Data processing agreement and consultant profile instructions

1. Parties and roles. This agreement is between Independent Consultants AS (IC), organisation no. 832 872 652, Nakkeknausen 4, 6014 Ålesund, Norway, and the consulting house whose name and organisation number are shown at acceptance. The house is the controller of the consultant profiles it registers. IC is the processor and acts under the house's documented instructions. IC contact: richard.gulbrandsen@ic.no, +47 91 31 25 77.

2. Effect. IC offers this agreement electronically. It is concluded when an authorised representative accepts it for the house. It covers new registrations, imports and further processing under the new instructions from acceptance. Within that scope it supplements earlier agreements and prevails over conflicting provisions on processing scope, providers, third countries and backup. It does not alter historical acceptances or retrospectively authorise earlier processing. Norway's Personal Data Act of 15 June 2018 no. 38 and Regulation (EU) 2016/679 apply.

3. Purpose and data. The house instructs IC to receive profiles manually or from its Flowcase account, store and update them on ic.no and in CRM, identify relevant assignments for its consultants and follow up specific submissions. Data includes necessary names, contact details, CVs, titles, skills, experience, availability, assignment links and source, and records of registration, information, consent and privacy requests. The house must avoid unnecessary data. Special categories under Article 9 and criminal-offence data under Article 10 are outside these instructions.

4. Matching, AI and sharing instructions. Processing includes access, storage, CV structuring, search, comparison of skills with assignment requirements, AI analysis and embeddings to support matching. Anthropic provides analysis and Voyage provides embeddings. IC must minimise submitted data and must not opt into the providers' general model training with the content. Voyage must be used with opt out. AI outputs are suggestions requiring human assessment and may be incorrect. These instructions do not permit solely automated decisions with legal or similarly significant effects. CVs and contact details are disclosed to a specific client following the house's submission or other documented instruction and checks of the basis and restrictions. IC must not reuse the house's profiles for independent purposes or make them available to other houses.

5. The house's legal basis. The house is responsible for a valid legal basis for collection, use and disclosure to IC. The registration flow's confirmation of CV consent must be supported by actual, freely given, specific and informed consent from the consultant. A representative's agreement acceptance is not the consultant's consent. If the house relies on another basis, that basis and an adapted flow must be agreed with IC before use; another basis must not be recorded as consent. The house notifies IC when the basis ends or data must be corrected, erased or restricted.

6. Information for consultants. The house provides adequate information before registration or explicitly asks IC to send it on its behalf. Leaving the email option unchecked confirms that the consultant has already received the information. Where IC delivery is selected, the operational target is the next daily run, with follow-up of queues, missing addresses and delivery failures. Information must be provided within the applicable deadline and at earlier contact or disclosure where required. The choice, actor, time, text version and affected profiles are recorded separately from consent. No reply or click is required. IC's published privacy notice and standard information form part of the information the house must provide.

7. Rights and assistance. IC receives requests at richard.gulbrandsen@ic.no and assists the house with access, rectification, erasure, portability, withdrawal, objection and restriction. The house is responsible for decisions and responses concerning its processing. IC records the original receipt date and follows up to allow statutory deadlines to be met. Active restrictions stop the relevant operations and are not removed by a new import. Necessary access and case handling remain available. Automatic house status notices are minimised; necessary case content is shared separately with access controls.

8. Approved subprocessors and tasks. The house authorises: Supabase (database, authentication data and CV storage); Vercel (hosting and server execution); Cloudflare (CRM files, backup and Turnstile); Resend / Plus Five Five, Inc. (email and delivery status); Anthropic, PBC (AI analysis); Voyage AI Innovations, Inc. (embeddings); GitHub, Inc. (isolated backup execution and short-lived encrypted backup artifacts). Google is used for optional Google sign-in; Sanity manages content and agreement texts and must not receive consultant CVs. Flowcase is the house's selected source, and the house must have the right to retrieve the data. Supabase's DPA identifies Supabase Pte. Ltd. as data importer. The providers' own subprocessors are subject to equivalent obligations, oversight and the change-notice requirements below.

9. Countries and transfer instructions. By accepting, the house gives written advance instructions for processing in the EU/EEA and necessary transfers/access in the USA for the US hosting, email, AI and backup services above, and Singapore for Supabase's data importer and necessary operations. This does not permit transfers without a lawful transfer mechanism: IC must apply relevant EU Standard Contractual Clauses, including Module Three where IC is a processor, or a covering adequacy decision, and assess necessary supplementary measures. Primary storage location does not guarantee that all operations occur in the same country. IC must obtain new documented instructions before using other third countries. Support requests must be minimised and should normally contain no consultant data. Transfers must stop if the necessary safeguards cannot be maintained. The house can request copies of relevant transfer safeguards from IC.

10. Provider terms and changes. IC must ensure binding data processing obligations substantially equivalent to this agreement, follow provider terms and remain responsible to the house for subprocessor performance. Public reference terms are supabase.com/legal/dpa, vercel.com/legal/dpa, cloudflare.com/cloudflare-customer-dpa, resend.com/legal/dpa, anthropic.com/legal/data-processing-addendum, voyageai.com/tos (incorporating its DPA) and github.com/customer-terms/github-data-protection-agreement. These links describe provider terms, not unrestricted instructions from the house. IC gives written notice before new subprocessors or material changes are used, normally at least 30 days beforehand, and allows reasoned objections. Unresolved objections or new third countries must be addressed before the affected processing continues.

11. Security, incidents and audit. IC limits access to authorised personnel bound by confidentiality, uses access controls, encrypted transport, protected file storage, logs and backups, and documents Article 32 safeguards. IC assists with risk assessments, data protection impact assessments and regulatory consultation. IC informs the house without undue delay and within 48 hours of becoming aware of a personal data breach and provides information needed for follow-up. The house may obtain necessary documentation and conduct or commission audits under practical arrangements; statutory oversight rights are not limited. IC promptly informs the house if it considers an instruction contrary to data protection rules.

12. Retention and termination. Registration, import and submissions require renewed agreement acceptance at least every 12 months. The agreement's protections remain applicable while IC processes the data. CV consent lasts 12 months; submissions stop on expiry and deletion/archiving is processed after a 90-day grace period. Profiles without a CV are archived after 30 days. The grace period does not authorise processing without a valid basis or override an earlier erasure instruction or withdrawal. At termination IC returns or erases operational data and copies as the house chooses, unless retention is required by law, and documents actions within four weeks. Necessary open cases, restrictions and legal requirements are assessed and recorded individually; they do not generally permit continued matching.

13. Express backup exception. As a specific amendment to earlier requirements to erase all backups within four weeks, the house accepts that restricted-access backups expire within 35 days for daily copies, 400 days for monthly copies and 90 days for deleted/overwritten files in the deletion mirror, measured from creation in that backup class. Encrypted GitHub backup artifacts are kept for up to 7 days. A live mirror must follow source deletions and is not an independent archive. Copies are used only for recovery and continuity, not matching or ordinary use. Subsequent erasures and restrictions must be reapplied before restored data enters production. IC's four-week confirmation must identify remaining backup categories and latest expiry. The exception applies only after acceptance and does not override statutory erasure obligations; requests for earlier erasure must be assessed individually.

14. Evidence and governing law. The house's name and organisation number, logged-in representative, time, version and hash of the complete agreement are stored with acceptance. Acceptance covers the described instructions, named providers, specified countries and backup exception. Norwegian law applies. Disputes are first addressed through dialogue and then before a competent Norwegian court. Confidentiality, return/erasure and oversight duties survive termination while relevant data is still processed.