Taki · Mandora AS
This is an English translation of the Norwegian «Brukervilkår for Taki», provided for convenience. In the event of any discrepancy, the Norwegian version prevails.
1.About the Terms
1.1. These terms of service (the “Terms”) apply between Mandora AS, business reg. no. 934 903 900, Karenslyst allé 56, 0277 Oslo, Norway (“Mandora”, “we”) and the business entering into an agreement for the use of Taki (the “Customer”, “you”). Mandora is part of the Visma group.
1.2. Taki is an AI-based accounting system (the “System” or “Taki”) for small businesses. The Terms are accepted upon ordering in the System, upon signing an individual Order Form, or by taking the System into use.
1.3. The Terms apply to all subscription plans. Plan-specific terms are set out in Appendix D. Packages, prices, year-end reporting, invoicing, commitment period and termination are governed by the Subscription Terms, and the Customer’s selected plan, package and start date are set out in the Order Confirmation. At present, the Pro plan is offered; further plans will be launched over time and will each have their own plan appendix.
1.4. The Data Processing Agreement in section 20, with Appendices A–C, forms an integral part of the Terms.
1.5. Contract documents and precedence. The agreement between the parties consists of these Terms with the Data Processing Agreement and appendices, the Subscription Terms and the Order Confirmation, and any individual Order Form, see section 12. In the event of conflict, an individual Order Form prevails over the Subscription Terms, and the Subscription Terms prevail over these Terms on matters concerning price, packages, invoicing, commitment period and termination. On matters concerning the processing of personal data, section 20.4 applies.
2.Definitions
- Pro plan: subscription plan under which an Accounting Partner is the Customer’s authorised accountant (“an accounting system with its own accountant”).
- Package: size tier within a plan (Small, Medium or Large), determined by transaction volume, see the Subscription Terms.
- Transaction Bank: the Customer’s annual quota of transactions under the chosen Package. The number of transactions is measured as the number of posted vouchers in the System (for example a sales invoice, a purchase invoice or a receipt). The Transaction Bank runs in periods of 12 months from the start date (the «transaction year»), see the Subscription Terms.
- AI usage: use of the System’s AI functionality, which is included in the subscription for normal accounting activity, see section 7.2 of the Subscription Terms.
- Standard plan: subscription plan under which the Customer is responsible for the keeping and quality of its own accounts. To be launched later; a separate plan appendix will apply from launch, see section 16.3.
- Accounting Partner: authorised accounting firm with which Mandora has a cooperation agreement, and which provides accounting services to Customers through the System.
- Platform: the functionality in the System for communication, task management, document exchange, orders and approvals between the Customer, the Accounting Partner and Mandora.
- Engagement Agreement: the agreement that, under Norwegian accountants legislation, must be in place between the Customer and the Accounting Partner when the latter is the Customer’s authorised accountant (Pro plan).
- Subscription Terms: Mandora’s standard terms for plans, packages, prices, year-end reporting, invoicing, commitment period and termination, published at takiregnskap.no/vilkar.
- Order Confirmation: the automatically generated confirmation the Customer receives upon ordering, stating the Customer’s selected plan, package, company type, start date and price at signing.
- Order Form: a signed individual agreement for Customers with needs outside the standard packages, see section 12.
3.The service and the division of roles
Taki is designed so that small businesses get well-kept accounts at a predictable price. Mandora develops and operates the System. On the Pro plan, the accounting is done by independent, authorised accounting firms that Mandora works with. The System takes care of the routine work, so the accountant can spend their time on control, assessments and advice.
3.1. Mandora provides the System, operates the Platform, holds the formal customer and billing relationship with the Customer and provides user support for system-related questions. All invoicing of ongoing services takes place through Mandora; the accountant never invoices the Customer directly for ongoing services. Additional services are invoiced by the accountant, see section 9.2. The accounting engagement itself is between the Customer and the Accounting Partner, which is the Customer’s accountant, see section 6.
