Technical and organisational measures are listed in the Security Appendix of the DPA (attached).

Requirement for information security

LINK, who according to the Agreement processes Personal Data on behalf of the Controller, shall implement appropriate technical and organizational measures as stipulated in Data Protection Legislation and/or measures imposed by relevant supervisory authority pursuant to Data Protection Legislation or other applicable statutory law to ensure an appropriate level of security. LINK shall assess the appropriate level of security and take into account the risks related to the processing in relation to the services under the Agreement, including risk for accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Person Data transmitted, stored or otherwise processed. All transmissions of Personal Data between LINK and the Controller or between LINK and any third party shall be done at a sufficient security level, or otherwise as agreed between the Parties. This Appendix contains a general description of technical and organizational measures that shall be implemented by LINK to ensure an appropriate level of security. To the extent LINK has access to such information, LINK shall provide the Controller with general descriptions of its Sub-processors' technical and organizational measures implemented to ensure an appropriate level of security.

LINK Mobility Group AS (sub)processors list - 01 October 2024

LINK Mobility Group Holding ASA – Subsidiaries list – 05 November 2025

LINK Mobility Group AS (sub)processors list - 30 October 2025