Standard Terms of Service for the Evolo Toppsystem

1. General

1.1 These Terms of Service (“Terms of Service”) apply to the use of the Evolo service platform, a comprehensive cloud-based toppsystem for monitoring and managing buildings, as described in more detail at https://www.evolo.no/ (“the Service”). By using the Service, you are deemed to have accepted the Terms of Service.

1.2 The Service is provided by Evolo Technologies AS (“Evolo”). “Customer” means the legal entity that uses the Service, either (i) as an End Customer—for its own business purposes, or (ii) as a Partner—to resell the Service to End Customers.

2. Right of Use

2.1 The Partner is granted the right to use the Service through a separate partner agreement with Evolo.

2.2 The End Customer is granted the right to use the Service in accordance with these Terms of Service, provided that a valid license has been established through the Partner or directly from Evolo.

2.3 The Customer may not transfer its right to use the Service, grant others access to the Service, or use the Service for the benefit of others, unless this has been expressly agreed upon with Evolo.

2.4 The End Customer may change the responsible Partner at any time, provided that the new Partner is approved by Evolo. This does not affect the End Customer’s ownership or rights to the license and associated content.

Such a change may have certain practical consequences for the End Customer. It is therefore recommended to carefully consider this before implementing the change.

3. The Service

3.1 The Service is made available to the Customer through a web browser by logging in with a username and password. Certain PCs and handheld devices, as well as certain web browsers, may have limitations that prevent the Service from functioning as intended.

3.2 The Service is standard software provided “as is.” Evolo will use commercially reasonable efforts to ensure the best possible uptime and functionality for the Service, but makes no guarantee that the Service will be free of errors or service interruptions at all times.

3.3 Evolo reserves the right to make changes and updates to the Service, including making improvements, adding, modifying, or removing functionality, at its sole discretion and without any obligations or liability to the Customer. Evolo shall notify the Customer if such a change or update results in altered requirements for the Customer’s user equipment. Work on modifying or updating the Service may result in reduced functionality and/or limited access to the Service, and Evolo shall endeavor to perform such work at times that cause the least possible disruption to the Customer. If Evolo chooses to discontinue the Service or significant features of the Service, the Customer shall be given 12 months’ notice.

3.4 The Service may include features based on artificial intelligence, including the AI assistant Eva. Such features may generate analyses, assessments, recommendations, and other content based on data available within the Service. AI-generated content may contain errors or be incomplete and must be evaluated by the user before it is used as a basis for actions that may affect technical systems, security, or operations.

4. Customer’s Responsibility for Security and Use

4.1 All use of the Service is at the Customer’s own risk. The Customer is responsible for the content and legality of its own data.  

4.2 The Customer shall not (i) reverse engineer or decompile the Service, (ii) copy or modify the Service, (iii) disrupt or interfere with the integrity or functionality of the Service, including by uploading or distributing files that contain viruses or that may otherwise harm the Service, (iv) use the Service for illegal or harmful purposes or store or transmit material that infringes the rights of third parties, (v) attempt to gain unauthorized access to the Service or associated systems and networks, or (vi) sell, resell, rent, or lease the Service.

4.3 The Customer’s user credentials are personal and may not be transferred to others. Username and password information must be stored securely. The Customer is responsible for all use of the Service, and it is the Customer’s responsibility to protect against unauthorized access to the Service.

4.4 The Customer is responsible for ensuring that they have compatible user equipment and sufficient internet capacity and speed for the Service to function as intended.

4.5 Evolo is not liable for deficiencies, delays, or errors resulting from misunderstandings, incomplete information, or miscommunication between the End Customer and the Partner.

5. Support

5.1 If the Customer has the right to use the Service through a Partner, all support and assistance shall be provided by the Partner. Evolo does not handle inquiries directly from the End Customer and refers all such requests to the responsible Partner.

6. Data Storage

6.1 Evolo will store the Customer’s data, including user information and statistics uploaded to and generated within the Service, in a secure manner. Evolo will only share the Customer’s data with third parties to the extent necessary to provide the Service as intended, or if disclosure is required by law, court order, or other legal mandate.

