Robopack Group — Robopack and Tenant Manager Services
Last updated: September 2026
Contents
- 0. Applicability of this DPA
- SECTION I — Purpose, Scope and Definitions
- SECTION II — Roles and Description of Processing
- SECTION III — Obligations of the Processor
- Clause 6 — Instructions
- Clause 7 — Purpose Limitation
- Clause 8 — Duration of Processing
- Clause 9 — Confidentiality
- Clause 10 — Security of Processing
- Clause 11 — Sensitive Data
- Clause 12 — Documentation and Compliance
- Clause 13 — Use of Sub-processors
- Clause 14 — International Transfers
- Clause 15 — Assistance to the Data Controller
- Clause 16 — Personal Data Breach Notification
- SECTION IV — Final Provisions
- Annex I — List of Parties
- Annex II-A — Description of Processing: Robopack Service
- Annex II-B — Description of Processing: Tenant Manager Service
- Annex III — Technical and Organisational Measures
- Annex IV — List of Sub-processors
- Annex V-A — International Transfers: Robopack Service
- Annex V-B — International Transfers: Tenant Manager Service
- Annex VI — Architecture and Data-Flow Documentation
- Annex VII — US State Privacy Law Annex
- Annex VIII — Australian Privacy Annex
- Annex IX — Other Jurisdictions Annex
0. Applicability of this DPA
This Data Processing Agreement (“DPA”) is entered into between the Data Controller identified in Annex I and Robopack Group A/S (“Data Processor”, “Robopack Group”), and forms part of the agreement(s) under which the Data Controller subscribes to one or more Robopack Group products. References to the Data Processor include its successors in title.
The core clauses in Sections I to IV apply to the Data Controller regardless of which product(s) it has purchased. Which product-specific parts of this DPA apply depends on which Service(s) the Data Controller has purchased under its order form:
- (a) Where the Data Controller has purchased the Robopack Service, Annex II-A and Annex V-A apply.
- (b) Where the Data Controller has purchased the Tenant Manager Service, Annex II-B and Annex V-B apply.
- (c) Where the Data Controller has purchased both Services, both sets of product-specific Annexes apply concurrently, each governing only the processing carried out under the respective Service. Annex III (technical and organisational measures), Annex IV (sub-processors) and Annex VI (architecture and data-flow documentation) apply to both Services.
- (d) Save as set out in paragraphs (a) to (c), the obligations in Sections I to IV apply identically to the Robopack Service and the Tenant Manager Service. It is only the Annexes (which record the facts specific to each Service, such as the categories of data processed and hosting locations) that differ by Service; the clauses themselves impose the same obligations on the Data Processor regardless of which Service is in question.
- (e) Where the Data Processor processes Personal Data subject to United States state privacy laws, Annex VII (US State Privacy Law Annex) applies in addition to Sections I to IV.
- (f) Where the Data Processor processes Personal Data that constitutes personal information regulated by the Privacy Act 1988 (Cth), Annex VIII (Australian Privacy Annex) applies in addition to Sections I to IV.
- (g) Where the Data Processor processes Personal Data subject to the data protection laws of Switzerland, Canada, South Africa or the United Arab Emirates, Annex IX (Other Jurisdictions Annex) applies in addition to Sections I to IV.
SECTION I — Purpose, Scope and Definitions
Clause 1 — Purpose and Scope
- (a) This DPA sets out the terms on which the Data Processor processes Personal Data on behalf of the Data Controller in connection with the Data Controller’s use of the Robopack and/or Tenant Manager services (each a “Service” and together the “Services”), as further described in Annex II-A and Annex II-B respectively.
- (b) This DPA applies only in respect of the Service(s) actually subscribed to by the Data Controller, as reflected in the applicable order form.
- (c) This DPA is without prejudice to obligations to which the Data Controller is subject under Regulation (EU) 2016/679 (“GDPR”).
- (d) Annexes I to IX form an integral part of this DPA.
Clause 2 — Precedence and Modification
- (a) The Parties shall not modify this DPA other than by adding or updating information in the Annexes, or by written amendment signed by both Parties. The Data Processor may update the Annexes to reflect changes permitted or required by this DPA (including changes to sub-processors under Clause 13, updates to the technical and organisational measures in Annex III, and changes required by applicable data protection law or new standard contractual clauses) by giving the Data Controller reasonable prior written notice; no such update shall materially diminish the level of protection of Personal Data.
- (b) In the event of a conflict between this DPA and any other agreement between the Parties, including the applicable master services agreement or order form, this DPA shall prevail with regard to the Parties’ data protection obligations. This paragraph does not affect the limitations and exclusions of liability set out in the Agreement, which shall apply to claims under this DPA and the Agreement in aggregate.
