Additional Services shall remain owned by the Supplier, unless stated to the contrary in the Additional Services Specification.

9.3. The Supplier shall defend the Customer, its officers, directors and employees against any claim that the Customer’s use of the Platform, the Services or Documentation in accordance with the Agreement infringes any European or Norwegian patents effective as of the Effective Date, copyright, trademark, database right or right of confidentiality, and shall indemnify the Customer for any amounts awarded against the Customer in judgment or settlement of such claims, provided that:

• the Supplier is given prompt notice of any such claim;
• the Customer provides reasonable co-operation to the Supplier in the defence and settlement of such claim, at the Supplier’s expense; and
• the Supplier is given sole authority to defend or settle the claim.

9.4. In the defence of settlement of any claim, the Supplier may procure for the Customer the right to continue to use the Services, replace or modify the Services so that they become non-infringing or, if such remedies are not reasonably available, terminate the Agreement on 20 Business Days’ notice to the Customer without any additional liability or obligation to pay liquidated damages or other additional costs to the Customer.

9.5. In no event shall the Supplier, its employees, agents and sub-contractors be liable to the Customer to the extent that the alleged infringement is based on:

• modification of the Services or Documentation by anyone other than the Supplier or the Supplier’s sub-contractor(s); or
• the Customer’s use of the Services or Documentation in a manner contrary to the instructions given to the Customer by the Supplier; or
• the Customer’s use of the Services or Documentation after notice of the alleged or actual infringement from the Supplier or any appropriate authority.

9.6. This clause 9 constitutes the Customer’s sole and exclusive remedy and the Supplier’s only liability for infringement of any patent, copyright, trademark, database right or right of confidentiality, and, for the avoidance of doubt, is subject to clause 12.2.

10. Payment

10.1. The Customer shall pay the Fees to the Supplier for the Services in accordance with this clause 10 and as set out in the Confirmation.

10.2. The Customer shall provide to the Supplier valid approved purchase order information acceptable to the Supplier and any other relevant valid, up-to-date and complete contact and billing details.

10.3. A valid and proper invoice will be issued by the Supplier showing (a) any VAT payable; and (b) setting out the sum which the Supplier considers to be due on the date 30 days after receipt by the Customer of such invoice. If the Supplier has not received payment within 30 days from the date of the Customer’s receipt, and without prejudice to any other rights and remedies of the Supplier:

• If the Customer is already using the Services, the Supplier may, subject to 13.2.1 and without liability to the Customer, disable the Customer’s license keys, passwords, accounts and access to all or part of the Platform and the Services and the Supplier shall be under no obligation to provide any or all of the Services or Services while the invoice(s) concerned remain unpaid; and
• interest shall accrue on such due amounts at an annual rate equal the Norwegian interest rate for late payments in effect at such time as set in accordance with the Penalty Payment Act 1976.

10.4. All amounts and fees stated or referred to in the Agreement unless otherwise specified in the Confirmation shall be payable in GBP, are non-cancellable and non-refundable, and are exclusive of value added tax, which shall be added to the Supplier’s invoice(s) at the appropriate rate if applicable and inclusive of all expenses, disbursements and other charges relating to the Supplier’s duties and obligations under and in accordance with the Agreement.

10.5. The Supplier shall after the first initial Term of the Agreement as set out in the Confirmation, be entitled to increase the Fees upon 180 days’ prior notice to the Customer, but not more than once during any 12-month period during the Agreement.

11. Confidentiality

11.1. Each party (Receiving Party) shall keep in strict confidence all technical, sensitive or commercial know-how, specifications, trade secrets, inventions, processes or initiatives which are of a confidential nature and have been disclosed to the Receiving Party by the other party (Disclosing Party), its employees, agents or subcontractors, and any other confidential information concerning the Disclosing Party’s business or its products or its services which the Receiving Party may obtain.

11.2. The Receiving Party shall restrict disclosure of such Confidential Information to such of its employees, agents or subcontractors as need to know it for the purpose of discharging the Receiving Party’s obligations under the Agreement, and shall ensure that such employees, agents or subcontractors are subject to obligations of confidentiality corresponding to those that bind the Receiving Party. This clause “Confidentiality” shall survive termination of the Agreement.

11.3. A party’s Confidential Information shall not be deemed to include information that:

• is or becomes publicly known other than through any act or omission of the Receiving Party;
• was in the Receiving Party’s lawful possession before the disclosure;
• is lawfully disclosed to the Receiving Party by a third party without restriction on disclosure;
• is independently developed by the Receiving Party, which independent development can be shown by written evidence; or
• is required to be disclosed by law, by any court of competent jurisdiction or by any regulatory or administrative body as evidenced and documented by relevant party.

