This Data Processing Agreement (the "DPA") sets out the terms on which Dimmi ApS processes personal data on behalf of its clients under Article 28(3) of Regulation (EU) 2016/679 (the "GDPR").

The DPA forms an integral part of the agreement between Dimmi and the Client — whether that agreement is the Terms of Service accepted during onboarding or a separately signed Service Agreement. Where the Client has signed a Service Agreement with its own data processing appendix, that appendix governs and this DPA does not apply.

Processor. Dimmi ApS, CVR no. 46 63 85 73, Karen Blixens Plads 16, 2300 København S, Denmark ("Dimmi" or the "Processor").

Controller. The client identified in the Dimmi account (the "Client" or the "Controller").

Each a "Party" and together the "Parties".

Four annexes form an integral part of this DPA: Annex A (details of the processing), Annex B (sub-processors and delivery partners), Annex C (instructions and security measures) and Annex D (other terms).

1. Preamble and roles#

1.1 These clauses set out the Processor's rights and obligations when processing personal data on behalf of the Controller.

1.2 The clauses are designed to ensure the Parties' compliance with Article 28(3) of the GDPR.

1.3 In connection with the delivery of Dimmi aOS and the associated services — case management of residence and work permits, social security certificates and posted worker notifications, tax support, business travel and remote work compliance, relocation and destination services, the Employee Portal, document handling, Dimmi Counsel, compliance monitoring and notifications — the Processor processes personal data on behalf of the Controller in accordance with these clauses.

1.4 The clauses and their annexes shall be retained in writing, including electronically, by both Parties.

1.5 The clauses do not relieve the Processor of obligations imposed on it directly by the GDPR or any other legislation.

1.6 Role clarification. For the processing described in Annex A, Dimmi acts as processor. For Dimmi's own operational purposes — account administration, error monitoring, security logging and invoicing — Dimmi acts as an independent controller. That processing is not covered by this DPA; it is described in Dimmi's Privacy Policy and recorded in Dimmi's own record of processing activities.

1.7 Delivery model. Dimmi delivers certain services through vetted delivery partners — immigration law firms and licensed advisers, tax and social security providers, relocation agencies, destination service providers and moving companies — engaged per case in the relevant jurisdiction. Where such a partner processes case data on Dimmi's documented instructions, the partner acts as a sub-processor under section 6 and Annex B.3. Where applicable law or professional rules require a partner to be engaged directly by the Controller and to act as an independent controller, section 15 applies instead.

2. The Controller's rights and obligations#

2.1 The Controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24), applicable EU or Member State data protection provisions and these clauses.

2.2 The Controller has the right and the duty to make decisions about the purposes and means of the processing of personal data.

2.3 The Controller is responsible for ensuring that there is a valid legal basis for the processing which the Processor is instructed to perform, and that the information required under Articles 13 and 14 of the GDPR has been provided to the individuals concerned.

3. The Processor acts on instructions#

3.1 The Processor processes personal data only on documented instructions from the Controller, unless required to do so by EU or Member State law to which the Processor is subject. The instructions are specified in Annexes A and C. Subsequent instructions may be given by the Controller while personal data is being processed, and shall always be documented and kept in writing, including electronically, together with these clauses.

3.2 The Processor immediately informs the Controller if instructions, in the Processor's opinion, infringe the GDPR or other applicable data protection law.

3.3 The Processor does not process the Controller's personal data for its own purposes, such as product development or marketing. Operational metadata (error logs, audit trails) is processed solely for security and availability. The Controller's personal data is not used to train or fine-tune AI models.

4. Confidentiality#

4.1 The Processor grants access to personal data only to persons under the Processor's authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only on a need-to-know basis. The list of persons with access is reviewed on an ongoing basis; access is withdrawn where it is no longer necessary.

4.2 The Processor shall, at the Controller's request, be able to demonstrate that the persons concerned are subject to the confidentiality obligation. The obligation survives termination of these clauses.

4.3 Employees handling personal data receive onboarding training in the GDPR and data minimisation, and annual refresher training in connection with incident exercises.