- (c) In the event of a conflict between the core clauses of this DPA and a product-specific Annex, the product-specific Annex shall prevail solely in respect of the Service it describes.
Clause 3 — Definitions and Interpretation
“Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach”, “Controller”, “Processor” and “Supervisory Authority” shall have the meanings assigned to them in the GDPR.
“Services” means, as applicable, the Robopack SaaS platform and/or the Tenant Manager SaaS platform, as described in Annex II-A and Annex II-B respectively. “Customer Data” means any data, including Personal Data, submitted to or processed by a Service on behalf of the Data Controller. “Agreement” means the master services agreement, order form, or other contract between the Parties under which the Data Controller subscribes to one or more Services, of which this DPA forms part.
This DPA shall be read and interpreted in light of the GDPR and shall not be interpreted in a way that runs counter to the rights and freedoms of Data Subjects.
SECTION II — Roles and Description of Processing
Clause 4 — Roles of the Parties
- (a) The Data Controller determines the purposes and means of the processing of Personal Data. The Data Processor processes Personal Data solely on behalf of, and on documented instructions from, the Data Controller, except where Robopack Group processes Personal Data for its own legal obligations (e.g. billing, compliance, or security), in which case Robopack Group acts as an independent Controller for that limited processing.
- (b) Robopack Group A/S (CVR 32559735) is a single legal entity and acts as Data Processor for both Robopack and Tenant Manager Services. The two Services are operated independently of one another; no Personal Data is shared or transferred between them absent a separate written agreement.
- (c) The Data Controller warrants that (i) it has established a valid legal basis for the processing of Personal Data under this DPA, (ii) it has provided all notices and obtained all consents and authorisations required under applicable data protection law, and (iii) its processing instructions comply with the GDPR and other applicable law. The Data Controller shall indemnify and hold harmless the Data Processor against all claims, fines and costs arising from the Data Controller’s breach of this paragraph or from processing carried out pursuant to unlawful instructions of the Data Controller.
- (d) Where the Data Controller acts as a processor on behalf of a third-party controller (for example, as a managed service provider administering its customer’s Microsoft 365 tenant), the Data Controller warrants that its instructions to the Data Processor are authorised by the relevant controller, that it has obtained that controller’s authorisation for the engagement of the Data Processor as a sub-processor, and that it flows down the obligations of this DPA as required by Article 28(4) GDPR. In such cases, this DPA applies mutatis mutandis to the processor-to-processor relationship, and obligations expressed as owed to the Data Controller are owed to it in its capacity as processor.
Clause 5 — Description of Processing
The categories of Data Subjects and Personal Data, the nature and purpose of the processing, and the duration of the processing are set out in Annex II-A (Robopack Service) and/or Annex II-B (Tenant Manager Service), in each case only to the extent the Data Controller has subscribed to the relevant Service.
SECTION III — Obligations of the Processor
Clause 6 — Instructions
- (a) The Data Processor shall process Personal Data only on documented instructions from the Data Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law to which the Data Processor is subject; in such a case, the Data Processor shall inform the Data Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.
- (b) The Data Processor shall immediately inform the Data Controller if, in its opinion, an instruction infringes the GDPR or other applicable data protection law. The Data Processor may suspend implementation of the relevant instruction until it is confirmed or modified by the Data Controller, without incurring liability for such suspension.
- (c) The Agreement and this DPA constitute the Data Controller’s complete and final documented instructions for the processing of Personal Data. Additional or amended instructions require the Parties’ prior written agreement, including agreement on any reasonable additional fees payable for implementing such instructions.
Clause 7 — Purpose Limitation
The Data Processor shall process Personal Data only for the specific purpose(s) of the processing set out in Annex II-A and/or Annex II-B, unless otherwise instructed by the Data Controller. The Data Processor shall not use Customer Data, including Personal Data, to train, test or improve artificial intelligence or machine learning models, nor for any purpose other than providing the Services, unless the Data Controller has given prior written consent.
Clause 8 — Duration of Processing
Processing shall take place for the duration specified in Annex II-A and/or Annex II-B, and in any event for no longer than the duration of the Data Controller’s subscription to the relevant Service, subject to Clause 18 (Data Deletion and Return).
Clause 9 — Confidentiality
The Data Processor shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and shall grant access to Personal Data only to personnel for whom access is strictly necessary for the performance, management, and monitoring of the Services.
