Updated 21.04.2024

This Cookie Policy explains how Payout Partner AS uses cookies and similar technologies to recognize you when you visit our websites. It details what these technologies are and why we use them, as well as your rights to control our use of them.

What are cookies?

Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used to make websites work or to improve performance, as well as to provide reporting information.

What cookies do we use and why?
We use various types of cookies on our site, including:

Essential Cookies: These are necessary for the site to function and cannot be switched off in our systems. They are set in response to actions made by you such as setting your privacy preferences, logging in, or filling in forms.
Performance and Analytics Cookies: These cookies help us measure and improve the performance of our site, understand which pages are the most and least popular and see how visitors move around the site.
Marketing and Advertising Cookies: These cookies may be set through our site by our advertising partners. They help those companies build a profile of your interests and show you relevant ads on other sites.
Functional Cookies: These enable the website to provide enhanced functionality and personalization. They may be set by us or third-party providers whose services we have added to our pages.

Cookies from Third-Party Services

In addition to the cookies used directly by us, we also use cookies from the following third-party services:
Google Analytics: We use Google Analytics to measure website traffic and track user behavior on our website. For more information about Google Analytics and its use of cookies, please refer to the Google Analytics privacy policy.
SE Ranking: We use SE Ranking for SEO analysis and to track our search engine rankings. For more information about SE Ranking and its use of cookies, please refer to the SE Ranking privacy policy.
Hotjar: We use Hotjar for UX/UI analysis and to track the usage of our products. For more information about Hotjar and its use of cookies, please refer to the Hotjar privacy policy.
Hubspot: We use Hubspot to manage our marketing and sales activities. For more information about Hubspot and its use of cookies, please refer to the Hubspot privacy policy.
Helpscout: We use Helpscout to manage our operations and support activities. For more information about Helpscout and its use of cookies, please refer to the Helpscout privacy policy.
Microsoft Clarity: We improve our products and advertising by using Microsoft Clarity to see how you use our website. By using our site, you agree that we and Microsoft can collect and use this data.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

You have the right to decide whether to accept or reject cookies. You can exercise your cookie rights by setting your preferences in the Cookie Consent Manager. The Cookie Consent Manager allows you to select which categories of cookies you accept or reject. Essential cookies cannot be rejected as they are strictly necessary to provide you with services.

Changes to the Cookie Policy

We may update this Cookie Policy from time to time in response to changing legal, technical, or business developments. When we update our Cookie Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

Contact Us

For any inquiries or concerns about our handling of personal information, please contact us at support@payoutpartner.com.

Updated 21.04.2024

1. Acceptance of Terms

These Terms of Use ("Terms") govern your access to and use of the Payout Partner AS ("Payout Partner", "we", "us", or "our") services. By creating an account, you agree to these Terms in full. You can terminate your account and stop using the services at any time.

2. Description of the Service

Payout Partner provides financial transaction services that facilitate payments to suppliers and contractors. Our services are accessible via our website and involve payment processing, transaction management, and related financial services.

3. Registration and Account Integrity

To use our services, you must register an account. You are responsible for maintaining the accuracy and security of your account information and for all activities that occur under your account.

4. Content and Usage Responsibility

You are responsible for all content you provide and your use of our services, ensuring that it does not infringe on any laws or rights. Misuse of the services may result in account suspension or termination.

5. Data Handling

We process personal information in accordance with our Privacy Policy and applicable data processing agreements. We also utilize cookies to enhance service functionality and gather analytical data.

6. Service Availability and Changes

We may update or change the services and will provide notice of significant changes. We are not liable for the service's unavailability due to maintenance or external factors.

7. Intellectual Property

We own the intellectual property rights to our services and materials provided. These Terms do not grant you any rights to use our trademarks, logos, or service marks.

8. Legal Compliance

You agree to use our services only for lawful purposes and in compliance with these Terms.

9. Termination of Use

You may terminate your account at any time. Upon termination, you must cease all use of the services. Termination does not entitle you to any refunds.

10. Modifications to Terms and Pricing

We may modify these Terms or pricing for our services with prior notice. Continued use of the services after changes indicates your acceptance of the new Terms or pricing.

11. Disclaimer of Warranties

Our services are provided "as is" without warranties of any kind, except as required by law.

12. Limitation of Liability

We are not liable for any indirect, incidental, special, or consequential damages arising from your use of the services.

