Data Processing Agreement
Last updated: 3 July 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between Sonara Media AS (“Sonara”, “Processor”) and the customer (“Customer”, “Controller”) for the use of Sonara’s services (the “Service”). It governs Sonara’s processing of personal data on the Customer’s behalf under the EU General Data Protection Regulation (“GDPR”) and the Norwegian Personal Data Act. Where it conflicts with the Terms of Service, this DPA prevails for data-protection matters. It is incorporated into the Terms by reference.
1. Roles and scope
For personal data the Customer uploads or that Sonara processes on the Customer’s instructions (“Customer Personal Data”), the Customer is the Controller and Sonara is the Processor. Sonara acts as an independent controller only for data it processes for its own purposes (e.g. account administration, billing, security), as described in our Privacy Policy.
2. Definitions
“Personal data”, “processing”, “controller”, “processor”, “data subject”, and “personal data breach” have the meanings given in the GDPR. “Sub-processor” means a third party engaged by Sonara to process Customer Personal Data.
3. Details of processing
- Subject matter: provision of the Service (AI-assisted sales prospecting, outreach, inbound handling, CRM, and enrichment).
- Duration: the term of the agreement, plus any deletion period in Section 12.
- Nature and purpose: hosting, storing, analysing, enriching, and transmitting Customer Personal Data to operate the Service on the Customer’s instructions.
- Types of personal data: business contact details of the Customer’s prospects and contacts (name, role, company, email, phone, public professional profile), communications content, and Customer users’ account data.
- Categories of data subjects: the Customer’s prospects, leads, customers, and authorised users.
4. Processing on instructions
Sonara processes Customer Personal Data only on the Customer’s documented instructions, including those given through the Service’s features and configuration, unless required by law (in which case Sonara will inform the Customer where legally permitted). Sonara will inform the Customer if, in its opinion, an instruction infringes data-protection law.
5. Confidentiality
Sonara ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations and process the data only as necessary to provide the Service.
6. Security measures
Sonara implements appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls and audit logging, per-tenant data isolation, regular security reviews, and incident-response procedures. A summary is maintained in our Privacy Policy and made available on request.
7. Sub-processors
The Customer authorises Sonara to engage the sub-processors listed on our Sub-processors page. Sonara imposes data-protection obligations on each sub-processor no less protective than this DPA and remains responsible for their performance. Sonara will notify the Customer of intended additions or replacements of sub-processors before they take effect, giving the Customer an opportunity to object on reasonable data-protection grounds.
8. Data subject rights
Taking into account the nature of the processing, Sonara assists the Customer with appropriate technical and organisational measures — insofar as possible — to respond to data-subject requests (access, rectification, erasure, restriction, portability, and objection), including self-service export and deletion tools within the Service. If a data subject contacts Sonara directly, Sonara will refer them to the relevant Customer.
9. Personal data breaches
Sonara will notify the Customer without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting Customer Personal Data, and will provide the information the Customer reasonably needs to meet its own notification obligations.
10. International transfers
Where Sonara or its sub-processors transfer Customer Personal Data outside the EEA, such transfers are made under an appropriate transfer mechanism, principally the European Commission’s Standard Contractual Clauses (SCCs) together with supplementary measures where required. The primary datastore (Supabase) is hosted in the EU. Two sub-processors deserve a named mention: Leadfeeder (Dealfront Group GmbH, Germany), which identifies visiting companies on the Customer’s website and processes within the EU; and DeepSeek, which performs AI reasoning on prospect research and processes in the People’s Republic of China under the SCCs, with prospect business data only and never the Customer’s own account data.
11. Audits
Sonara makes available information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits. Sonara may satisfy audit requests by providing relevant certifications or reports where available.
12. Return and deletion
On termination of the Service, Sonara will, at the Customer’s choice, delete or return Customer Personal Data and delete existing copies within a reasonable period (target: 30 days), unless retention is required by law.
13. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.
14. General
This DPA is governed by Norwegian law and subject to the jurisdiction agreed in the Terms of Service. Customers requiring a countersigned copy for procurement may request one at fabian@sonara-media.com.
This DPA is provided as a starting point and should be reviewed by qualified legal counsel before being relied upon. It does not constitute legal advice.