6.2 Evolo maintains a customer database containing information about the Customer, including general information and statistics related to the Customer’s use of the Service. The purpose of the customer database is to further develop and optimize the Service in accordance with customer needs. The customer database will not be made available to anyone other than Evolo and its subcontractors.‍

7. Privacy

7.1 Evolo processes personal data in accordance with applicable privacy laws. Evolo is the data controller for personal data processed for its own purposes, and acts as a data processor or subprocessor when data is processed on behalf of the Customer.
Further information can be found at Privacy Policy, available in Evolo’s Help Center.

7.2 When Evolo processes personal data on behalf of the Customer through the Service, Evolo acts as a data processor or subprocessor, depending on the contractual relationship.

The processing is governed by the Data Processing Agreement in Appendix 1, which is an integral part of the Terms of Service. The following provisions also apply:

• Evolo Evolo shall only process the Customer’s personal data to the extent necessary to ensure the contractual delivery of the Service, and in accordance with the Customer’s documented instructions and applicable privacy laws. In this context, Evolo may process personal data related to the Customer’s employees, suppliers, customers, and others included in the data that the Customer uploads and generates in the Service.

• Evolo shall implement and, upon request, document such technical and organizational measures as are necessary to achieve an appropriate level of security in accordance with applicable data protection laws. Evolo shall also assist the Customer in implementing such measures.

• If Evolo becomes aware of a data breach, Evolo shall notify the Customer of this without undue delay in accordance with applicable data protection laws. The Customer is responsible for submitting any report to the Data Protection Authority and/or the data subject. Evolo shall assist the Customer in fulfilling the requirements regarding the Customer’s handling of data breaches.

• Evolo shall, without undue delay, notify the Customer of any inquiries from data subjects and shall assist the Customer in responding to them.

• Evolo has the right to use the sub-processors listed in the “Overview of Sub-Processors” in effect at any given time. Evolo will notify the Customer before new sub-processors are engaged. If such use involves the transfer of personal data outside the EEA, this must be stated in the overview and any notifications. Evolo shall ensure that binding data processing agreements are in place with its sub-processors, in accordance with applicable data protection legislation.

• Evolo shall ensure that persons authorized to process the Customer’s personal data are obligated to treat the data confidentially, see Section 8.

Evolo processes personal data on behalf of the Customer for as long as necessary to provide the Service. The processing includes the personal data the Customer makes available through the Service and is carried out solely to provide, operate, and administer the Service in accordance with the Customer’s instructions.

Evolo shall, to the extent necessary and possible, assist the Customer in fulfilling its obligations under applicable data protection laws and make available the information necessary to document that Evolo fulfills its obligations as a data processor.

Upon termination of the Service, the Customer shall be able to retrieve its data. At the Customer’s discretion, personal data shall then be deleted or anonymized, unless further retention is required by applicable law.

Evolo shall, upon reasonable request, provide the necessary information and assistance in verifying compliance with these provisions.

8. Confidentiality

8.1 Information that the parties become aware of in connection with the Customer’s use of the Service shall be treated as confidential and shall not be made available to third parties without the consent of the other party. The parties shall take the necessary precautions to ensure that unauthorized persons do not gain access to confidential information.

8.2 The duty of confidentiality does not apply to information that is generally known or is available elsewhere without this being due to wrongful conduct by the other party or a third party. The duty of confidentiality does not apply when a duty to disclose arises from law or a court order.

8.3 A breach of the duty of confidentiality is considered a material breach of the Terms of Service. The duty of confidentiality remains in effect even after the Customer’s use of the Services has ceased.

9. Communication and Notices

9.1 General information about the Service, including information about new features, price changes, or scheduled maintenance, will be provided within the Service, on Evolo’s website, or via email. Notices that apply specifically to the Customer and information of particular importance, such as information related to security and privacy, will be sent via email.

10. Intellectual Property Rights

10.1 Evolo owns all intellectual property rights related to the Service, including source code, databases, design, and data compilation.

