Data processing agreement — kex.dk

Version 1.0 · 20 October 2026

1. Parties and conclusion

This data processing agreement ("the agreement") is made between the customer using kex.dk ("the controller") and LynBro ApS, CVR no. 46321499, Rødovre Parkvej 276, 2610 Rødovre, Denmark ("the processor"), pursuant to Article 28(3) of the General Data Protection Regulation (GDPR).

The agreement forms part of the terms of service ("the main agreement") and is concluded when the controller accepts the main agreement electronically. The time and the accepted version are recorded. The controller can get a signed copy by writing to info@lynbro.dk. In case of conflict this agreement prevails over the main agreement as regards processing of personal data; otherwise the main agreement applies.

2. The processing

The processor processes personal data on behalf of the controller to provide kex.dk under the main agreement. The purpose, nature, categories of data subjects and data, and duration of the processing are described in Annex A.

The controller is responsible for the lawfulness of the processing, including having a valid legal basis, informing data subjects, the accuracy of the data, and the content, texts and settings the controller chooses in the service — also when they are based on templates from the processor. Special categories of data (GDPR Articles 9 and 10) and CPR numbers may only be processed in the service if kex.dk is expressly designed for it, or if the parties have agreed so in writing.

3. Instructions

The processor processes personal data only on documented instructions from the controller. The main agreement, this agreement and the controller's settings and actions in the service constitute the complete instructions. Further instructions are given in writing (email is sufficient); instructions beyond the service's features may be declined by the processor or carried out against payment at the current hourly rate.

The processor immediately informs the controller if, in the processor's opinion, an instruction infringes data protection law, but is not obliged to carry out a legal assessment of the instruction. If EU or Danish law requires the processor to process the data, the processor informs the controller unless the law prohibits it.

4. Confidentiality

The processor ensures that only persons who need it have access to the data and that they have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

5. Security

The processor implements appropriate technical and organisational measures under GDPR Article 32, as described in Annex C. The processor may change the measures as long as the overall level of security is not reduced.

The controller has assessed that the measures are appropriate for the processing. The controller is itself responsible for the security of what the controller controls, including its own users, passwords, API keys, integrations and the data the controller chooses to send to third parties through the service.

6. Sub-processors

By this agreement the controller gives general prior authorisation for the processor to engage sub-processors. The sub-processors used when the agreement is concluded are listed in Annex B; the current list is always on the sub-processors page.

The processor notifies the controller at least 30 days before a new sub-processor is engaged or an existing one is replaced, by email to the account's address and/or in the service and on the list. Within that period the controller may raise a reasoned objection on data protection grounds. If the parties cannot find a solution, the controller may terminate the affected part of the main agreement without cost with effect from the date of the change and get prepaid amounts for the period after termination back; this is the controller's sole remedy in respect of the change.

If a sub-processor must be replaced sooner because it ceases operations, breaches its obligations or poses a security risk, the processor may do so with shorter notice or immediately and notifies as soon as possible; the controller's right to object and terminate applies correspondingly.

The processor imposes the same data protection obligations on sub-processors as in this agreement and is liable to the controller for their performance under section 12. Services that the controller itself connects or instructs (e.g. social networks, accounting systems, webhooks or its own integrations) are not the processor's sub-processors; their own terms apply.

7. Transfers to third countries

Personal data is transferred to countries outside the EU/EEA only on instructions or via sub-processors under section 6, and only with a valid transfer basis under GDPR Chapter V, e.g. the European Commission's decision on the EU-US Data Privacy Framework or EU standard contractual clauses. The transfer basis for each sub-processor is shown in Annex B. By this agreement the controller authorises the processor to enter into EU standard contractual clauses with sub-processors on the controller's behalf where necessary.

8. Assistance to the controller

The processor assists the controller as far as possible in responding to requests from data subjects (GDPR Articles 12-22) and in complying with Articles 32-36, taking into account the nature of the processing and the information available to the processor. The service's features for searching, exporting, correcting and deleting data are the primary assistance.

If the processor receives a request directly from a data subject, it is forwarded to the controller without undue delay; the processor does not respond itself unless the controller instructs it to. Assistance beyond the service's features and normal operation is paid for by time spent at the current hourly rate.

9. Personal data breaches

The processor notifies the controller without undue delay and where possible no later than 48 hours after becoming aware of a personal data breach concerning the controller's data. The notification contains the information available to the processor at the time, cf. Article 33(3), and is supplemented as more information becomes available.

The controller assesses and makes any notification to the Danish Data Protection Agency and to data subjects. The processor immediately takes reasonable measures to contain the breach.

10. Documentation and audits

On request the processor makes available the information necessary to demonstrate compliance with Article 28, primarily as a written description of the processing and the security measures.

If that information is insufficient, the controller may, no more than once a year and with at least 30 days' written notice, have an independent auditor bound by confidentiality carry out an audit. The audit may not give access to other customers' data or disrupt operations unnecessarily. The controller bears its own costs and pays the processor's time at the current hourly rate unless the audit reveals a material breach. Audits by an authority are carried out as the authority requires.

11. Termination, deletion and return

When the main agreement ends, the controller may export its data for 30 days using the service's features; any other form of return is paid for by time spent. The processor then deletes the data within a further 30 days. Copies in backups are deleted with the normal backup cycle and no later than 90 days after termination. The processor may keep data if EU or Danish law requires it, and only for as long as required.

12. Liability

Each party is liable under the general rules of Danish law with the limitations that follow from the main agreement. The processor's total liability under this agreement and the main agreement together is limited as stated in the main agreement (the amount the controller has paid for the service in the 12 months before the event giving rise to the claim), and the processor is not liable for indirect loss. The limitations do not apply in case of intent or gross negligence. GDPR Article 82 on liability towards data subjects is not affected.

The controller indemnifies the processor against claims, fines and reasonable costs from third parties, including data subjects and authorities, resulting from the controller's failure to comply with its obligations as controller or from processing carried out on the controller's instructions.

13. Term, changes and transfer

The agreement applies for as long as the processor processes personal data for the controller and then ends automatically.

The processor may change the agreement with 30 days' notice under the main agreement's change rules when required by changed rules, a decision of an authority, new standard clauses or changes in the service; changes that reduce the protection of the data require the controller's consent. Sub-processors are changed under section 6.

Transfer. The processor may transfer this agreement, including rights and obligations and the personal data processed in connection with the service, to another company as part of a transfer of the service or the part of the business that operates it. The controller is notified in writing at least 30 days before the transfer, with the new processor's name and CVR number. The new processor assumes all obligations under this agreement. Within that period the controller may object and terminate this agreement and the affected part of the main agreement free of charge with effect from the date of transfer.

14. Governing law and venue

The agreement is governed by Danish law. Disputes are settled by the City Court of Copenhagen (Københavns Byret) as the court of first instance.

Annex A — The processing

Annex B — Sub-processors when the agreement is concluded

Changes are made under section 6. The current list: https://kex.dk/en/subprocessors.

Annex C — Security measures

• Encrypted connections (TLS) to the service and between systems over public networks.
• Server access only via keys for a limited number of people, least privilege and logging of administrative actions.
• Separation of customers' data in the application and role-based access control.
• Security updates, firewall, protection against brute force and automated abuse, and monitoring of operations and errors.
• Regular backups with limited retention.
• Passwords stored as hashes; secrets such as API keys and integration credentials stored encrypted where the service keeps them.
• Procedures for handling personal data breaches and for deletion on termination.