Clause 10 — Security of Processing
The Data Processor shall implement and maintain the technical and organisational measures set out in Annex III, appropriate to the risk, to ensure a level of security appropriate to the risk in accordance with Article 32 GDPR, including measures to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
Clause 11 — Sensitive Data
Neither the Robopack Service nor the Tenant Manager Service processes special categories of personal data within the meaning of Article 9 GDPR. The Data Controller shall not submit to the Services special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR); the Data Processor shall have no liability for such data submitted in breach of this Clause.
Clause 12 — Documentation and Compliance
- (a) The Parties shall be able to demonstrate compliance with this DPA. The Data Processor shall make available to the Data Controller information reasonably necessary to demonstrate such compliance and shall deal promptly and adequately with the Data Controller’s inquiries regarding the processing of Personal Data.
- (b) At the Data Controller’s request, and subject to reasonable confidentiality safeguards, the Data Processor shall permit and contribute to audits of the processing activities covered by this DPA, taking into account relevant certifications held by the Data Processor.
- (c) Audits shall be limited to once per calendar year, unless required by law or following a confirmed Personal Data Breach, shall be conducted during normal business hours with at least 90 days’ prior written notice, and shall primarily be performed through documentation review, certifications (e.g. ISO/IEC 27001), and independent third-party audit reports. Audits shall not compromise the security, confidentiality, or availability of the Services to other customers. To the extent audit assistance requires significant additional effort beyond standard support, the Data Processor may charge reasonable fees based on time and materials. The Data Controller shall bear its own audit costs. Any third-party auditor engaged by the Data Controller must not be a competitor of the Data Processor and must be bound by written confidentiality obligations; audit findings and all information disclosed in the course of an audit constitute Confidential Information of the Data Processor.
Clause 13 — Use of Sub-processors
- (a) The Data Controller provides the Data Processor with a general, standing authorization to engage, replace, or remove sub-processors without obtaining the Data Controller’s consent on a case-by-case basis. The Data Processor shall give the Data Controller at least 30 days’ prior written notice of any intended addition or replacement of a sub-processor, identifying the sub-processor and the processing it will carry out. Notice may be given by email to the Data Controller’s registered contact or by updating the Data Processor’s published sub-processor list accompanied by a notification through the Services or by email and is deemed given on the date it is sent or posted.
- (b) If the Data Controller has legitimate data protection grounds to object to a new or replacement sub-processor, it shall notify the Data Processor in writing within 14 days of the notice under paragraph (a). The Parties shall use reasonable efforts to resolve the objection. If the objection is not resolved within a reasonable time, the Data Controller’s sole remedy is to terminate this DPA and the applicable Service agreement, solely insofar as it relates to the Service affected by the new sub-processor, by written notice to the Data Processor.
- (c) Where the Data Processor engages a sub-processor to carry out specific processing activities, it shall do so under a written contract that imposes, in substance, the same data protection obligations as those set out in this DPA, in relation to implementing appropriate technical and organizational measures.
- (d) The Data Processor shall remain fully responsible to the Data Controller for the performance of the sub-processor’s obligations, and shall notify the Data Controller of any failure by a sub-processor to fulfil its contractual obligations.
- (e) The Data Processor shall agree a third-party beneficiary clause with each sub-processor whereby, in the event the Data Processor has factually disappeared, ceased to exist in law, or become insolvent, the Data Controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the Personal Data.
- (f) The current sub-processors for the Robopack and Tenant Manager Services are listed in Annex IV.
Clause 14 — International Transfers
- (a) Personal Data processed under the Robopack Service is hosted exclusively within the EU/EEA; see Annex V-A for the specific regions used. No transfer of Personal Data outside the EU/EEA takes place under the Robopack Service.
- (b) Personal Data processed under the Tenant Manager Service is hosted on Microsoft Azure in the region matching the Data Controller’s own jurisdiction (see Annex V-B), so that a Data Controller’s Personal Data remains within its own jurisdiction. No international transfer of Personal Data takes place under the Tenant Manager Service. Where the Data Processor accesses Personal Data hosted in each region from another jurisdiction (for example, for support or maintenance), such access shall, where required by applicable data protection law, be subject to appropriate safeguards in accordance with paragraph (c).
- (c) Where the Data Processor engages a sub-processor whose involvement would otherwise involve a transfer of Personal Data within the meaning of Chapter V GDPR, the Data Processor shall ensure that such transfer is subject to appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission.
- (d) If the Data Processor receives a legally binding request for access to or disclosure of Personal Data from a public authority or law-enforcement body, the Data Processor shall, unless legally prohibited, promptly notify the Data Controller and, where possible, redirect the requesting authority to the Data Controller. The Data Processor shall review the legality of each such request, shall disclose only the minimum legally required Personal Data, and shall, where reasonable grounds exist, pursue available remedies against overbroad or unlawful requests.
