This agreement is entered into between the Customer and Make AS, org. no. 993 555 002 (Make).

The Customer accepts this agreement from the moment the Customer registers an account in the Service. Questions regarding the agreement should be directed to support@make.as.

1. The Service

The agreement applies to the Customer's subscription to Make's Service, which allows the Customer to communicate with the Customer's contacts (Recipient) via email and SMS. The Service may also provide options for publishing to various online channels.

The Customer's subscription is limited to a right to use the Service as described by Make.

For critical errors, Make will perform bug fixing without undue delay. Critical errors mean errors that the Customer cannot easily bypass and which result in system downtime, data loss, or the failure of other functions critical to the Customer.

For necessary maintenance, a time window is set between 01:00 and 05:00 on the night leading to Saturday every first and third Saturday of the month. Planned work on the service where downtime is likely will be carried out during this period without further notice.

Error reporting must be submitted in writing via email to support@make.as.

Otherwise, the Service is delivered "as is", and the Customer's use of the Service is at their own risk.

2. Data Protection

The Customer decides which personal data about the Recipient is registered in the Customer's account in the Service, and the Customer decides if and which personal data is to be used in communications from the Service. The Customer is therefore the data controller for the personal data uploaded to the Service.

Make's processing of the personal data uploaded by the Customer to the Service is highly limited. For the processing that does occur, Make acts as the data processor, and the data processing agreement is attached to this agreement.

3. Customer Obligations

The Service may only be used by the enterprise (org. no.) registered as the Customer, and the Customer may not use the Service as part of a delivery to other enterprises or individuals.

The Customer is responsible for ensuring good security regarding the Customer's username and password for logging into the Customer's account in the Service.

The Customer is responsible for having a valid legal basis for all personal data uploaded to the Customer's account in the Service, in accordance with the Personal Data Act (GDPR). Sensitive personal data (GDPR art. 9) must not be stored in the Customer's account in the Service.

The Customer is responsible for complying with the provisions of the Marketing Control Act regarding distribution via email and SMS.

The Customer must follow Make's anti-spam guidelines: www.make.as/antispam

4. Payment

The price for the Customer's use of the Service is set out in Make's price list excl. VAT: www.make.as/priser
Licenses are invoiced in advance for the period unless otherwise agreed.

Make has the right to change prices with 30 days' notice. The Customer has the right to terminate the agreement before the new prices take effect, and any advance payments will be refunded in such cases.

Invoices are sent electronically to the email address registered by the Customer on their account. The Customer must register all information necessary for the Customer's accounting systems to accept the invoice.

5. Changes

The Customer can upgrade the subscription at any time. The change will take effect immediately and with the same period length as the previous period. The Customer will be credited for any advance payment for the remaining time of the previous period.

The Customer can downgrade the subscription at any time. The change will take effect from the expiry of the existing period. Downgrading the subscription may result in the loss of content, features, or capacity in the Service. Downgrading will not entitle the Customer to a refund of any advance payment for the period.

If Make fails to enforce any right under this agreement, this shall not be construed as a waiver of that right.

6. Duration of the Agreement

The agreement takes effect from the moment the Customer registers an account in the Service, and the subscription is automatically renewed for the agreed period length.

To avoid automatic renewal, the Customer must cancel the subscription more than 30 days before the expiry of the active period. Cancellation does not entitle the Customer to a price reduction or refund for activated periods.

Make can terminate the subscription with effect 3 months after notice is given. Any advance payment for the period after the expiry of the 3-month deadline will be refunded.

Termination of the subscription will result in the deletion of the Customer's account. All information, such as newsletters, statistics, Recipient details, etc., will be deleted when the Customer's account is deleted. A deleted account cannot be restored. Prior to deletion, the Customer will be given a 30-day deadline to export information from the customer account in the Service.

7. Breach of Contract

Make may terminate the agreement with immediate effect by closing the Customer's access to the Customer's account in the Service if the Customer:

• Breaches Make's anti-spam guidelines.

• Uploads sensitive personal data to the Customer's account in the Service.

If the agreement is terminated by Make, the Customer is not entitled to a refund for prepaid periods.

The Customer shall indemnify Make against claims from Recipients or other third parties where the claim arises from the Customer's use of the Service.

Make cannot be held liable for losses incurred by the Customer due to downtime in the Service.

For other errors in the Service, Make is only liable for the Customer's direct losses. Liability is limited to the amount paid by the Customer in the last 12 months.

The limitations of liability described above do not apply to Make's liability for breaches of data protection regulations. Make's liability for such breaches is set out in the data processing agreement.

8. Governing Law and Legal Venue

This agreement is governed by Norwegian law, and Oslo District Court is the legal venue for any disputes.

Data Processing Agreement

The appendix is available for download on the customer's account here: My Company > DPA

• Appendix 1, List of sub-processors

• Appendix 2, Technical and organizational measures

1. Processing of Personal Data

Make is the data processor and shall process personal data in accordance with applicable data protection regulations, the data controller's instructions, and this agreement.

