Questions or a problem? Call our support team +372 5681 0666 A real person answers. If we can't pick up, leave a message – we'll call you back with a solution.
GreenDice
ET Get a device
← Home

Legal

Data processing terms

These terms apply when GreenDice AS processes personal data on behalf of a client: in the course of device, user and IT support services for a school, municipality, business or partner. The terms are a data processing agreement under Article 28 of the General Data Protection Regulation (GDPR) and form part of the contract between GreenDice and the client.

Last updated 1 November 2026

1. Parties and scope

  1. The client is the controller and GreenDice AS (registry code 16522580, Aia 3, 10111 Tallinn, Estonia) is the processor.
  2. These terms apply together with the service, cooperation or other agreement between the parties (the main agreement). If the main agreement contains different provisions on data processing, the main agreement prevails.
  3. Where GreenDice processes data for its own purposes (for example invoicing, the client relationship or proving a device's lifecycle), GreenDice is the controller and the privacy notice applies.

2. Scope of processing

ServiceWhat we doData
Device intake and data erasureWe receive devices, erase data according to NIST SP 800-88 and issue an erasure certificateData stored on devices (contents are not viewed), device serial number
Devices for users and lifecycle reportingWe assign devices to users, take them back, route them to reuse or material recycling and report to the clientUser's name, school and class or unit, contact details, device details
IT support and remote supportWe resolve support requests, if needed through a remote connection to the user's deviceContent of the request, user's contact details, data visible on screen during a remote session
Microsoft 365 and device managementWe create and manage user accounts, manage devices through Entra ID and Intune, and audit the tenant configurationName, username, email, groups and licences, device management data
Client portalWe show the client the journey of its devices and their CO₂ impactContact person's name and email, device details
  • Data subjects: the client's employees, students, teachers and other users designated by the client.
  • Special categories of data: GreenDice doesn't knowingly process them. If such data is present on devices or in support requests, we protect it with the same measures.
  • Duration: the term of the main agreement and the termination described in section 7.

3. GreenDice's obligations

  1. We process data only on the client's documented instructions. The instructions are the main agreement, these terms and the client's written instructions, including those given by email. If we believe an instruction infringes the law, we inform the client without delay.
  2. Only employees and interns who need the data for their work and are bound by confidentiality work with the data.
  3. We apply the security measures described in the annex (GDPR Art. 32).
  4. We help the client respond to data subject requests. If a request reaches us directly, we forward it to the client within 5 working days and don't respond on the merits without the client's instructions.
  5. We help the client meet its obligations on security, impact assessments and prior consultation (GDPR Art. 32–36) to the extent of the information available to us.
  6. We notify the client of a personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notice describes the nature of the breach, the data affected and the measures taken, as far as known.
  7. At the client's request we provide the information needed to demonstrate compliance with these terms, such as erasure certificates and a description of security measures. The client may carry out an audit once a year with 30 days' notice. The client bears the cost of the audit.

4. Sub-processors

The client gives general authorisation to use the following sub-processors:

Sub-processorPurposeLocation
Zone Media OÜServers and hosting of GreenDice's web servicesEstonia
Odoo S.A.Customer management, device and support ticket registerBelgium (EU)
Microsoft Ireland Operations LtdEmail, Teams, SharePoint, Microsoft 365 administrationIreland (EU)
OpenAI Ireland LtdAI tools, such as drafting replies to support requestsIreland (EU); processing may take place in the USA
  1. We notify the client by email at least 30 days before adding a new sub-processor. The client may object on reasonable grounds during that period. If no agreement is reached, the client may terminate the service concerned.
  2. Sub-processors are bound by equivalent data protection obligations. GreenDice is liable to the client for the acts of its sub-processors.
  3. Data is transferred outside the European Economic Area only under Chapter V of the GDPR, for example on the basis of a European Commission adequacy decision or standard contractual clauses.

5. Client's obligations

  1. The client ensures it has a legal basis for the processing and that data subjects (for example students and their parents) have been informed about it.
  2. The client gives instructions in writing and in accordance with the law.
  3. Before handing over devices, the client backs up any data it needs. Erased data cannot be recovered.

6. Liability

The parties' liability is governed by the main agreement.

7. Termination

When the main agreement ends, we return or delete the client's personal data, at the client's choice, within 30 days. The exception is data the law requires us to keep (for example accounting records). Data in backups is deleted in the normal backup cycle.

Annex. Security measures

  • Data erasure follows NIST SP 800-88 and every device receives an erasure certificate. A storage medium that cannot be reliably erased is physically destroyed and sent to material recycling.
  • Devices are kept in GreenDice's workshop (Härgmäe 22, Tallinn), which only employees can access.
  • Access to systems is through a personal GreenDice Microsoft account and limited to what each person needs for their work. Access is revoked when an employee leaves.
  • Remote support runs through GreenDice's own server and only with the user's permission.
  • Connections are encrypted (HTTPS/TLS) and GreenDice's servers are located in Estonia.
  • Backups are made regularly.
  • Employees have signed confidentiality undertakings and receive data protection guidance.

Contact

Data protection questions and breach notifications: tugi@greendice.ee, +372 5681 0666.