Clause 15 — Assistance to the Data Controller
- (a) The Data Processor shall promptly notify the Data Controller of any request it receives directly from a Data Subject relating to the processing of Personal Data and shall not respond to such a request itself unless authorized to do so by the Data Controller.
- (b) The Data Processor shall assist the Data Controller, by appropriate technical and organizational measures, in fulfilling the Data Controller’s obligation to respond to requests from Data Subjects exercising their rights under the GDPR.
- (c) In addition, taking into account the nature of the processing and the information available to it, the Data Processor shall assist the Data Controller in ensuring compliance with:
- (1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a “data protection impact assessment”) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;
- (2) the obligation to consult the competent supervisory authority prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the Data Controller to mitigate the risk;
- (3) the obligation to ensure that Personal Data is accurate and up to date, by informing the Data Controller without delay if the Data Processor becomes aware that the Personal Data it is processing is inaccurate or has become outdated;
- (4) the obligations in Article 32 GDPR (security of processing) and Articles 33 and 34 GDPR (notification of a personal data breach), as further addressed in Clause 10 and Clause 16.
- (d) The Data Controller shall, to the extent possible, respond to Data Subject requests itself using the functionality of the Services. To the extent assistance under this Clause requires significant additional effort beyond standard support, the Data Processor may charge reasonable fees based on time and materials.
Clause 16 — Personal Data Breach Notification
16.1 Assistance where a Personal Data Breach concerns data for which the Data Controller must notify
- (a) The Data Processor shall assist the Data Controller in notifying a Personal Data Breach to the competent supervisory authority without undue delay after the Data Controller becomes aware of it, where relevant.
- (b) The Data Processor shall assist in obtaining the information which the Data Controller must state in its notification, including, at least, the nature of the Personal Data (including, where possible, the categories and approximate number of Data Subjects and personal data records concerned), the likely consequences of the breach, and the measures taken or proposed to address it, including to mitigate its possible adverse effects.
- (c) The Data Processor shall assist the Data Controller in complying with its obligation to communicate the breach to affected Data Subjects without undue delay, where the breach is likely to result in a high risk to their rights and freedoms.
16.2 Notification where a Personal Data Breach concerns data processed by the Data Processor
The Data Processor shall notify the Data Controller without undue delay, and in any event no later than 48 hours after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA. Such notification shall contain, at least: a description of the nature of the breach (including, where possible, the categories and approximate number of Data Subjects and data records concerned); the details of a contact point where more information can be obtained; and its likely consequences and the measures taken or proposed to address it, including to mitigate its possible adverse effects. Where it is not possible to provide all this information at the same time, the initial notification shall contain the information then available, with further information provided without undue delay as it becomes available. Notification of, or response to, a Personal Data Breach shall not be construed as an acknowledgement of fault or liability by the Data Processor. The Data Processor becomes “aware” of a Personal Data Breach when it has established with a reasonable degree of certainty that a security incident has occurred and that it affects Personal Data processed under this DPA.
SECTION IV — Final Provisions
Clause 17 — Non-Compliance and Termination
- (a) Without prejudice to the GDPR, if the Data Processor is in breach of its obligations under this DPA, the Data Controller may instruct the Data Processor to suspend the processing of Personal Data until compliance is restored or terminate this DPA and/or the applicable Service agreement as set out below. The Data Processor shall promptly inform the Data Controller if it is unable to comply with this DPA, for whatever reason. Suspension of processing under this Clause does not relieve the Data Controller of its payment obligations under the Agreement in respect of Services already provided or during the period of suspension.
- (b) The Data Controller shall be entitled to terminate this DPA insofar as it concerns the processing of Personal Data under the relevant Service if:
- (1) the processing of Personal Data by the Data Processor has been suspended under paragraph (a) and compliance with this DPA is not restored within a reasonable time, and in any event within one month following suspension;
- (2) the Data Processor is in substantial or persistent breach of this DPA or its obligations under the GDPR; or
- (3) the Data Processor fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under this DPA or the GDPR.
- (c) The Data Processor shall be entitled to terminate this DPA insofar as it concerns the processing of Personal Data under a given Service where, having informed the Data Controller in accordance with Clause 6(b) that an instruction infringes applicable legal requirements, the Data Controller insists on compliance with that instruction.
- (d) Termination under this Clause is without prejudice to Clause 18 (Data Deletion and Return) or to any other rights either Party may have under the Agreement, and, where the Data Controller subscribes to both Services, affects only the Service to which the ground for termination relates unless the breach is common to both.