3.2. Mandora is not an accountant and has no professional responsibility for the accounting treatment. On the Pro plan, the accounting services are provided by an Accounting Partner acting as the Customer’s authorised accountant, with the professional and legal responsibility this entails under the Norwegian Accountants Act and generally accepted accounting service practice.
3.3. The System’s AI functionality prepares automated suggestions for accounting entries. On the Pro plan, such suggestions are reviewed and approved by the Accounting Partner as part of the ordinary performance of the services.
3.4. User accounts. The Customer shall provide accurate and complete information upon registration and keep it up to date. Login details are personal and must be kept confidential; user accounts must not be shared. The Customer is responsible for activity on its own accounts and shall notify Mandora without undue delay if unauthorised access is suspected. Two-factor authentication (2FA) is required for all users.
3.5. Acceptable use. The System may only be used for lawful business and accounting purposes. The Customer shall not: violate applicable law or the rights of others; upload harmful or unlawful content; attempt to gain unauthorised access to systems or data; disrupt the operation or security of the service; use the System to gather competitive intelligence; or reverse engineer or attempt to extract the System’s source code or models. Material breaches may result in suspension under section 17.
3.6. Usage data. Mandora may collect and process information about how the System is used – for example feature usage, activity on the Platform, technical logs and device information – in order to improve and further develop the System and the user experience, and for internal statistics and business management (for example aggregated key metrics for usage, customer activity and customer churn). For such processing, Mandora is the controller, see section 20.2, and the processing is described in more detail in the privacy statements. The data is aggregated or anonymised where possible.
4.Onboarding and clean-up of previous accounts
4.1. The onboarding process is included at no separate charge and is largely automated. The Customer’s bank integration must be connected before the choice of accountant (section 5) is carried out, see section 10.1.
4.2. Errors in the Customer’s previous accounts must be corrected before the accountant assumes responsibility for the accounts. As part of the onboarding process, the accountant reviews the Customer’s books and provides a fixed price for any necessary clean-up before the Customer commits, in line with the price ranges in the Subscription Terms. If the books are in order, the review costs nothing.
4.3. Clean-up is the Customer’s responsibility and cost. It is agreed at a fixed price with the accountant, notified through the Platform before work begins, and invoiced to the Customer by Mandora, see section 9.2 of the Subscription Terms. The agreed fixed price is confirmed in the Platform before the work begins. Where the clean-up required exceeds the ranges in the Subscription Terms, a separate fixed-price offer is provided; Mandora may decline the customer relationship if such an offer is not provided or accepted.
4.4. The Customer is invoiced from when the Customer has accepted the Terms and been given access to the System, see section 9.5 of the Subscription Terms, and chooses when the Accounting Partner takes over the accounts. The Accounting Partner may decline to take over a VAT period the Customer has already started. This is agreed directly with the Accounting Partner.
5.Your choice of accountant
5.1. New Customers on the Pro plan choose their own accountant from normally three suggestions presented by Mandora in the System. The selection is composed on objective and verifiable criteria: the Customer’s customer type, the accountants’ relevant competence, registered capacity and quality assessment. If the Customer does not make a choice, Mandora may assign an accountant based on the same criteria.
5.2. Customers referred by an Accounting Partner are, as a starting point, assigned to that partner, unless the Customer chooses otherwise.
5.3. The Customer may request a change of accountant on reasonable grounds. Mandora will then offer another qualified Accounting Partner, and the parties will contribute to a smooth transfer of accounting data and history. If an Accounting Partner’s affiliation with the System ends, the Customer continues in the System and Mandora offers a new accountant.
5.4. The Customer is invited to rate its accountant. The ratings are used in Mandora’s quality monitoring of the Accounting Partners.
6.Engagement Agreement and powers of attorney (Pro plan)
6.1. For the Pro plan, an engagement agreement must be in place between the Customer and the Accounting Partner in accordance with Norwegian accountants legislation.
6.2. Mandora facilitates the digital signing of the Engagement Agreement and the necessary powers of attorney and makes them available to the Accounting Partner. The Customer must contribute to signing without undue delay; the accounting services cannot commence until the necessary agreements and powers of attorney are in place.
