Data processing agreement
DRAFT – to be approved legally before payment is switched on.
Last updated: 3 November 2026
This agreement covers PRECURE ApS’ processing of employees’ answers in the risk assessment assistant, where the customer is the data controller and PRECURE the data processor. The customer accepts it together with the terms of sale when buying the risk assessment assistant. Its structure follows the European Commission’s standard contractual clauses under GDPR Article 28(7) (Implementing Decision (EU) 2021/915). The Danish version applies if the versions differ.
1. Parties and background
The data controller: the company that has bought the risk assessment assistant (“the customer”), as stated at purchase.
The data processor: PRECURE ApS, CVR 46512987, Bryggeristræde 2, 3770 Allinge, Denmark, mail@precure.dk (“PRECURE”).
The customer uses the risk assessment assistant to make its workplace risk assessment and to collect its employees’ answers. In doing so, PRECURE processes personal data about the customer’s employees on the customer’s behalf.
2. Purpose and relation to the terms of sale
This agreement ensures that PRECURE processes personal data in line with the General Data Protection Regulation (GDPR), in particular Article 28(3), and the Danish Data Protection Act.
This agreement forms part of the terms of sale for the risk assessment assistant. If the terms of sale and this agreement differ on the processing of personal data, this agreement prevails.
This agreement does not cover the data PRECURE is itself the controller of, such as the customer’s account, purchases and invoicing. The privacy policy describes those.
3. The controller’s rights and obligations
The customer is responsible for the processing being lawful, including having a legal basis and informing the employees about the processing under GDPR Article 13.
The customer decides which items employees are asked about, who receives the survey link, and who in the company has access to the assessment. The customer must not use free-text fields or its own items to collect sensitive data that the assessment does not need.
4. The processor acts on instructions
PRECURE processes the personal data only on documented instructions from the customer. The instructions consist of this agreement with Annex C and the choices the customer makes in the risk assessment assistant. The customer may give further written instructions, as long as they stay within the functions of the risk assessment assistant.
PRECURE does not process the data for its own purposes, such as marketing or training AI models.
If EU or Danish law requires PRECURE to process the data in another way, PRECURE tells the customer before the processing takes place, unless the law forbids it.
If PRECURE believes an instruction breaks the GDPR or other data protection law, PRECURE tells the customer immediately.
5. Confidentiality
Only people at PRECURE who need it to run and maintain the risk assessment assistant have access to the data. They are bound by confidentiality by agreement or by law, and their access is removed when the need ends. PRECURE only looks at the customer’s data when needed to fix a fault or when the customer asks.
6. Security of processing
PRECURE implements the technical and organisational measures required by GDPR Article 32, based on the risk to the employees’ rights. The measures are listed in Annex C.
PRECURE may change the measures, as long as the level of security does not go down.
7. Sub-processors
The customer gives PRECURE general prior authorisation to use sub-processors. The sub-processors used when the agreement is made are listed in Annex B and are approved.
PRECURE tells the customer by email at least 30 days before adding or replacing a sub-processor. The customer may object within that period. If the parties cannot agree, the customer may cancel the subscription from the date of the change and get back the proportionate part of the prepaid price.
PRECURE imposes the same data protection obligations as in this agreement on each sub-processor by a written agreement. PRECURE remains liable to the customer for the sub-processors’ compliance.
8. Transfers to third countries
PRECURE only transfers personal data to countries outside the EU/EEA on the customer’s instructions, given with this agreement, and only to the sub-processors and countries listed in Annex B.
Transfers rely on the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) or the EU-US Data Privacy Framework where the sub-processor is certified under it, in line with GDPR Chapter V.
Only the data the AI functions need is transferred to the USA: the items, ratings, descriptions, totals and comments without names. Names and raw anonymous answers do not leave the EU.
9. Assistance to the controller
PRECURE helps the customer, as far as possible, to meet the employees’ rights under GDPR Chapter III, such as access, rectification and erasure. The customer can view, export and delete assessments and answers in the risk assessment assistant itself. Answers without a name cannot be linked to a particular employee, so PRECURE cannot find or hand over one employee’s anonymous answers either.
If an employee sends a request directly to PRECURE, PRECURE forwards it to the customer without undue delay.
PRECURE also helps the customer with security of processing, breach notification, impact assessments and prior consultation of the supervisory authority under GDPR Articles 32–36, with the information PRECURE holds. Help beyond what the risk assessment assistant can do itself is charged by time spent, as agreed.
10. Personal data breaches
PRECURE notifies the customer without undue delay and no later than 48 hours after becoming aware of a security breach affecting the customer’s data. This gives the customer time to notify the supervisory authority within 72 hours.