Clause 18 — Data Deletion and Return
- (a) Upon termination of a Service, the Data Processor shall, at the choice of the Data Controller, delete or return all Personal Data processed under that Service within 30 days, unless retention is required by applicable law. Upon written request, the Data Processor shall confirm deletion in writing. For the purposes of this Clause, a Service terminates when the Agreement or the relevant subscription is terminated or expires without renewal. A temporary lapse of the license followed by reactivation within 90 days shall not constitute termination; during such period the Data Processor shall suspend active processing (including tenant scans) and may retain account and configuration data solely to enable reactivation.
- (b) Database backups (Azure SQL) for both Services are retained for up to 7 days for point-in-time recovery and are automatically deleted thereafter. The Robopack Service additionally maintains file-level backups, retained for 180 days (daily backups), 104 weeks (weekly backups), and 60 months (monthly backups), and automatically deleted upon expiry of the applicable retention period; the Tenant Manager Service does not use a separate file-level backup schedule.
- (c) Until Personal Data is deleted or returned in accordance with this Clause, the Data Processor shall continue to ensure compliance with this DPA.
Clause 19 — Liability and Indemnification
The Data Processor shall only be liable for damages caused by processing where it has not complied with the obligations of the GDPR specifically directed to processors, or where it has acted outside or contrary to the Data Controller’s lawful instructions. The Data Processor’s aggregate liability arising out of or in connection with this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement, applied in aggregate across the Agreement and this DPA together.
Clause 20 — Governing Law and Jurisdiction
This DPA shall be governed by the laws of Denmark, and the Parties submit to the exclusive jurisdiction of the Danish courts.
Clause 21 — Signature
This DPA may be executed and accepted electronically, including by execution of an order form that incorporates it by reference or by acceptance through the Services, and such acceptance has the same effect as a handwritten signature. Where this DPA is accepted through an order form or the Services, Annex I is deemed completed with the details provided by the Data Controller in the order form, and no separate signature of this DPA is required.
| On behalf of the Data Controller: | On behalf of the Data Processor: |
|---|---|
| Name: | Name: Anton Jesper Kristensen |
| Position: | Position: Compliance Officer |
| Date: | Date: |
| Signature: | Signature: |
Annex I — List of Parties
Data Controller
| Field | Details |
|---|---|
| Name | |
| Address | |
| Contact person, position, contact details | |
| Signature and accession date |
Data Processor
| Field | Details |
|---|---|
| Name | Robopack Group A/S |
| CVR | CVR 32559735 |
| Address | Kongevejen 418, 2840 Holte, Denmark |
| Contact person, position, contact details | Anton Jesper Kristensen, Compliance Officer, [email protected] |
| Signature and accession date |
Annex II-A — Description of Processing: Robopack Service
This Annex applies only if the Data Controller has subscribed to the Robopack Service.
Categories of Data Subjects
Users of the Robopack Service (the Data Controller’s authorized personnel).
Categories of Personal Data
- Identification and contact information (name, business email address, phone number if provided).
- User account and authentication data (user identifiers such as Entra ID user ID, tenant identifiers, role assignments and associated access permissions).
- System and tenant configuration data (tenant IDs, domain information, branding configuration and related metadata).
- Deployment and package management data (software package metadata, deployment configurations, group assignments and related operational data).
- User-generated content limited to comments and feedback related to application packages.
- Audit and operational log data, including timestamps, IP addresses, user activities and system events necessary for security monitoring and troubleshooting.
- Device and endpoint data obtained from Microsoft Intune (device name, platform, the user email address associated with the device, discovered and managed application inventory, and deployment status timestamps).
Sensitive Data
None. The Robopack Service does not process special categories of personal data as defined in Article 9 GDPR.
Nature of the Processing
Operating a SaaS-based application for software package management and deployment automation, including account management, authentication and authorisation, software packaging and conversion, deployment management, integration with Microsoft Intune and related tenant services, logging of user activities, and customer support.
Purpose of the Processing
Providing access to, operating, maintaining, and supporting the Robopack Service in accordance with the Agreement.
Duration of the Processing
For the duration of the Data Controller’s subscription to the Robopack Service; see Clause 18 for handling of Personal Data upon termination.
For processing by (sub-)processors — subject matter, nature and duration
As set out in Annex IV. The subject matter and nature of the sub-processing correspond to the functions listed in Annex IV, for the duration of the Data Controller’s subscription to the relevant Service.
Annex II-B — Description of Processing: Tenant Manager Service
This Annex applies only if the Data Controller has subscribed to the Tenant Manager Service.
Categories of Data Subjects
Users of the Tenant Manager Service (the Data Controller’s authorized administrators); the Data Controller’s own end users and customers whose accounts or data are present in the managed Microsoft 365 tenant(s); and third parties whose personal data is present in the Data Controller’s Microsoft 365 environment (for example, external contacts or correspondents visible in tenant metadata).