5. Security of processing#

5.1 Pursuant to Article 32 of the GDPR, the Parties — taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks for natural persons — implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, as relevant: (a) pseudonymisation and encryption of personal data; (b) the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services; (c) the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing, assessing and evaluating the effectiveness of the measures.

5.2 The Processor has implemented the technical and organisational measures described in Annex C.2 and in the Security Measures document published at dimmi.dk/en/legal/security-measures, and evaluates and updates these on an ongoing basis.

5.3 The Processor assists the Controller with compliance with Article 32 by making necessary information about the measures available. Where identified risks require further measures, these are set out in Annex C.

6. Use of sub-processors and delivery partners#

6.1 The Processor meets the conditions in Article 28(2) and (4) of the GDPR for engaging another processor.

6.2 The Controller grants a general written authorisation for the Processor to engage: (a) the core sub-processors published at dimmi.dk/en/subprocessors; (b) the Client-activated integrations in Annex B.2, to the extent activated by the Controller; and (c) delivery partners within the categories described in Annex B.3, engaged per case in the relevant jurisdiction.

6.3 The Processor gives the Controller at least thirty (30) calendar days' written notice before adding or replacing a sub-processor, including a delivery partner. Notice is given to the contact person under section 14 and published on the authoritative, continuously updated sub-processor list at dimmi.dk/en/subprocessors. The Controller may object within the notice period on reasonable data protection grounds. The delivery partners actually engaged on the Controller's cases are additionally visible per case in the Client Portal.

6.4 The Processor imposes the same data protection obligations as set out in these clauses on its sub-processors by contract, including EU Standard Contractual Clauses where required. For delivery partners this is done through Dimmi's Network Partner Agreement, whose data processing appendix mirrors these clauses: processing on documented instructions only; confidentiality and need-to-know access; minimum security measures equivalent to Annex C.2; no use of case data for own purposes, marketing or AI training; breach notification to Dimmi within 24 hours; erasure or return within 60 days of case completion; audit rights; and EU Standard Contractual Clauses where the partner is in a third country without an adequacy decision. The Processor remains fully liable to the Controller for the sub-processor's performance of its obligations.

6.5 The Processor includes the Controller as a third-party beneficiary in its agreements with sub-processors, so that the Controller — in the event of the Processor's bankruptcy or cessation — can enforce the agreement directly against the sub-processor.

6.6 Copies of sub-processor agreements and subsequent amendments are, at the Controller's request, provided to the Controller. Provisions on commercial terms that do not affect the data protection content need not be provided.

6.7 Public data sources that contain no personal data — exchange rates, maps, travel advice and similar — are not sub-processors. Public authorities to which an application or notification is submitted are not sub-processors; they are recipients, and are identified in Annex A.7.

7. Transfers to third countries#

7.1 Any transfer of personal data to third countries or international organisations takes place only on documented instructions from the Controller and in compliance with Chapter V of the GDPR. The agreement between the Parties and these clauses constitute such instruction for the transfers described in this section.

7.2 The Processor's primary hosting and processing of the Controller's personal data takes place in the EU/EEA (Hetzner, Germany and Finland).

7.3 Certain core sub-processors process personal data outside the EU/EEA. Transfers take place in compliance with Chapter V, including the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), module 3, for US-based sub-processors. Details are set out at dimmi.dk/en/subprocessors and in Annex C.6.

7.4 Destination-country processing. Where a case concerns relocation to, or services in, a jurisdiction outside the EU/EEA, delivery of the service inherently requires that relevant case data is processed in that jurisdiction by the engaged delivery partner and, where applicable, by local authorities as part of the application process. Transfers to delivery partners in third countries without an adequacy decision take place on the basis of the EU Standard Contractual Clauses incorporated into the Network Partner Agreement, supplemented by transfer impact assessments, or on the basis of Article 49(1)(b) where the transfer is necessary for the performance of a contract in the interest of the data subject. Disclosures to public authorities as part of an application are made at the Controller's instruction as necessary for the case.