12. Liability

12.1. Except as expressly and specifically provided in the Agreement:

• the Customer assumes sole responsibility for results obtained from the use of the Services and the Documentation by the Customer, and for conclusions drawn from such use. The Supplier shall have no liability for any damage caused by errors or omissions in any information, instructions or scripts provided to the Supplier by the Customer in connection with the Services, or any actions taken by the Supplier at the Customer’s direction;
• all warranties, representations, conditions and all other terms of any kind are excluded from the Agreement; and
• the Services and the Documentation are provided to the Customer on an “as is” basis.

12.2. Except as expressly stated in clause 12.3:

• the Supplier shall not in any circumstances have any liability for any losses or damages which may be suffered by the Customer (or any person claiming under or through the Customer), whether the same are suffered directly or indirectly or are immediate or consequential, and whether the same arise in contract, tort (including negligence) or otherwise howsoever, which fall within any of the following categories:
  • special damage even if the Supplier was aware of the circumstances in which such special damage could arise;
  • loss of profits;
  • loss of anticipated savings;
  • loss of business opportunity;
  • loss of goodwill, or
  • loss or corruption of data.
• with the specific exception of those liabilities referred to in clause 12.3 and the liability for costs arising from any dispute or legal proceedings, the total liability of the Supplier, whether in contract, tort (including negligence) or otherwise and whether in connection with the Agreement or any collateral contract, shall in no circumstances exceed a sum equal to the Fees paid or payable by the Customer to the Supplier under the Agreement the last 12 months, except in relation to any obligation of the Supplier for indemnities in respect of infringement of Intellectual Property Rights, or breaches of clause 6 or clause 11, for which the Supplier’s liability is capped at the total of Fees paid under the Agreement.
• the Customer agrees that, in entering into the Agreement, either it did not rely on any representations (whether written or oral) of any kind or of any person other than those expressly set out in the Agreement or (if it did rely on any representations, whether written or oral, not expressly set out in the Agreement) that it shall have no remedy in respect of such representations and (in either case) the Supplier shall have no liability in any circumstances otherwise than in accordance with the express terms of the Agreement.

12.3. Nothing in the Agreement shall exclude liability for:

• fraud or fraudulent misrepresentation; or
• any other liability which may not be excluded by law.

12.4. All dates supplied by the Supplier for the provision of Services shall be treated as approximate only, to the extent the Supplier has not provided an explicit fixed and firm date to the Customer. The Supplier shall not in any circumstances be liable for any loss or damage arising from any delay in delivery beyond such approximate dates. In case of non-delivery of the Services at the Service Start Date, the Supplier shall not be entitled to charge the Customer for the period such delay exists.

13. Term and termination

13.1. The Agreement shall commence on the Effective Date and shall, unless otherwise terminated earlier in accordance with the Agreement, shall continue for the Term as set out in the Confirmation from the Services Start Date (the Term). Unless terminated by the Customer in writing no later than 30 days prior to the end of the Term, the Agreement shall automatically renew for successive 12-month periods (each a “Renewal Period”). To terminate the Agreement at the end of a Renewal Period, the Customer shall notify the Supplier in writing no later than 30 days before the end of the Renewal Period.

13.2. Without prejudice to any other rights or remedies to which the parties may be entitled, either party may terminate the Agreement without liability to the other if:

• the other party commits a material breach of any of the terms of the Agreement and (if such a breach is remediable) fails to remedy that breach within 14 days of that party being notified in writing of the breach; or
• the other party is insolvent within the meaning of the Norwegian Insolvency Act 1984 or any other equivalent or similar event in any other jurisdiction;
• a petition is filed, a notice is given, a resolution is passed, or an order is made, for or in connection with the winding up of the other party other than for the sole purpose of a scheme for a solvent amalgamation of the other party with one or more other companies or organisations, or the solvent reconstruction of that other party;
• the other party ceases, or threatens to cease, to trade; or
• in respect of the Supplier only, the Supplier commits a material breach of its obligations under the Agreement that is not capable of being remedied.

13.3. On termination of the Agreement for any reason:

• all licences granted under the Agreement shall immediately terminate;
• each party shall return and make no further use of any equipment, property, and other items (and all copies of them) belonging to the other party;
• the Supplier shall have no obligation to maintain or facilitate access to the Platform; and
• the accrued rights of the parties as at termination, or the continuation after termination of any provision expressly stated to survive or implicitly surviving termination, shall not be affected or prejudiced.

14. Third party rights

14.1. The Agreement does not confer any rights on any person or party (other than the parties to the Agreement and, where applicable, their successors and permitted assigns) pursuant to the Contracts.