Categories of Personal Data
User identifiers and Microsoft 365 metadata relating to the Data Controller’s managed tenant(s), comprising: names, user principal names, group memberships, device identifiers, authentication-method metadata, audit log entries, and security alert data; together with tenant configuration data and policy configurations (in JSON format) referencing object IDs.
Sensitive Data
None. The Tenant Manager Service does not process special categories of personal data as defined in Article 9 GDPR.
Nature of the Processing
Operating a SaaS-based platform for tenant management of Microsoft 365 environments, comprising storage, backup, monitoring, restoration and related technical support activities, including management of security and Conditional Access policies, device and application management via Microsoft Intune, and audit and compliance reporting, performed via delegated Microsoft Graph API access to the Data Controller’s Microsoft 365 tenant(s).
Purpose of the Processing
Providing access to, operating, maintaining, and supporting the Tenant Manager Service in accordance with the Agreement.
Duration of the Processing
For the duration of the Data Controller’s subscription to the Tenant Manager Service. Database backups (Azure SQL point-in-time recovery) are retained for up to 7 days; upon termination, Personal Data is automatically deleted within 30 days. See Clause 18.
For processing by (sub-)processors — subject matter, nature and duration
As set out in Annex IV. The subject matter and nature of the sub-processing correspond to the functions listed in Annex IV, for the duration of the Data Controller’s subscription to the relevant Service.
Annex III — Technical and Organisational Measures
This Annex forms an integral part of the DPA and applies to both the Robopack and Tenant Manager Services. Robopack Group implements and maintains the following technical and organizational measures to ensure a level of security appropriate to the risk in accordance with Article 32 GDPR. The Data Processor may update these measures from time to time, provided that updates do not materially degrade the overall level of security of the Services.
1. Information Security Governance
- An Information Security Management System (ISMS) aligned with ISO/IEC 27001 is operated and maintained.
- Information security roles and responsibilities are formally assigned.
- Information security policies and procedures are documented, reviewed at least annually, and continuously improved.
- Employees are subject to confidentiality obligations and receive periodic security and data protection training.
2. Access Control and Identity Management
- Access to systems containing Personal Data is restricted on a need-to-know basis and in accordance with the principle of least privilege.
- Role-based access control (RBAC) is implemented.
- Multi-factor authentication (MFA) is enforced for administrative access and privileged accounts.
- Access rights are reviewed periodically and revoked without undue delay when no longer required; administrative access is logged and monitored.
- Support personnel do not have routine access to customer environments; any access necessary to resolve a support request is limited to the minimum data necessary and logged.
3. Network and Infrastructure Security
- Network segmentation and secure configuration practices are applied.
- Personal Data is encrypted in transit using industry-standard TLS and at rest using industry-standard encryption mechanisms, with keys managed through secure key management services.
4. Logging and Monitoring
- Security-relevant events are logged, including user authentication events, administrative actions, and configuration changes.
- Logs are retained for a defined period and protected against unauthorized access and alteration.
5. Secure Development and Change Management
- Secure configuration and change management processes are implemented; application updates are tested prior to release.
- Anti-malware scanning and integrity validation mechanisms are implemented where applicable; changes to production environments are controlled and documented.
6. Data Minimisation and Processing Controls
- Only Personal Data necessary for service delivery is processed.
- Personal Data is hosted within the EU/EEA (Robopack Service) or within the region matching the Data Controller’s own jurisdiction (Tenant Manager Service); see Annex V-A and Annex V-B.
7. Backup and Recovery
- Backup procedures are implemented to ensure availability and resilience; backups are protected by appropriate access controls and encryption where applicable.
- Restoration procedures are tested at least annually.
8. Incident Management
- A documented incident management procedure is maintained; security incidents are logged, assessed, and handled according to defined procedures.
- Personal Data Breaches are notified to the Data Controller without undue delay (see Clause 16); root cause analysis and corrective measures are implemented following significant incidents.
9. Business Continuity
- Business continuity and disaster recovery measures are implemented to ensure service availability and resilience.
10. Sub-processor Security
- Sub-processors are selected based on security and compliance assessments.
