Data Processing Addendum

1. Introduction

This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer") and Getia AS ("Processor") for the use of Portifer services.

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person
Processing: Any operation performed on personal data
Controller: The entity that determines the purposes and means of processing
Processor: The entity that processes personal data on behalf of the controller

3. Scope of Processing

The Processor shall:

Process personal data only on documented instructions from the Customer
Ensure that persons processing data are subject to confidentiality obligations
Implement appropriate technical and organizational security measures
Assist the Customer in responding to data subject requests
Delete or return all personal data upon termination of services

4. Subprocessors

The Customer authorizes the Processor to engage subprocessors as listed in the Subprocessors List.

5. Security Measures

Encryption in transit: the service is served over HTTPS only, with HTTP Strict Transport Security.
Encryption of stored credentials: carrier API credentials, CRM tokens and print-service keys are encrypted at the application level with AES-256-GCM. Other stored data is protected by the security controls of the hosting and storage subprocessors.
Hashing: customer API keys are stored only as hashes, and user passwords are hashed with bcrypt.
Access control: role-based access per customer organisation, optional two-factor authentication (TOTP), session expiry with central revocation, and rate limiting with temporary lockout after repeated failed sign-ins.
Logging: security-relevant administrative actions, sign-ins and staff access to customer accounts are recorded in audit logs.
Integrations: outbound webhooks are signed with HMAC-SHA256, and requests to internal network addresses are blocked.
Personal data breaches are handled and notified as described in section 6.

6. Data Breach Notification

In the event of a personal data breach, the Processor shall notify the Customer within 72 hours.

7. Contact

For questions about data processing, please contact us at [email protected]

Company: Getia AS (Org. nr: 926 610 198)
Address: At Mesh, Møllergata 6, 0179 Oslo, Norway

3. Scope of Processing

The Processor shall:

Process personal data only on documented instructions from the Customer

Ensure that persons processing data are subject to confidentiality obligations

Implement appropriate technical and organizational security measures

Assist the Customer in responding to data subject requests

Delete or return all personal data upon termination of services

5. Security Measures

Encryption in transit: the service is served over HTTPS only, with HTTP Strict Transport Security.

Encryption of stored credentials: carrier API credentials, CRM tokens and print-service keys are encrypted at the application level with AES-256-GCM. Other stored data is protected by the security controls of the hosting and storage subprocessors.

Hashing: customer API keys are stored only as hashes, and user passwords are hashed with bcrypt.

Access control: role-based access per customer organisation, optional two-factor authentication (TOTP), session expiry with central revocation, and rate limiting with temporary lockout after repeated failed sign-ins.

Logging: security-relevant administrative actions, sign-ins and staff access to customer accounts are recorded in audit logs.

Integrations: outbound webhooks are signed with HMAC-SHA256, and requests to internal network addresses are blocked.

Personal data breaches are handled and notified as described in section 6.