Make's processing of personal data on behalf of the data controller is highly limited, as the data controller utilizes Make's technical solution for communication with their own contacts.

The data controller decides which personal data about their own contacts is registered in the data controller's account in Make's technical solution. The data controller also decides, via Make's technical solution, if and which personal data is to be used in communications from Make's technical solution.

Relevant personal data will normally include name, email address, mobile number, and potentially other contact details. The data controller must not register sensitive personal data in Make's technical solution.

Make's technical solution will add personal data about the contacts. This relates to the contacts' IP address and statistics linked to the response to communications initiated by the data controller. The data controller can choose to disable this function, or set a deletion routine that provides a shorter retention period than the default setting of the solution.

Make's employees may access the personal data in connection with support, system checks, troubleshooting, and updates.

Apart from the cases mentioned above, Make's processing of personal data is limited to technical access because the data is registered in Make's technical solution. Make has no right to process this personal data in any other way without prior consent from the data controller. Such processing may include restructuring and restoration of personal data due to technical or user errors.

2. Use of Sub-processors

All sub-processors involved in Make's data processing must have their place of business in Norway, and the technical solutions used by the sub-processor must physically be located in Norway.

When Make engages a sub-processor, Make must ensure that the sub-processor signs a contract confirming that the sub-processor commits to following the same requirements for data processing as set out in this agreement. Make is responsible for all processing of personal data carried out by a sub-processor engaged by Make.

The list of sub-processors is attached as Appendix 1 to this agreement. If Make plans to engage a new sub-processor, Make must inform the data controller about the new sub-processor at least 1 month before the sub-processor is granted access to the personal data.

The data controller always has the right to object to Make engaging a new sub-processor, but in such cases, Make has an unconditional right to terminate this agreement and the relevant service contract.

3. Transfer of Personal Data to Other Countries

All data processing must take place in Norway, and Make does not have the right to transfer personal data to anyone not subject to Norwegian law.

4. Make's Obligations

4.1 Make's Duty to Notify of Unlawful Instructions

If Make believes that an instruction from the data controller constitutes a breach of data protection regulations, Make must immediately notify the data controller. In such cases, Make has the right to suspend execution of the instruction until it is confirmed or modified by the data controller.

4.2 Technical and Organizational Measures

Make shall implement appropriate technical and organizational security measures to protect the personal data processed under this agreement. The measures are described in Appendix 2.

If Make becomes aware of a breach of security measures, Make must notify the data controller without undue delay, and at the latest within 1 business day.

4.3 Inquiries from Individuals and Authorities

Upon request from the data controller, Make shall assist in handling inquiries from individuals and authorities. For handling such inquiries, Make is entitled to compensation according to our standard rates. This right to compensation only applies after the data controller has requested assistance in the specific case, and the right to compensation is waived if the inquiry is due to errors attributable to Make.

If an individual or authority contacts Make directly, Make must forward the inquiry to the data controller without undue delay, and at the latest within 1 business day. Make must also attach information about the nature of the inquiry. Make shall not handle such inquiries without instructions from the data controller.

4.4 Audits

The data controller has the right to verify whether Make processes personal data as described in this agreement, and Make shall ensure that the data controller has access to the information needed to perform the audit. Make shall implement measures to allow and contribute to inspections carried out by the data controller or a third party on behalf of the data controller. Such third parties must not be direct competitors of Make and must be bound by confidentiality.

The data controller must notify Make of any planned inspection at least ten days in advance. For other audits, Make shall have 14 days to compile and deliver relevant information to the data controller.

For audits and/or inspections, each party covers its own expenses, including expenses for third parties engaged by the respective party. If the data controller conducts audits and/or inspections more than once a year, Make is entitled to compensation according to our standard rates for assistance with the extra audit/inspection. Make is not entitled to compensation for assistance with extra audits/inspections if they are due to errors on Make's part.

5. Duration and Termination

This agreement is binding between the parties from the moment the data controller begins using Make's technical solution, and runs for as long as Make processes personal data on behalf of the data controller.

If the data controller terminates this agreement, Make has an unconditional right to terminate the relevant service contract.

Upon termination of this agreement, Make shall return all personal data to the data controller, or alternatively delete all personal data if the data controller requests this in writing.

6. Confidentiality

Make shall not disclose to third parties, or otherwise publish information about the personal data or the processing covered by this agreement. Make shall also ensure that confidentiality is maintained by individuals who process or otherwise have access to the personal data.

The duty of confidentiality also applies after this agreement has terminated.

7. Liability

Make is liable for claims from individuals (GDPR Art. 82) and fines from authorities (GDPR Art. 83) resulting from errors attributable to Make. For such claims, Make shall indemnify the Customer. Liability is limited to 4% of Make's annual gross turnover.

8. Governing Law and Legal Venue

This data processing agreement is governed by Norwegian law, and Oslo District Court is the legal venue for any disputes.