7.5 The Processor has carried out documented Transfer Impact Assessments ("TIAs") for transfers to third countries, in accordance with EDPB Recommendations 01/2020. The Processor maintains the TIAs, reviews them annually and upon material changes, implements supplementary measures where necessary, and makes the current TIA package available to the Controller on request and upon significant updates.

8. Assistance to the Controller#

8.1 Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in fulfilling the Controller's obligation to respond to requests for the exercise of data subjects' rights under Chapter III of the GDPR. Details are set out in Annex C.3. Requests received directly from data subjects are forwarded to the Controller without undue delay.

8.2 The Processor further assists the Controller with: (a) notification of personal data breaches to the supervisory authority; (b) communication of breaches to data subjects; (c) data protection impact assessments (Article 35); and (d) prior consultation (Article 36).

8.3 The Processor makes available, on request, the information necessary to demonstrate compliance with Article 28, including extracts from its record of processing activities, the sub-processor list, documentation of security measures, and incident response and disaster recovery procedures.

9. Notification of personal data breaches#

9.1 The Processor notifies the Controller without undue delay after becoming aware of a personal data breach concerning the Controller's personal data.

9.2 Notification takes place, where possible, no later than twenty-four (24) hours after the Processor has become aware of the breach, so that the Controller can comply with its 72-hour deadline for notification to the supervisory authority under Article 33 of the GDPR.

9.3 The notification contains, as a minimum and to the extent available, the information required by Article 33(3): the nature of the breach, the likely consequences, and the measures taken or proposed.

9.4 The Processor documents all breaches in an internal breach register, available to the Controller on request, and follows documented incident-handling procedures.

10. Erasure and return of data#

10.1 On termination of the processing, the Processor — at the Controller's choice — erases or returns all personal data processed on behalf of the Controller no later than sixty (60) days after termination, and confirms this to the Controller, unless EU or Member State law requires storage. Specific erasure and retention periods are set out in Annex C.5.

10.2 Where erasure is impracticable because the data is held in encrypted backup archives, the data is blocked from further processing and erased on expiry of the backup lifecycle, and remains subject to the security and confidentiality obligations of these clauses until then.

11. Audit, including inspection#

11.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 and these clauses, and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Procedures are set out in Annexes C.7 and C.8.

11.2 The Processor may satisfy the audit right by making third-party attestations available where such exist. Dimmi ApS is not yet ISO 27001 or SOC 2 certified. ISO 27001 implementation is underway, with certification expected in 2026. Hosting is delivered from Hetzner's ISO 27001-certified EU data centres.

11.3 The Processor grants supervisory authorities that have statutory access to the Parties' facilities access against proper identification.

12. Other terms#

12.1 The Parties may agree other provisions concerning the processing, for example on liability, provided these do not conflict with these clauses or prejudice the rights of data subjects. Such provisions are set out in Annex D.

13. Commencement and termination#

13.1 These clauses take effect together with the agreement between the Parties and are binding without separate signature where they form part of the Terms of Service accepted during onboarding.

13.2 Either Party may require the clauses renegotiated if changes in law or material inexpediency give rise to this.

13.3 The clauses apply for as long as the processing lasts, plus the period necessary for erasure or return under section 10.

13.4 Termination of the agreement between the Parties automatically terminates these clauses, subject to section 10 and section 4. Provisions that by their nature survive termination remain in force.

14. Contact persons#

14.1 The Controller: the administrator user registered in the Client Portal, unless the Controller designates another contact in writing.

14.2 The Processor: Massimo Hansen, Data Protection Officer — massimo@dimmi.dk. General privacy enquiries: info@dimmi.dk. Sub-processor notices are sent to the Controller's contact person and published at dimmi.dk/en/subprocessors.

15. Authorised disclosure to independent professional advisers#

15.1 Where applicable law or professional rules require that regulated advice or representation on a case — typically legal advice by a law firm, or regulated tax advice — is provided under a direct engagement between the Controller (or the data subject) and the adviser, the adviser acts as an independent controller for that processing and not as a sub-processor.