6.3. The Accounting Partner has the right and duty to assess the risk associated with the engagement, and may decline or terminate the engagement in accordance with applicable rules, including the Norwegian Anti-Money Laundering Act. In the event of such termination, section 5.3 applies correspondingly.
6.4. When responsibility commences. The Accounting Partner’s responsibility for the Customer’s accounts commences only when (i) the Engagement Agreement and the necessary powers of attorney have been signed and approved, including access in Altinn under section 6.5, and (ii) the Customer has completed the onboarding process made available in the Platform, including connecting the bank integration and any agreed clean-up under section 4. Until both conditions are met, the Customer’s accounts and statutory reporting remain the Customer’s own responsibility, and neither Mandora nor the Accounting Partner has assumed any accountant’s responsibility for the Customer.
6.5. Access in Altinn. For the Accounting Partner to be able to submit statutory filings and returns on behalf of the Customer from the System – for example the VAT return, the tax return, the annual accounts and the shareholder register statement – the Customer must grant the Accounting Partner the necessary access in Altinn, including the right to sign and submit. This is done by registering the Accounting Partner as the Customer’s accountant in the Central Coordinating Register for Legal Entities (Enhetsregisteret) and/or by the Customer delegating the necessary roles and rights in Altinn, and by the Customer approving any system access for the System. For sole proprietorships, this also covers the proprietor’s tax return with business specification. Mandora and the Accounting Partner provide guidance on the procedure during the onboarding process. The Customer must maintain the access for as long as the agreement is in force. If access has not been granted, is insufficient or has been withdrawn, the Accounting Partner cannot submit on behalf of the Customer, and the Customer is itself responsible for ensuring that filings and returns are submitted by the deadlines and for the consequences of late or missing submission (for example coercive fines and late filing fees). Upon termination of the agreement, the Accounting Partner may notify the Register of its resignation as accountant, and the access is discontinued.
7.Communication through Taki
7.1. All communication between the Customer and the accountant concerning the accounting engagement and the use of the System takes place through the Platform. This keeps the dialogue, documentation and approvals in one place, gives the accountant the full history of the engagement and keeps the information secure. The Customer and the accountant shall not exchange direct contact details for contact outside the Platform, and shall not agree or perform services outside the System, see section 9.
7.2. Exceptions apply to communication that by law must be given in another form (for example customer due diligence under the Norwegian Anti-Money Laundering Act and contact with public authorities), to the assignment of roles and rights in Altinn, and to situations where the Platform is unavailable and the matter cannot wait.
8.User support and assistance from the accountant
8.1. Enquiries are registered in the Platform and answered by Mandora (system-related questions) or the accountant (accounting questions).
8.2. On the Pro plan, ongoing assistance from the accountant includes: professional accounting assistance, correction of errors in the bookkeeping, manual adjustments and reconciliations, and review and correction of the System’s automated suggestions – to the extent the enquiry concerns ordinary day-to-day accounting and is covered by the Engagement Agreement and the Package’s service content (Appendix D).
8.3. The following is not covered by the subscription or ongoing assistance: assistance with applications for public grant and support schemes (for example Innovation Norway), loan applications and other financing assistance, business plans, budgeting, and advisory services beyond ordinary accounting. Such services may be agreed as additional services under section 9.
9.Additional services and advisory
9.1. Services outside the scope of the subscription (section 8.3 and Appendix D.2) may be agreed directly between the Customer and the accountant, at an agreed price (hourly rate or fixed price agreed before the work begins). Such engagements are ordered, agreed and performed through the Platform.
9.2. Additional services are invoiced to the Customer directly by the accountant, where applicable with payment through a payment solution in the System where the payment goes directly to the accountant. The accountant has full professional and legal responsibility for the additional services. Mandora is not a party to the agreement on additional services; Mandora’s role is to provide the Platform where they are ordered and agreed.
10.The Customer’s obligations
10.1. Bank account and integration. The Customer shall have a dedicated business bank account connected to the System via Taki’s bank integration. The business’s payments shall be made from the company account, without commingling with private payments.