Annex IV — List of Sub-processors
The table below lists Robopack Group’s known sub-processors, based on the Robopack Service architecture. Microsoft (Azure hosting and Microsoft Graph / Entra ID / Intune integration) is used by both the Robopack and Tenant Manager Services.
| Name of sub-processor | Function | Location | Service(s) |
|---|---|---|---|
| Microsoft (Azure; Microsoft Graph API) | Cloud hosting (application, database, backup, monitoring) and Microsoft 365 / Entra ID / Intune API integration | EU | Robopack and Tenant Manager |
| Zoho | Customer support tooling | EU | Robopack and Tenant Manager |
Annex V-A — International Transfers: Robopack Service
Personal Data processed under the Robopack Service is hosted on Microsoft Azure within the EU/EEA, across the following regions. No transfer of Personal Data outside the EU/EEA takes place under the Robopack Service.
| Region | Country |
|---|---|
| West Europe | Netherlands |
| North Europe | Ireland |
| Denmark East | Denmark |
Annex V-B — International Transfers: Tenant Manager Service
The Tenant Manager Service is hosted on Microsoft Azure across multiple geographic regions as a data-residency feature, not a transfer mechanism: each Data Controller’s tenant is hosted in the Azure region matching that Data Controller’s own jurisdiction, so that, for example, a UK-based customer’s data stays in the UK and an EU-based customer’s data stays in the EU. On this model, a Data Controller’s Personal Data always remains within its own jurisdiction, and no international transfer of Personal Data takes place under the Tenant Manager Service.
The Tenant Manager Service is available in the following regions:
| Code | Country | Azure Region |
|---|---|---|
| DNK | Denmark | Denmark East |
| SWE | Sweden | Sweden Central |
| BEL | Belgium | Belgium Central |
| DEU | Germany | Germany West Central |
| GBR | United Kingdom | UK South |
| CHE | Switzerland | Switzerland North |
| CAN | Canada | Canada Central |
| USA | United States | US West |
| ZAF | South Africa | South Africa North |
| AUS | Australia | Australia East |
| ARE | United Arab Emirates | UAE North |
Annex VI — Architecture and Data-Flow Documentation
Detailed architecture and data-flow diagrams for the Robopack and Tenant Manager Services are maintained by Robopack Group separately from this DPA and are made available to the Data Controller upon reasonable request, for example in connection with a security review. The nature of the processing carried out under each Service is described in Annex II-A and Annex II-B respectively, and the corresponding technical and organizational measures are set out in Annex III.
Annex VII — US State Privacy Law Annex
1. Applicability. This Annex applies solely to the extent Personal Data processed by the Data Processor on behalf of the Data Controller under the Agreement is subject to US State Privacy Laws. “US State Privacy Laws” means the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”) and any other comprehensive United States state privacy law applicable to the Personal Data processed under the Agreement. For the purposes of this Annex, “Personal Information”, “Business”, “Service Provider”, “Business Purpose”, “Sell” and “Share” have the meanings given in the applicable US State Privacy Laws; the Data Controller acts as the Business and the Data Processor acts as the Service Provider.
2. Service Provider Obligations. The Data Processor processes Personal Information solely as a Service Provider for the Business Purposes described in the Agreement and this DPA. The Data Processor shall not (a) Sell or Share Personal Information; (b) retain, use or disclose Personal Information for any purpose other than the Business Purposes specified in the Agreement, or outside the direct business relationship between the Parties, except as permitted by US State Privacy Laws; or (c) combine Personal Information received from the Data Controller with personal information received from another source, except as permitted by US State Privacy Laws.
3. Certification and Remediation. The Data Processor certifies that it understands and will comply with the restrictions set out in this Annex. The Data Processor shall notify the Data Controller without undue delay if it determines that it can no longer meet its obligations under US State Privacy Laws, in which case the Data Controller may, upon reasonable written notice, take reasonable and appropriate steps in accordance with Clause 12 (Documentation and Compliance) to stop and remediate unauthorized use of Personal Information.
4. Consumer Requests. Requests from consumers exercising rights under US State Privacy Laws shall be handled in accordance with Clause 15 (Assistance to the Data Controller), including its provisions on forwarding of requests, self-service and fees for assistance beyond standard support.
5. Deidentified Data. Nothing in this Annex restricts the Data Processor’s use of deidentified data that is maintained and used in accordance with applicable US State Privacy Laws, provided the Data Processor does not attempt to reidentify such data.
6. No Sale. The Parties acknowledge that the exchange of Personal Information under the Agreement does not constitute a Sale or Share, and that no monetary or other valuable consideration is provided in exchange for Personal Information.
7. Precedence. In the event of a conflict between this Annex and the core clauses of this DPA with respect to Personal Information subject to US State Privacy Laws, this Annex shall prevail to the extent of the conflict.
Annex VIII — Australian Privacy Annex
1. Applicability. This Annex applies solely to the extent Personal Data processed by the Data Processor on behalf of the Data Controller under the Agreement constitutes “personal information” regulated by the Privacy Act 1988 (Cth) (the “Privacy Act”), including the Australian Privacy Principles (“APPs”), and the Data Controller is an “APP entity”. Terms used in this Annex have the meanings given in the Privacy Act.