10.2 The Customer owns the rights to its own data.

10.3 The Customer owns the license. Any configuration, customization, or setup performed under the license—regardless of which Partner performed the work—shall be considered the Customer’s property.

The Customer has the exclusive right at all times to determine who shall have access to the license and may freely modify, replace, or revoke accesses without restriction under this agreement.

The Partner may not assert any ownership, rights, or restrictions on use against the Customer based on previously provided services or work performed in connection with the license.

11. Restrictions on Use

11.1 If the Customer infringes Evolo’s intellectual property rights or otherwise misuses their access in a manner that may harm Evolo or materially violates the Terms of Service, Evolo may, with immediate effect, suspend access for the relevant user and/or the Customer.

11.2 If a payment default is not rectified after receipt of a reminder and a notice of suspension, Evolo may suspend the Customer’s access to the Service. Access to the Service will be reinstated on the first business day after Evolo has received payment.

11.3 If the Customer’s access to the Service is suspended pursuant to this Section 11 for more than 3 months, the Customer’s right to use the Service will automatically terminate, see Section 13.

12. Evolo’s Liability

12.1 The Customer must report errors, defects, and losses immediately and no later than 14 days after becoming aware of the circumstances. If a complaint is not filed within this time limit, the Customer loses the right to assert any remedies for breach of contract.

12.2 Evolo will endeavor to correct errors in the Service as quickly as possible. If the error significantly impairs the Customer’s ability to use the Service, and Evolo does not remedy the error within a reasonable time, the Customer may terminate the right to use the Service and demand a proportionate refund of the fees paid (price reduction). The Customer is not entitled to make any other claims against Evolo as a result of errors in the Service.

12.3 Under no circumstances shall Evolo be liable for the Customer’s indirect or consequential losses, including loss of data or customers, business interruption, loss of use, lost profits, or claims for payment of taxes or fees. Evolo’s liability for damages is, in all circumstances, limited to an amount equivalent to one year’s fee for the Customer’s right to use the Service.

12.4 The above limitations of liability do not apply if the damage is caused by willful misconduct or gross negligence on the part of Evolos.

13. Termination

13.1 These Terms of Service remain in effect for as long as the Customer uses the Service.

13.2 Upon termination of the Customer’s right to use the Service, Evolo will, for a period of up to 12 months, make the Customer’s data available for delivery or transfer to another storage location.

Upon termination, personal data that Evolo processes on behalf of the Customer shall be deleted or returned at the Customer’s discretion, unless further retention is required by law. Making data available for up to 12 months is subject to compliance with the Customer’s instructions and the data processing agreement.

Anonymization of data is considered deletion when the information can no longer be linked to an identified or identifiable individual.

14. Changes

14.1 Evolo may amend the Terms of Service when deemed necessary. The Customer will be notified of the change upon their next login and may not continue using the Service until the change is accepted.

15. Governing Law

15.1 The Terms of Service shall be governed by Norwegian law.

Appendix 1 – Data Processing Agreement

This Data Processing Agreement (“Data Processing Agreement”) is an integral part of the Standard Terms of Service for Evolo Toppsystem (“Terms of Service”).

The Data Processing Agreement governs how Evolo Technologies AS (“Evolo”) processes personal data on behalf of the Customer in connection with the provision of the Service, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

The terms “Customer,” “Partner,” “End Customer,” and “Service” have the same meanings as in the Terms of Service.

1. Scope of the Agreement and Allocation of Roles

1.1 This Data Processing Agreement applies when Evolo processes personal data on behalf of the Customer through the Service.

1.2 When the Customer itself is the data controller for the personal data, Evolo acts as the data processor. If the Customer, as a Partner, processes personal data on behalf of an End Customer, Evolo acts as a sub-processor. The Data Processing Agreement applies accordingly in such cases. The Partner is responsible for obtaining the necessary authorization and instructions from the End Customer, who is the data controller.

1.3 The Data Processing Agreement does not cover personal data thEvolo processes for its own purposes as an independent data controller. Such processing is governed by Evolo’s Privacy Policy.

