Data processing for advisers

Three roles

• The client (seller or buyer) is the data controller for the information the client puts on Sitavo — e.g. accounts, employee information in the data room and messages.
• The adviser (the firm) is as a starting point an independent data controller for the information the firm gets access to through Sitavo. The firm determines the purpose itself — its advice to the client — and is subject to its own professional and statutory duties.
• Sitavo is the data controller for the platform: accounts, access control and the log of what the adviser does on the client’s behalf. Sitavo does not process information on the adviser’s behalf and is therefore not the adviser’s data processor.

Why the adviser is normally an independent data controller

A broker, lawyer, accountant or other adviser uses the information for their own professional task: assessing, advising and negotiating. The adviser decides which information is necessary, how it is used in the advice and how long it must be kept (e.g. under anti-money-laundering, bookkeeping or professional rules). Whoever determines the purposes and means is the data controller — even when the task is carried out for the client.

This means the client and the adviser do not need a data processing agreement in the ordinary advisory relationship. Instead, the adviser must have a legal basis of their own (typically the agreement with the client), inform the client about the processing and comply with the terms for Sitavo advisers.

When the adviser may be a data processor

In some tasks the adviser acts solely on the client’s instructions and has no purpose of their own — e.g. when an adviser only maintains the client’s listing, organises documents in the data room or forwards messages for the client. The adviser may then be a data processor for the client, and the GDPR (Article 28) requires a written data processing agreement between client and adviser.

• It is the specific task that decides the role — not the title. If in doubt, agree on it in writing with the adviser.
• An adviser can be a controller for one part of the task and a processor for another.
• Sitavo is not a party to the agreement between client and adviser and does not check it.

What Sitavo takes care of

• The adviser only sees what the client grants access to — for the listings, areas and period the client chooses.
• Everything the adviser does on the client’s behalf — including refused attempts and exports of client lists — is logged and shown to the client.
• The client can change or withdraw the access at any time. The adviser’s access then ends immediately.
• Only the responsible adviser and the colleagues the client can see have access to the client’s information.

Template: data processing agreement between client and adviser

1. Parties

• The data controller (“the client”): [Name / company], [CVR no.], [address].
• The data processor (“the adviser”): [Adviser firm’s name], [CVR no.], [address].

2. Background and purpose

This agreement covers the adviser’s processing of personal data on the client’s behalf in connection with [describe the task, e.g. “maintaining the sales listing and data room for company X on Sitavo”]. The adviser may only process the information for this purpose.

3. Nature and scope of the processing

4. Instructions

The adviser only processes the information on the client’s documented instructions, including the permissions the client has granted on Sitavo. If the adviser considers an instruction to infringe data protection law, the adviser informs the client immediately.

5. Confidentiality

Only people at the adviser’s firm who need the information for the task may access it. They are bound by confidentiality — also after the task has ended.

6. Security

The adviser takes appropriate technical and organisational security measures (GDPR Article 32), including [e.g. personal logins, access control, encryption of portable devices, secure deletion]. Information from Sitavo may only be downloaded when the task requires it.

7. Sub-processors

The adviser may only engage other processors (sub-processors) with the client’s [prior specific / general written] authorisation. Approved sub-processors: [name, task, country]. The adviser imposes the same obligations on sub-processors as in this agreement. Sitavo is the platform the client has chosen and is not the adviser’s sub-processor.

8. Transfers outside the EU/EEA

The information may only be transferred to countries outside the EU/EEA on the client’s instructions and with a valid transfer mechanism. [No transfers / state country and mechanism].

9. Assistance to the client

The adviser assists the client in responding to requests from data subjects (e.g. access or erasure) and with the client’s obligations on security, breach notification, impact assessments and prior consultation (Articles 32–36), insofar as relevant to the task.

10. Personal data breaches

The adviser notifies the client without undue delay and no later than [24/48] hours after becoming aware of a personal data breach, with the information the client needs to notify the Danish Data Protection Agency.

11. Deletion and return

When the task ends, the adviser deletes or returns all personal data at the client’s choice, unless the law requires retention. The access on Sitavo ends when the client withdraws it.

12. Documentation and audits

The adviser makes available the information necessary to demonstrate compliance with this agreement and allows for audits, including inspections, conducted by the client or an auditor mandated by the client.

13. Entry into force and termination

This agreement enters into force on signature and applies for as long as the adviser processes personal data on the client’s behalf. In case of conflict between this agreement and the parties’ other agreements, this agreement prevails as regards the processing of personal data.

Signatures