10.2. Response deadlines. Enquiries from the accountant shall be answered within 72 hours (business days). Requests related to statutory deadlines (for example VAT reporting and year-end reporting) may have shorter response deadlines; such deadlines are clearly marked in the Platform.
10.3. Documentation. Vouchers and other documentation shall be submitted within the deadlines stated in the Platform, and the Customer is responsible for the information being accurate and complete.
10.4. Fees in the event of default. Delays that cause additional work for the accountant may be subject to fees in accordance with the fee schedule published in the System from time to time. Applicable deadlines, countdowns and fee rates are visible in the System, and the Customer is notified before a fee is incurred. Fees are invoiced by Mandora, see the Subscription Terms.
11.Packages, prices and payment
11.1. Plans, packages and the Transaction Bank, package adjustments, prices and the price guarantee, year-end reporting, clean-up, integrations, AI usage, fees, invoicing and payment are governed by the Subscription Terms.
11.2. Further conditions underlying the standard prices are set out in Appendix D, including requirements regarding bank accounts, closed previous accounts and limitations on shareholder-change events. Industries and needs on the out-of-scope list in Appendix D are not covered by the System or the standard prices.
11.3. In the event of payment default, section 17 applies.
12.Individual agreements
12.1. For Customers with needs outside the standard packages, for example more than 600 transactions per year, an individual agreement may be entered into in the form of a signed Order Form. The Order Form prevails over the Subscription Terms and these Terms for the matters it governs, except for the Data Processing Agreement, see section 20.4.
13.Commitment period, duration and termination
13.1. The agreement runs from the start date stated in the Order Confirmation. The commitment period and notice period follow from the Subscription Terms; after the commitment period, the agreement continues until terminated.
13.2. How notice of termination is given follows from section 10.2 of the Subscription Terms.
13.3. During the notice period, the services are delivered as normal and the Customer pays the ordinary consideration. Prepaid consideration for periods after the termination date is refunded or set off, unless the Subscription Terms provide otherwise. Year-end reporting that has been commenced is settled against work actually performed.
13.4. Upon termination, Mandora and the Accounting Partner assist with an orderly conclusion or transfer of the engagement in accordance with the requirements of the Norwegian Accountants Act, and the Customer receives its accounting data in a structured, commonly used and machine-readable format, see section 20. The Customer is itself responsible for further retention in accordance with the Norwegian Bookkeeping Act.
13.5. Termination for cause. Either party may terminate the agreement with immediate effect by written notice if the other party (a) becomes insolvent, including where bankruptcy or debt negotiation proceedings are opened, or a decision is made to liquidate it, or it otherwise ceases its business; (b) becomes subject to sanctions or other measures that make performance of the agreement unlawful; or (c) commits a material breach of the agreement and has not remedied it within 30 days of written notice describing the breach. If the Customer terminates the agreement under this section, the commitment period does not apply. Upon termination for cause, section 13.4 and section D9 apply correspondingly. Mandora’s right of suspension under section 17 applies in addition.
13.6. Data export and switching provider. The Customer may also, before the agreement ends, request its accounting data, vouchers and related documentation in a structured, commonly used and machine-readable format, for example in order to switch to another provider. Mandora assists with the export and transfer. From 12 January 2027, such assistance is free of charge for the Customer. After termination, the data remains available for export as set out in section D9. The Customer also has the rights under Regulation (EU) 2023/2854 (the Data Act), when and to the extent it applies in Norway.
14.Transition to another system (“outgrowing Taki”)
14.1. Taki is designed for small businesses within the limits of the packages. If the Customer is no longer suited to the System – including because the Customer permanently exceeds 600 transactions per year without an individual agreement being in place, falls within the out-of-scope list in Appendix D, or has needs the System by its nature does not cover – Mandora may decide that the Customer can no longer use the System and the System’s pricing model.
14.2. In such cases, the Customer shall be offered a transition to the accounting system Tripletex, and the Customer’s accountant is given the opportunity to continue the customer relationship in Tripletex. The transition requires the Customer’s acceptance and is carried out with at least 2 months’ notice, with an orderly transfer of accounting data and history.