13. Indemnification

You agree to indemnify and hold harmless Payout Partner from any claims arising from your use of the services.

14. Dispute Resolution

These Terms are governed by Norwegian law. Disputes arising under these Terms will be resolved in Oslo District Court, subject to amicable resolution attempts.

15. Contact Information

If you have any questions about these Terms, please contact us at support@payoutpartner.com.

Appendix 1: Data Processing Agreement (DPA) between the user of the Service ("Controller") and Payout Partner AS ("Processor").

1. INTRODUCTION

By using the Service, the Controller has accepted the Processor's Terms of Use. In order to be able to provide the Service, the Processor will process Personal Data on behalf of the Controller. This agreement document constitutes the data processing agreement between the parties, and will hereinafter be referred to as the "Data Processing Agreement" or “DPA”.

The purpose of the Data Processing Agreement is to regulate rights and obligations in accordance with the current Privacy Legislation in connection with the Processor's processing of Personal Data on behalf of the Controller. The Data Processing Agreement must ensure that Personal Data is processed in accordance with Privacy Legislation and is not used in a way that is unlawful or that unauthorised parties gain access to the Personal Data.

In the event of a conflict between the Agreement and the Data Processing Agreement, the Data Processing Agreement takes precedence when it comes to matters specifically related to the processing of personal data.

2. DEFINITIONS

"Privacy Legislation" refers to EU regulation 2016/679 ("GDPR"), and at any time applicable national legislation related to privacy, including legislation that implements or supplements the GDPR.

"Personal information" means any information about an identified or identifiable natural person (the "Registrants").

"Third country" means countries outside the EU/EEA.

"Sub-processor" means sub-contractors engaged by the Processor to process personal data under this Data Processing Agreement.

For privacy terms that are not defined in this Data Processing Agreement, the definitions in Article 4 of the GDPR apply.

3. RIGHTS AND OBLIGATIONS OF THE DATA CONTROLLER

The Controller has the right and duty to determine the purpose of the processing of personal data and which means are to be used.

The Controller is responsible for ensuring that the processing of personal data takes place in accordance with the Privacy Legislation. The Controller is responsible for, among other things, ensuring that there is a processing basis for the processing of personal data that the Processor is instructed to do.

4. SCOPE OF PROCESSING

1. General

The Processor, its Sub-Processors and others who carry out tasks on behalf of the Processor and have access to the Personal Information shall process the Personal Information only on behalf of the Controller and in accordance with the Agreement, this Data Processing Agreement and the Controller's documented instructions. If other processing is necessary to fulfil obligations to which the Processor is subject in accordance with applicable law, the Processor must notify the Controller as far as this is permitted by law.

The Processor must immediately notify the Controller if the Processor believes an instruction is in breach of the Privacy Legislation.

The processor must keep records of processing activities on behalf of the Controller in line with GDPR Article 30.

2. Overview of the treatment

The nature and purpose of the processing is to obtain and store information and documentation that the Controller uploads to the Service, so that i) the Controller can upload and store the necessary information in the Service, ii) the Processor can obtain the necessary information on behalf of the Controller, and/ or iii) third parties who need said information and documentation can retrieve it where the Data Controller agrees to it.

The processing concerns the name, social security number, address and other information about the Controller that appears in the documentation the Controller uploads to the Service.

3. Confidentiality

The Processor, its Sub-Processors and others who carry out assignments on behalf of the Processor and have access to the Personal Information are subject to a duty of confidentiality and must comply with the duty of confidentiality in connection with the processing of Personal Data in accordance with the applicable Privacy Act. The Processor is responsible for ensuring that Sub-Processors and others who act on behalf of the Processor are subject to such confidentiality obligations. The confidentiality obligation also applies after the termination of the Data Processing Agreement.

4. Security

The Processor must take all measures necessary in accordance with GDPR article 32, including implementing suitable technical and organisational security measures with the aim of achieving a level of security that is suitable in relation to the risk of achieving a suitable level of security.

The Processor must assess the appropriate level of security and take into account the risks associated with the processing, including the risk of accidental or illegal destruction, loss, alteration or unauthorised disclosure or access to Personal Data that has been transferred, stored or otherwise processed.

All transfers of Personal Data between the Processor and the Controller or between the Processor and a third party must be made using adequate security measures, or as agreed between the parties.

Appendix 1 contains a general description of the technical and organisational measures to be implemented by the Processor.