1.4 In the event of a conflict between the Data Processing Agreement and the Terms of Service, the Data Processing Agreement shall take precedence with respect to matters concerning the processing of personal data on behalf of the Customer.

2. Purpose and Scope of Processing

2.1 The purpose of the processing is to provide, operate, maintain, and administer the Service in accordance with the agreement between the parties.

2.2 The processing includes the collection, storage, organization, provision, analysis, and deletion of information that the Customer records or makes available through the Service. This includes information from associated technical systems, integrations, and functions for monitoring, management, and reporting.

2.3 The following categories of personal data may be subject to processing:

• Name, email address, and phone number.

• User information, access rights, and activity logs.

• Information from technical systems that can be directly or indirectly linked to identifiable individuals, including presence data.

• Other personal data that the Customer makes available through the Service.

2.4 The processing may include the Customer’s and End Customer’s employees, representatives, operational staff, suppliers, visitors, and other individuals who can be identified through the information in the Service.

2.5 When using AI functionality, including the assistant Eva, relevant information from the Service may be processed by authorized sub-processors to generate responses, analyses, and assessments. Such processing shall be limited to what is necessary to provide the relevant functionality.

2.6 Processing continues for as long as the Customer uses the Service, as well as for the period necessary to return or delete personal data upon termination, see Section 10.

3. Customer’s Responsibilities and Instructions

3.1 The Customer is responsible for ensuring that the processing of personal data through the Service occurs on a lawful basis and that the necessary instructions and authorizations from the data controller are in place. The data controller determines the purpose of the processing and the essential means used.

3.2 Evolo shall process personal data only in accordance with documented instructions from the Customer. These instructions are set forth in the Terms of Service, this Data Processing Agreement, the Customer’s documented use and configuration of the Service, and any subsequent written instructions.

3.3 Evolo shall not process personal data for its own or any other purposes, unless this is in accordance with documented instructions or is required by law.

3.4 If Evolo is legally obligated to process personal data beyond the Customer’s instructions, the Customer shall be informed in advance, unless such disclosure is prohibited by law.

3.5 Evolo shall, without undue delay, notify the Customer if, in Evolos’s assessment, an instruction is in violation of applicable data protection laws.

4. Confidentiality and Information Security

4.1 Evolo shall implement appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, alteration, and unlawful processing, in accordance with Article 32 of the General Data Protection Regulation.

4.2 The security measures shall be tailored to the risks associated with the processing and shall include access control, securing systems and databases, encryption where relevant, backup procedures, incident response, and regular security assessments. Evolo must have procedures in place to restore access to personal data in the event of technical or physical incidents.

4.3 Evolo shall ensure that individuals with access to personal data are subject to a duty of confidentiality and that access is limited to what is necessary to perform their duties. Access rights shall be revoked when the need ceases.

4.4 The Customer is responsible for managing its own user accesses and ensuring that the Service is used in accordance with Section 4 of the Terms of Service.

5. Sub-processors

5.1 The Customer grants Evolo general written authorization to use sub-processors necessary to provide the Service. Approved sub-processors are listed in the current overview of sub-processors available in Evolo’s Help Center.

5.2 Evolo shall notify the Customer in writing at least 14 days before new subprocessors are engaged or existing subprocessors are replaced. The Customer shall be given the opportunity to object to the change before it takes effect. In the event of objections, the parties shall seek an appropriate solution. If this is not possible, the Customer may terminate the affected Service before the change is implemented.

5.3 Evolo shall ensure that binding data processing agreements are in place with the subprocessors, imposing on them obligations regarding the protection of personal data equivalent to those set forth in this Data Processing Agreement.

5.4 Evolo is liable to the Customer for ensuring that sub-processors fulfill their obligations under applicable data protection laws and the data processing agreements entered into.

6. Transfer of Personal Data

6.1 The processing of personal data may take place within and outside the EU/EEA, depending on which approved sub-processors are used. The relevant processing locations are listed in the overview of sub-processors.