14.3. From the migration date, the subscription and Taki’s pricing model cease in their entirety. Use of Tripletex takes place on Tripletex’s own terms and prices, and the customer and billing relationship for the accounting services is established directly between the Customer and the accountant, at the accountant’s own prices or under a separate agreement. The Taki prices confer no right to equivalent prices after migration. If the Customer does not accept the transition, either party may terminate the agreement with the notice period set out in the Subscription Terms; the commitment period does not then apply.
15.AI functionality
15.1. Taki is built on AI. To deliver the service, the System sends the Customer’s messages and relevant accounting information to our AI providers, which are listed with their place of processing and transfer mechanism in Appendix B. This is explained in more detail in the privacy statements and, in the app, on a dedicated activation screen before the app is taken into use.
15.2. Data that the Customer and its users enter into the System is processed to deliver the service under the Data Processing Agreement. The AI providers do not train their models on data sent via the System. Mandora continuously improves the System, including instructions, rules and workflows, based on experience from its use and the Accounting Partner’s corrections, as follows:
(a) Operation and error correction: Mandora may process data in the System to the extent necessary to operate, secure, troubleshoot and correct errors in the System. This takes place as part of the service delivered to the Customer, see the Data Processing Agreement.
(b) Evaluation and improvement: Mandora evaluates and improves the System’s accuracy against real accounting data in minimised and pseudonymised form, as described in the privacy statement.
(c) Anonymised and aggregated data: Mandora may use anonymised and aggregated data for the further development of the System, including AI functionality.
On the Pro plan, the Customer consents to Mandora using the Accounting Partner’s corrections in the System as set out in this section, and releases the Accounting Partner from its duty of confidentiality to the extent necessary for such use, cf. section 4-2 of the Norwegian Accounting Practitioners Act (regnskapsførerloven).
The Customer’s data is not used to train or fine-tune language models. Should Mandora wish to change this, it will be notified as a material change under section 21.1, and the Customer may opt out.
15.3. The System’s automated suggestions do not constitute professional accounting advice from Mandora. On the Pro plan, the entries are quality-assured by the Customer’s accountant, see section 3.3.
15.4. The System’s AI functionality only responds to enquiries concerning the Customer’s accounts and the use of the System. The framework for AI usage in the subscription, including Mandora’s right to limit abnormally high usage, follows from section 7.2 of the Subscription Terms.
16.Future modules and services
16.1. Payroll. Payroll functionality is not included in the System or the subscription. Mandora may in the future launch further functionality covering additional customer needs (for example payroll); the content, prices and terms of such functionality will be announced separately, and this section confers no right to delivery.
16.2. Marketplace. Mandora may offer a marketplace for additional services (for example application assistance and company dissolution) at a fixed price agreed before ordering. Such services are ordered through the Platform and invoiced by the provider of the service in accordance with the principles in section 9.
16.3. Standard plan. Upon launch of the Standard plan, a separate plan appendix will apply. Self-service year-end reporting on the Standard plan is submitted via Taki at the Customer’s own responsibility.
16.4. Integrations. Bank integration is included in all plans and packages, see section 10.1. Other integrations with third-party systems – for example an online store, payment solution, point-of-sale system or other business systems – may be activated by the Customer in the System for an add-on fee. The price, activation and termination of integration add-ons follow from section 7.1 of the Subscription Terms.
16.5. Third-party systems. When the Customer activates an integration with a third-party system with which the Customer has its own agreement, the activation constitutes the Customer’s instruction to exchange data with that third party, see section D1. The third party’s processing of data is governed by the agreement between the Customer and the third party. Mandora is not responsible for the availability, functionality or data processing of the third-party system, and may change or discontinue an integration if the third party’s services, interfaces or terms change. Upon discontinuation, the integration add-on ceases from the date of discontinuation. Providers that Mandora itself uses to deliver an integration are covered by Appendix B and section D6.