The Processor must also assist the data controller in complying with the data controller's duties according to GDPR article 32, taking into account the nature of the processing and the information available to the Processor. The controller must bear all costs in connection with such assistance.

5. Access to personal data and fulfilment of data subjects' rights

Unless otherwise agreed or follows from applicable legislation, the Controller shall have the right to demand access to Personal Data processed by the Processor on behalf of the Controller. The Controller shall bear all costs in connection with such access, unless the access is available as part of the Service.

If the Processor or Sub-Processor receives a request from the Data Subject regarding the processing of Personal Data, the Processor must forward the request to the Controller, unless the Processor is entitled to handle the request under current legislation or in line with the Controller's instructions.

The Processor shall assist the Controller in fulfilling the Controller's duty to respond to requests submitted by the Data Subjects in order to exercise their rights set out in the Privacy Legislation. This includes, among other things, the data subject's right to access, correction, deletion, limitation, protest and data portability.

6. Other assistance to the controller

If the Processor or a Sub-Processor receives a request from the relevant supervisory authority for access to or information about registered Personal Data or processing activities covered by this Data Processing Agreement, the Processor must notify the Controller of the request, unless the Processor is entitled under current legislation or in line with the Controller's instructions to handle the request.

If the Controller is obliged to carry out an assessment of privacy consequences and/or carry out preliminary discussions with the relevant supervisory authority in connection with the processing of Personal Data under this Data Processing Agreement, the Processor shall assist the Controller.

7. Security breach notification

The Processor must notify the Controller without undue delay, and at the latest within 36 hours, after becoming aware of a security breach in the processing of Personal Data ("Security Breach"). The controller is responsible for reporting security breaches to the relevant supervisory authority.

The notification to the Controller shall, as a minimum, describe (i) the nature of the Security Breach, including, when possible, the categories of and approximate number of Registered and Personal Data affected, (ii) the likely consequences of the Security Breach, (iii) the measures taken by the Processor has taken or proposes to take to deal with the Security Breach, including, if relevant, measures to reduce any harmful effects as a result of the Security Breach.

If the Controller is obliged to notify the Data Subjects of a security breach, the Processor must assist the Controller with this, including providing, if available, the necessary contact information to the Data Controllers who are affected.

8. Use of sub-processors

The Processor has the Controller's general approval to use Sub-Processors. The Processor must at all times have an updated list with an overview of the names and contact information of all Sub-Processors and locations Sub-Processors process Personal Data on behalf of the Controller, which must be made available at the request of the Controller.

The Processor must ensure that the Processor's obligations set out in the Data Processing Agreement and the Privacy Legislation are imposed on Sub-Processors through a written agreement. The Processor must be fully responsible to the Controller for Sub-Processors to fulfil their obligations.

9. Transfer to third countries

The Processor is authorized to carry out transfers of Personal Data to third countries at its own discretion, provided that such transfers comply with the GDPR and any other applicable data protection laws and regulations. The Controller hereby gives its prior consent to such transfers, subject to the condition that the third country has a sufficient level of protection in line with the GDPR and that the necessary safeguards are in place to protect the Personal Data.

The Processor must assist the Controller with its risk assessment of the use of Sub-Processors and/or the transfer of Personal Data to a Third Country, as well as an assessment of whether the transfer is legal, including assessing whether the Third Country ensures an adequate level of protection, whether there is a need to implement further measures, which further measures that need to be implemented, as well as providing documentation that necessary additional measures can be implemented.

10. Revisions

The Processor is obliged to provide the Controller with documentation of implemented technical and organisational measures to ensure a suitable level of security, as well as other information that is necessary to document that the Processor fulfils its obligations under this Data Processing Agreement and the Privacy Legislation.

The data controller and the relevant supervisory authority have the right to carry out audits, including inspections and evaluations of Personal Data processed, the systems used for this purpose, implemented technical and organisational security measures, including security instructions etc., as well as Sub-processors.

If the Controller appoints an external auditor to carry out the audit, the auditor must be bound by a duty of confidentiality.

The controller must cover costs related to audits initiated by the controller.

11. Duration and termination

The Data Processing Agreement applies as long as the Processor processes Personal Data on behalf of the Controller.

If the Processor breaches the Data Processing Agreement or does not fulfil its obligations under the Privacy Legislation, the Controller may (i) order the Processor to stop further processing of Personal Data with immediate effect, and/or (ii) terminate the Data Processing Agreement with immediate effect.