15.2 The Controller authorises Dimmi to disclose to such an adviser the case data necessary for the engagement. The adviser engaged on a case is visible in the Client Portal. Dimmi ensures by contract that the adviser: (a) uses the data only for the engagement; (b) complies with the GDPR or, outside its scope, provides materially equivalent protection; (c) applies security measures at least equivalent to Annex C.2; (d) notifies breaches affecting the case without undue delay; and (e) erases the data when no longer required for the engagement or statutory retention.

15.3 The adviser's professional liability and duty of confidentiality towards the Controller or the data subject are governed by the direct engagement and applicable professional rules.

Annex A — Details of the processing

A.1 Purpose. Delivery of Dimmi aOS and the associated services: case management of residence and work permits; social security certificates (A1 and equivalents under bilateral and totalisation agreements) and posted worker notifications; tax support, including residence and liability questions, arrival and departure, and special regimes; business travel and remote work threshold tracking; relocation and destination services; the Employee Portal (documents, status, settling in); Dimmi Counsel; document handling with AI-assisted extraction and quality control; compliance monitoring of permits, certificates, visas and expiry dates; eligibility and cost projections; audit logging; and email notifications.

A.2 Nature of the processing. Collection, registration, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission (including to delivery partners and authorities as part of a case), alignment, restriction, erasure and destruction.

A.3 Categories of data subjects. The Controller's employees and candidates who are the subject of a case; their accompanying family members; the Controller's users of the platform and contact persons.

A.4 Types of personal data.

A.5 Special categories (Article 9). The processing is not directed at special categories of personal data. Immigration, tax and relocation casework may, however, incidentally involve such data where the process requires it — for example medical certificates, biometric data collected by authorities, or documents that indirectly reveal such information. Such data is processed only to the extent necessary for the case and protected by the measures in Annex C.2.

A.6 Criminal convictions and offences (Article 10). Certain immigration routes and background screening processes require submission of a criminal record certificate or a declaration of good conduct. Where a case requires this, the document is processed solely for submission to the competent authority and is subject to the retention schedule in Annex C.5.

A.7 Recipients that are not sub-processors. Public authorities to which an application, notification or registration is submitted as part of a case act as independent controllers for their own processing. These include, depending on the case: the Danish Agency for International Recruitment and Integration (SIRI), the Danish Tax Agency (Skattestyrelsen), Udbetaling Danmark, the Danish Business Authority (RUT), the Danish Civil Registration System (CPR), the Danish Agency for Labour Market and Recruitment, and the equivalent authorities in other jurisdictions where a case is filed.

A.8 Duration. The processing lasts for the term of the agreement between the Parties plus the retention periods in Annex C.5.

Annex B — Sub-processors and delivery partners

Authoritative list, continuously updated: dimmi.dk/en/subprocessors

The list published at that address is the authoritative record of Dimmi's sub-processors at any given time. It states, for each sub-processor, the purpose of the processing, the categories of data involved, the location, the transfer mechanism and a link to the relevant data processing agreement. This annex describes the categories and the authorisation mechanism; it does not duplicate the list.

B.1 Core sub-processors. Engaged for all production environments, covering authentication and session management, application hosting, document and backup storage, AI inference and document processing, transactional email, optional payment processing and error monitoring. Additions and replacements are notified under section 6.3.

B.2 Client-activated integrations. Engaged only where the Controller configures the integration in its own environment. Dimmi maintains a standard catalogue of HR, identity and case management integrations — including employee master data synchronisation, single sign-on against the Controller's identity provider, and document or case synchronisation with the Controller's own systems. An integration provider becomes a sub-processor for the Controller only once the Controller activates it. Addition or replacement of an integration provider is notified under section 6.3. The integrations currently activated for the Controller are visible in the Client Portal.

B.3 Delivery partners. Engaged per market and per case type, and receiving only the data necessary for the specific case. The authorised categories are: immigration law firms and licensed immigration advisers; tax and social security service providers; relocation agencies and destination service providers; and international moving companies. The current list of named delivery partners by service area and market is published at dimmi.dk/en/subprocessors and made available to the Controller on request. The partner actually engaged on a given case is visible per case in the Client Portal. Each delivery partner is bound by Dimmi's Network Partner Agreement, as described in section 6.4. Partners acting as independent controllers under applicable professional rules are covered by section 15, not by this annex.