6.2 The transfer of personal data to countries outside the EU/EEA shall only take place in accordance with documented instructions from the Customer or when required by law. The Customer’s approval of subprocessors and associated processing locations pursuant to Section 5 constitutes such instructions for the transfers necessary to provide the Service.

6.3 Transfers to countries outside the EU/EEA shall be made in accordance with Chapter V of the General Data Protection Regulation (GDPR). Evolo shall ensure that the necessary legal bases for transfer and safeguards are in place, including any standard data protection clauses approved by the European Commission.

7. Personal Data Breaches

7.1 If Evolo becomes aware of a personal data breach affecting the Customer’s personal data, the Customer shall be notified without undue delay.

7.2 The notification shall, to the extent that the information is available, describe the nature of the incident, what data may be affected, possible consequences, and measures that have been implemented or are planned. Additional information shall be provided as it becomes available.

7.3 The data controller is responsible for any notification to the Norwegian Data Protection Authority and affected individuals. Evolo shall assist the Customer with the necessary information to fulfill these obligations. If the Customer is a Partner and acts as a data processor, the Partner shall ensure the necessary notification is forwarded to the End Customer, who is the data controller.

8. Assistance to the Customer

8.1 Evolo shall, to the extent possible and relevant to the processing, assist the Customer in fulfilling its obligations under the General Data Protection Regulation.

8.2 This includes assistance with requests for access, rectification, erasure, restriction of processing, and other rights to which data subjects are entitled.

8.3 Evolo shall also assist the Customer with necessary information related to information security, handling of security breaches, assessment of data protection impacts, and any prior consultation with supervisory authorities, cf. Articles 32–36 of the General Data Protection Regulation.

8.4 If Evolo receives inquiries from data subjects regarding processing on behalf of the Customer, these shall be forwarded to the Customer without undue delay. Evolo shall not decide on such inquiries on its own without the Customer’s instructions, unless otherwise required by law.

9. Documentation and Auditing

9.1 Evolo shall make available the information necessary to document compliance with the obligations under this Data Processing Agreement and Article 28 of the General Data Protection Regulation.

9.2 Evolo shall facilitate and cooperate with audits, including inspections, conducted by the Customer or an auditor designated by the Customer. As a general rule, audits shall be agreed upon in advance and conducted in a manner that safeguards security, confidentiality, and sound operations, without limiting the Customer’s statutory right to audit.

9.3 Evolo may use available security documentation, independent audit reports, and other relevant documentation to demonstrate compliance with the requirements.

10. Termination and Deletion

10.1 Upon termination of the Service, personal data processed by Evolo on behalf of the Customer shall, at the Customer’s discretion, be deleted or returned, unless further retention is required by applicable law.

10.2 The Customer’s right to have data disclosed pursuant to Section 13.2 of the Terms of Service applies to the extent that such retention is in accordance with the Customer’s instructions and applicable privacy laws. This provision does not imply that personal data must be retained for 12 months if the Customer has instructed that it be deleted earlier.

10.3 Evolo shall ensure that any remaining copies of personal data are deleted in a secure manner, including backups, in accordance with documented deletion procedures, unless further retention is required by law. Personal data that, for technical reasons, remains in backups shall be protected against unauthorized access and further processing until it is deleted.

10.4 Evolo shall, upon request, confirm that the personal data has been deleted or returned in accordance with this Data Processing Agreement.

11. Term and Other Provisions

11.1 The Data Processing Agreement forms an integral part of the Terms of Service and takes effect upon the Customer’s binding acceptance of the Terms of Service.

11.2 This Data Processing Agreement remains in effect for as long as Evolo processes personal data on behalf of the Customer, including in connection with the return and deletion of such data following the termination of the Service.

11.3 Changes to the Data Processing Agreement shall be handled in accordance with Section 14 of the Terms of Service, subject to the limitations set forth in applicable privacy laws.

11.4 If Evolo can no longer fulfill its obligations under applicable privacy laws, the Customer has the right to demand that the affected processing be halted. If the situation cannot be rectified, the Customer may terminate the affected Service.

11.5 The Data Processing Agreement is governed by Norwegian law, see Section 15 of the Terms of Service.