12. Consequences of termination

Upon termination of the Data Processing Agreement, the Processor must, as specified by the Controller, either delete or return all Personal Information to the Controller, including copies and back-up, unless otherwise stipulated in applicable legislation.

The Processor must document in writing to the Controller that deletion has taken place in accordance with the Data Processing Agreement and as indicated by the Controller.

13. Notices and changes

All notices relating to the Data Processing Agreement must be sent in writing to legal@manymore.com.

In the event of changes to the Privacy Legislation, if a judgement or statement from a competent authority or other authoritative source results in a changed interpretation of the Privacy Legislation, or if changes are made to the delivery of the service under the Agreement that requires changes to the Data Processing Agreement, the parties shall cooperate to update the Data Processing Agreement accordingly.

Any updates or changes to this Data Processing Agreement must be made in writing, email being sufficient, and require the prior consent of the Controller. The Processor may propose changes or additions to the Agreement, but the Controller has the right to reject any proposed changes or additions that are not in compliance with applicable data protection laws and regulations or that would materially affect the processing of Personal Data.

If the Controller does not consent, the Processor may update their proposal and request another review, or terminate the entire Agreement including this DPA.

If the Controller consents to any updates or changes to this Agreement, the updated Agreement will be published on the Processor's website and will become effective immediately upon publication. The Controller is responsible for regularly reviewing the Data Processing Agreement on the Processor's website to ensure compliance with the updated terms.

‍



Appendix 1 to the Data Processing Agreement: requirements for information security

Physical access control

The Processor must take proportionate measures to prevent unauthorised physical access to the Processor's property and premises where Personal Data is stored or processed. The measures shall include:

• Procedures and/or physical systems for access control, including security

• Automatic door locking or other measures for electronic access control

• ID, key or other requirements for access to the premises

Access control for systems

The Processor must take proportionate measures to prevent unauthorised access to systems where Personal Information is stored. The measures shall include:

• Procedures for password protection (including, for example, requirements for length and use of special characters, regular password changes, etc.)

• Access to systems requires approval from HR or IT administrators

• Guest users and anonymous users are denied access to systems

• Routines for manual locking of the PC when leaving the workstation

Access management for Personal Information

The Processor must take proportionate measures to prevent initially authorised users from accessing Personal Data that it is outside their authorisation to process, to prevent, among other things, unauthorised access, removal, modification or disclosure of Personal Data. The measures shall include:

• Only employees and others with an official need must have access to the Personal Information

• Differentiated access rights defined based on work tasks

• Automatic logging of user access in IT systems

Control over entry, change etc. of Personal Data

The Processor must take proportionate measures to check and confirm whether and by whom Personal Data has been entered into the system, modified or removed. The measures shall include:

• Differentiated access rights defined based on work tasks

• Automatic logging of user access in IT systems, and regular review of security logs to uncover and follow up on potential security incidents

• Ensure that it is possible to verify and confirm to which third parties Personal data may have, or has been, disclosed through the use of electronic communication equipment

• Ensure that it is possible to verify and confirm which Personal Information has been entered into the system, changed or deleted, as well as when and by whom

Control over the release of Personal Information

The Processor must take proportionate measures to prevent unauthorised access, modification or removal of Personal Data upon transfer. The measures shall include:

• Use of "state of the art" encryption on all electronic transmission of Personal Information

• Create an audit trail for all disclosure of Personal Information

Availability control

The Processor must take proportionate measures to ensure that Personal Data is protected against accidental destruction or loss. The measures shall include:

• Regular back-up of Personal Information

• Remote storage

• Use of virus protection/firewall

• Monitoring of systems to detect viruses etc.

• Ensure that malfunctions/machine errors cannot cause stored Personal Information to be destroyed

• Ensure that installed systems can be restored in the event of disruptions

• Uninterrupted power supply

• Procedures to ensure business continuity (Business Continuity)

Control that Personal Information is kept separate

The Processor must take proportionate measures to ensure that Personal Information collected for different purposes is also processed separately. The measures shall include:

• Differentiated access rights defined based on work tasks

• Separate IT systems

Training and awareness

The Processor must take measures to ensure that all employees are trained in the requirements of the Privacy Legislation, as well as information security, through, among other things, having:

• Unequivocal and clear regulation in employment agreements on confidentiality, security and requirements for compliance with internal routines

• Internal routines and training in requirements for processing Personal Data to create awareness among employees