Annex C — Instructions and security measures

C.1 Instruction. The Processor processes personal data solely for the purposes and on the terms set out in Annex A, the agreement between the Parties and these clauses, including engaging delivery partners and disclosing case data to competent authorities as necessary to deliver the requested services. The Controller may give supplementary written instructions via the contact person in section 14 or via the platform. The Controller's creation and initiation of a case in the Client Portal constitutes a documented instruction to process and disclose the data necessary for that case to the relevant authority and delivery partner.

C.2 Technical and organisational measures (Article 32). The measures below are summarised here and described in full in the Security Measures document at dimmi.dk/en/legal/security-measures.

C.3 Assistance with data subjects' rights. Article 15 (access) and Article 17 (erasure) via the platform's self-service functions with a 30-day service level; Article 16 (rectification) via profile editing; Articles 18 and 21 (restriction and objection) handled manually via massimo@dimmi.dk or info@dimmi.dk. Requests received directly from data subjects are forwarded to the Controller without undue delay. The Processor further assists with data protection impact assessments and prior consultation (Articles 35–36).

C.4 Processing locations. Processing takes place at locations in the EU/EEA (Hetzner, Germany and Finland), at the sub-processors published at dimmi.dk/en/subprocessors, and — for cases with a destination outside the EU/EEA — at the engaged delivery partner in the relevant jurisdiction, per section 7.4.

C.5 Erasure and retention schedule.

On termination, personal data is erased or returned no later than 60 days after termination per section 10.1, unless statutory retention applies.

C.6 Third-country transfers and transfer impact assessments. The transfer mechanism for each sub-processor outside the EU/EEA is stated on the authoritative list at dimmi.dk/en/subprocessors. Transfers rest on the EU Standard Contractual Clauses (module 3, Commission Implementing Decision (EU) 2021/914) together with the sub-processor's own data processing agreement, or on an adequacy decision where one applies. For delivery partners outside the EU/EEA, transfers rest on the Standard Contractual Clauses incorporated into the Network Partner Agreement or on Article 49(1)(b), with a transfer impact assessment completed before go-live.

A documented TIA exists for every transfer to a third country without an adequacy decision. Each TIA covers the legal framework of the destination country, the categories of data involved, the transfer mechanism and the supplementary technical and organisational measures applied. TIAs are approved by the Processor's Data Protection Officer, reviewed at least annually and on material change, and the current package is made available to the Controller and its advisers on request.

C.7 Procedures for the Controller's audits. The Controller may conduct an audit once per year with at least 30 days' notice, and more frequently where a material breach is suspected. The Processor may satisfy the audit right through third-party attestation where one exists. Audits must not unduly disrupt operations, and do not extend to data belonging to other clients of the Processor.

C.8 Supervision of sub-processors and delivery partners. The Processor supervises sub-processors and delivery partners through their data processing agreements, their attestations and — for delivery partners — the onboarding declarations in the Network Partner Agreement, and forwards documentation to the Controller on request. TIAs for third-country transfers are reviewed annually.

Annex D — Other terms

D.1 Remuneration. The Processor's remuneration for processing under these clauses is included in the fees under the agreement between the Parties, unless otherwise agreed in writing. Assistance with data protection impact assessments and with data subjects' rights, and changes to the instruction that do not follow from changes in law, are invoiced on the basis of a prior written quote.

D.2 Liability. The Parties' liability is governed by the liability provisions of the agreement between the Parties and by Danish law. The Processor is liable in accordance with Article 82 of the GDPR. Nothing in these clauses limits the rights of data subjects.

D.3 Order of precedence. In the event of conflict, the following order applies: 1) this DPA; 2) the Service Agreement or Terms of Service; 3) any other appendix.

D.4 Amendments. Amendments to these clauses must be in writing and accepted by both Parties. The Processor may update the annexes to reflect changes in sub-processors, security measures or retention periods, subject to the notice obligations in section 6.3.

Previous versions of this document are available at dimmi.dk/en/legal/archive.