2. Roles. The Privacy Act does not distinguish between controllers and processors. For the purposes of this Annex, the Data Controller is the APP entity that collects and holds personal information, and the Data Processor handles personal information solely on the Data Controller’s behalf and only for the purposes of providing the Services in accordance with this DPA.
3. Cross-border Disclosure (APP 8). Personal information processed under the Tenant Manager Service for Australian customers is hosted in the Australia East region (Annex V-B) and remains in Australia. For the Robopack Service, the Data Controller acknowledges and authorizes hosting within the EU/EEA (Annex V-A). This DPA constitutes the contractual measures forming part of the reasonable steps taken by the Data Controller for the purposes of APP 8.1, and the Data Processor shall handle such personal information in a manner consistent with the APPs to the extent they apply to the processing under this DPA. The Data Controller remains accountable for overseas disclosures in accordance with section 16C of the Privacy Act.
4. Security and Destruction (APP 11). The technical and organizational measures in Annex III constitute reasonable steps to protect personal information from misuse, interference, loss, and unauthorized access, modification or disclosure. Deletion, return and de-identification in accordance with Clause 18 constitute the reasonable steps to destroy or de-identify personal information no longer required.
5. Data Breaches (Notifiable Data Breaches Scheme). Notification under Clause 16 is intended to enable the Data Controller to comply with Part IIIC of the Privacy Act. The Data Controller is solely responsible for assessing whether a Personal Data Breach constitutes an “eligible data breach” and for any notification to the Office of the Australian Information Commissioner and to affected individuals. The Data Processor shall not make such notifications on the Data Controller’s behalf unless required by law or agreed in writing.
6. Access and Correction (APP 12 and APP 13). Requests by individuals for access to or correction of personal information shall be handled in accordance with Clause 15 (Assistance to the Data Controller), including its provisions on forwarding of requests, self-service and fees for assistance beyond standard support.
7. Sensitive Information. Consistent with Clause 11, the Data Controller shall not submit “sensitive information” as defined in the Privacy Act to the Services, and the Data Processor shall have no liability for such information submitted in breach of this paragraph.
8. Precedence. In the event of a conflict between this Annex and the core clauses of this DPA with respect to personal information regulated by the Privacy Act, this Annex shall prevail to the extent of the conflict.
Annex IX — Other Jurisdictions Annex (Switzerland, Canada, South Africa, United Arab Emirates)
1. Applicability. This Annex applies solely to the extent Personal Data processed by the Data Processor on behalf of the Data Controller under the Agreement is subject to the data protection laws of one of the jurisdictions below. Terms used in each paragraph have the meanings given in the law referred to in that paragraph.
2. Switzerland. Where Personal Data is subject to the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”), references in this DPA to the GDPR shall be read as references to the FADP mutatis mutandis, and references to the Supervisory Authority include the Swiss Federal Data Protection and Information Commissioner. Personal Data of Swiss customers processed under the Tenant Manager Service is hosted in the Switzerland North region (Annex V-B). Where a transfer from Switzerland requires safeguards, the Standard Contractual Clauses as adapted for Switzerland apply.
3. Canada. Where Personal Data is subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”) or substantially similar provincial law (including the Quebec Act respecting the protection of personal information in the private sector), this DPA constitutes the contractual protection through which the Data Controller ensures a comparable level of protection while personal information is processed by the Data Processor. Assistance with access and correction requests is provided in accordance with Clause 15; the assessment of whether a breach creates a real risk of significant harm, and any notification to the Privacy Commissioner or affected individuals, remain the responsibility of the Data Controller, supported by Clause 16.
4. South Africa. Where Personal Data is subject to the Protection of Personal Information Act, 2013 (“POPIA”), the Data Processor acts as an “operator” and this DPA constitutes the written contract required by section 20 POPIA. The Data Processor shall process personal information only with the knowledge or authorisation of the Data Controller (as responsible party), shall treat personal information as confidential (section 20), shall maintain the security measures required by section 19 through Annex III, and shall notify the Data Controller in accordance with Clause 16 where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorized person (section 21(2)). Notifications to the Information Regulator and to data subjects remain the responsibility of the Data Controller.
5. United Arab Emirates. Where Personal Data is subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”), this DPA constitutes the contract governing processing on behalf of the controller required by the PDPL, and the obligations in Clauses 6 to 18 apply to that processing accordingly.
6. Precedence. In the event of a conflict between this Annex and the core clauses of this DPA with respect to Personal Data subject to a law referred to in this Annex, this Annex shall prevail to the extent of the conflict.