15. Force majeure

The Supplier shall have no liability to the Customer under the Agreement if it is prevented from or delayed in performing its obligations under the Agreement, or from carrying on its business, by acts, events, omissions or accidents beyond its reasonable control, including, without limitation, strikes, lock-outs or other industrial disputes (whether involving the workforce of the Supplier or any other party), failure of a utility service or transport or telecommunications network, act of God, war, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, pandemic, fire, flood, storm or default of suppliers or sub-contractors, provided that the Customer is notified of such an event and its expected duration.

16. General

16.1. If the Supplier chooses to waive any particular right it has under the Agreement on any particular occasion this does not prevent it from exercising that right on another occasion.

16.2. If any provision of the Agreement is held by a court of law (or similar forum) to be invalid or unenforceable, then that provision will be severed and it shall not affect the validity or enforceability of the rest of the Agreement.

16.3. The Customer is not entitled to transfer or assign its rights and obligations under the Agreement to anyone else without the Supplier’s prior written permission.

16.4. Nothing in the Agreement is intended to, or shall operate to, create a partnership between the parties, or to authorise either party to act as agent for the other, and neither party shall have authority to act in the name or on behalf of or otherwise to bind the other in any way (including the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power).

16.5. All notices required or permitted under the Agreement will be in writing (which shall include email only in respect of notices not relating to legal process). Any notice shall be deemed to have been duly received:

• if delivered personally, on signature of a delivery receipt if before 5pm on a Business Day and otherwise on the next Business Day;
• if sent by pre-paid first-class post or recorded delivery at 9.00 am three Business Days after posting and where the address is not the same country as that from which the notice is sent, seven Business Days after posting;
• if delivered by commercial courier, on the date and at the time that the courier’s delivery receipt is signed if before 5pm on a Business Day and otherwise on the next Business Day.

Notices relating to the Agreement will be sent to the primary corporate addresses set forth in the Agreement or to such other address as Customer or the Supplier may notify the other party in writing.

16.6. The Agreement constitutes the complete and exclusive understanding and agreement between Customer and the Supplier regarding its subject matter and supersedes all prior or other agreements or understandings, written or oral, relating to its subject matter (including any proposal the Supplier may have issued to the Customer). Each party acknowledges that, in entering into the Agreement it does not rely on any statement, representation, assurance or warranty (whether it was made negligently or innocently) of any person (whether a party to the Agreement or not) other than as expressly set out in the Agreement.

16.7. Notwithstanding the termination or expiry of the Agreement, the provisions of the Agreement will continue to bind each party insofar as and so long as may be necessary to give effect to their respective rights and obligations under the Agreement.

16.8. This Agreement shall be governed by and construed in accordance with Norwegian law.

16.9. Any dispute, controversy or claim arising out of or in connection with this Agreement, or the breach, termination or invalidity thereof, shall be referred to mediation in accordance with the Rules of the Arbitration and Dispute Resolution Institute of the Oslo Chamber of Commerce in force at any time.

16.10. If mediation is not successful, or the parties agree to skip the mediation process, any dispute or difference arising out of this Agreement shall be referred to arbitration in Stavanger, one arbitrator being appointed by each party in accordance with the Arbitration Act 2004 or any statutory modification or re-enactment thereof for the time being in force. On the receipt by one party of the nomination in writing of the other parties’ arbitrator, that party shall appoint their arbitrator within 14 days, failing which the decision of the single arbitrator appointed shall apply. Two arbitrators properly appointed shall appoint a third arbitrator who shall be the chairman of the Arbitration Panel. Should the two arbitrators fail to appoint the third arbitrator, any party can request that the appointment be made by the Stavanger City Court. The parties agree that no Party shall appeal to the court on a question of law arising out of an award made in the proceedings.

16.11. The arbitration hearings, any submissions to the court and the award or ruling passed by the court shall be treated as confidential. If a party demands, the proceedings shall be conducted in the English language.

Schedule 2, Part 1: Additional Services

1. The Additional Services consist of (i) Custom Content development and updates and (ii) Technology Features.

(i) Custom Content development and updates:

• Development and update of Customer specific scenarios
• Configuration of Customer specific KPIs
• Configuration of Customer specific courses
• Training of Customer’s personnel
• Support of Users
• Assistance with other related tasks.

(ii) Technology Features:

The Parties may agree in writing to carry out collaboration projects related to e.g. developing specific functionality. The Parties may agree in writing that the Customer shall be compensated on an hourly basis in accordance with the agreed scope. These additional services are charged on an hourly basis.

2. The Platform and the Services and the Additional Services shall be provided to the Customer in accordance with the terms set out in the Service Level Agreement described in Part 2 of the Appendix to this Schedule 2.

We are committed to upholding the highest standards of data protection and security. Sklls is GDPR compliant, adheres to the principles of the EU AI Act, and is ISO 27001 certified for Information Security Management.

View our ISO 27001 certification (PDF)