The notification describes, as far as possible, the nature of the breach, the categories and approximate number of employees and records affected, the likely consequences, and what PRECURE has done or proposes to deal with the breach. Information not yet known is sent later.
11. Deletion and return
The customer can export and delete its assessments and the employees’ answers in the risk assessment assistant at any time.
Apart from that, PRECURE deletes automatically:
- employees’ answers 12 months after the survey is closed
- an assessment with its answers 4 years after its last change
When the subscription ends, the customer can still view, export and delete its assessments until they are deleted under the periods above. The customer can ask for everything to be deleted at once by writing to mail@precure.dk. No backups are taken, so deleted data cannot be restored (see Annex C).
PRECURE may only keep the data longer if EU or Danish law requires it.
12. Audits and inspections
PRECURE makes available the information the customer needs to see that this agreement and GDPR Article 28 are complied with. This is done mainly by PRECURE sending, on request once a year, a written account of the security measures and the sub-processors, with the sub-processors’ own audit reports (such as ISO 27001 or SOC 2) where they exist.
In addition, the customer or an independent auditor bound by confidentiality may inspect PRECURE with at least 30 days’ notice. The customer pays its own costs and PRECURE’s time, unless the inspection shows material breaches of this agreement.
The Danish Data Protection Agency and other authorities always have access under the law.
13. Commencement, changes and termination
This agreement takes effect when the customer buys the risk assessment assistant and applies for as long as PRECURE processes personal data for the customer, also after the subscription has ended, until the data is deleted under Section 11.
PRECURE may change this agreement with 30 days’ notice by email if the change is caused by new legislation, new standard contractual clauses or changes of sub-processors under Section 7. Other changes require the customer’s acceptance.
This agreement is governed by Danish law. Disputes are settled under the venue rules in the terms of sale.
Annex A: Details of the processing
| Topic | Description |
|---|---|
| Purpose | To let the customer make its risk assessment, collect employees’ ratings of the working environment and get suggestions for an action plan |
| Nature of processing | Collection through a survey link, storage, aggregation (medians, counts, distribution), display to the customer, AI suggestions without names, export and deletion |
| Data subjects | The customer’s employees who answer the survey; people mentioned in the customer’s own descriptions and action plan |
| Ordinary data | Name and, optionally, department for physical items; ratings from 1 to 5; comments |
| Sensitive data | Musculoskeletal discomfort (health data, GDPR Article 9) and ratings of the psychosocial working environment. Both are answered without a name or other identifier and shown only as totals once at least 3 have answered |
| Duration | As long as the customer uses the risk assessment assistant, and until the data is deleted under Section 11 |
Annex B: Sub-processors
| Sub-processor | Task | Data | Location | Transfer basis |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd. (Azure) | Hosting the risk assessment assistant and storing assessments and answers | All data in Annex A | EU (European Azure region) | No transfer |
| Anthropic, PBC | AI check of the customer’s own items and action plan suggestions | Items, ratings, descriptions, totals and comments without names | USA | Standard contractual clauses in Anthropic’s data processing agreement |
SendGrid and Stripe are not listed, because they only process the customer’s contact and payment data, which PRECURE is itself the controller of.
Annex C: Instructions and security measures
Instructions. PRECURE processes the data to provide the functions of the risk assessment assistant as described in Annex A and the terms of sale, and according to the choices the customer makes in the tool.
Location. The data is stored in Microsoft Azure in a European region. Only the data listed for Anthropic in Annex B is sent to the USA.
Security measures
- Customer access: sign-in with a one-time link sent by email; the session is a signed cookie only the server can read (HttpOnly). The email address is not stored, only a keyed hash of it.
- Employee access: the survey is reached with a long random token. Employees have no account and cannot see others’ answers.
- Anonymity: answers without a name are stored in a separate table with no respondent id, token, IP address, browser details or time finer than the date. The rows are rewritten on each new answer, so the storage timestamps cannot tell them apart. The customer sees only totals from 3 answers, and raw anonymous answers never leave the server.
- Encryption: all traffic over HTTPS; data is encrypted at rest in Azure.
- Data minimisation towards AI: names are never sent to the AI.
- Logging: request contents are not logged; only error codes.
- Access at PRECURE: only the people who run the service, with personal accounts and two-factor authentication for Azure.
- Deletion: automatic under Section 11, run daily.
- Backups: no separate backups are taken. Microsoft Azure keeps three copies of the data in the same data centre in the EU (locally redundant storage) to protect against hardware failure. The copies are deleted at the same time as the data itself. The customer can export its assessments at any time.