16.6. Changes to the System. Mandora continuously develops the System and may change functionality, the user interface and the underlying technology, including AI models and AI providers, see section D6. Material changes are notified in the System or by email. If functionality that is essential to the Customer’s use of the System is removed without an equivalent replacement, the Customer may terminate the agreement with 30 days’ written notice. The commitment period does not then apply, and prepaid consideration for the period after termination is refunded.
16.7. Discontinuation of Taki. Mandora may discontinue the System with at least 3 months’ written notice, including during the commitment period. The Customer shall then be offered a transition under section 14.2, with an orderly transfer of accounting data and history, and prepaid consideration for the period after discontinuation is refunded. Section 13.4 applies correspondingly.
17.Suspension
17.1. Mandora may suspend or restrict the Customer’s access to the System in the event of (a) the Customer’s material breach, including payment default; (b) use that places an unreasonable burden on the System or endangers other users; (c) use that constitutes a security risk or is unlawful; or (d) the Customer becoming subject to sanctions or a legal order. In the event of breach under (a), suspension takes place gradually: first written notice with at least 14 days to remedy the matter, thereafter limitation of functionality and thereafter closure of access. In the cases under (b) to (d), Mandora may suspend immediately, but shall notify the Customer in advance where practicable and limit the suspension to what is necessary. Accounting data is not deleted as a consequence of suspension.
17.2. During suspension, the Customer’s payment obligation continues to run. Access is restored without undue delay once the matter has been remedied.
18.Liability
18.1. Mandora is responsible for the System’s general functionality and operation, and shall use commercially reasonable efforts to keep the System available. The System is provided as available from time to time, and Mandora does not guarantee any specific uptime. Mandora is not an accountant and has no responsibility for the professional accounting treatment; on the Pro plan, the Accounting Partner is responsible for the quality of the accounting services under the Engagement Agreement and applicable rules. The Customer is responsible for the information and documentation entered into the System being accurate and complete, and submitted on time, see section 10.
18.2. In the event of errors in the System, Mandora’s primary remedy is correction and restoration, including restoration of data from backup.
18.3. Mandora’s total liability in damages is limited to an amount equal to the Customer’s total consideration during the last 12 months before the event giving rise to liability. Mandora is not liable for indirect losses, including loss of profit, loss of revenue, loss of business or goodwill, loss of data that could have been avoided with normal backup routines on the Customer’s side, or third-party claims.
18.4. The limitations in section 18.3 do not apply in cases of gross negligence or intent, and do not limit liability that cannot be excluded or limited under mandatory law, including data subjects’ rights under the GDPR.
19.Intellectual property and confidentiality
19.1. Mandora and its licensors retain all intellectual property rights to the System, including updates, new versions and modifications, and to insights in anonymised and aggregated form derived from the use of the System, see section 15.2 (c). This does not give Mandora any right to use the Customer’s data other than as set out in section 15.2. The Customer retains all rights to its own data. The Customer receives a non-exclusive, non-transferable right to use the System during the term of the agreement, for its own business purposes. The right of use may not be sublicensed, but the Customer may, under its own responsibility, give its accountant, auditor and other advisers access. The right of use does not include any right to use the System or its output to train, develop or improve competing AI models or AI services.
19.2. Confidentiality. Each party shall keep the other party’s confidential information secret and protect it with at least the same degree of care as it applies to its own confidential information of a similar nature, and never with less than reasonable care. The obligation does not apply to information that (a) is or becomes publicly available without breach of the agreement, (b) was already known to the recipient when received, (c) the recipient has lawfully received from a third party without a duty of confidentiality, or (d) the recipient has developed independently without use of the information. Confidential information may be shared with companies in the same group, subcontractors, the Accounting Partner and advisers who need it for the purposes of the agreement and are subject to an equivalent duty of confidentiality, and with authorities and courts where required by law. In the latter case, the other party is notified in advance to the extent permitted by law. The obligation applies for 3 years after the agreement ends. Confidentiality obligations under the Data Processing Agreement and under law apply without time limit.
20.Privacy and Data Processing Agreement
20.1. For personal data in the accounting and voucher data, the Customer is the controller and Mandora the processor. The processing is governed by the data processing agreement below (the “Data Processing Agreement”) with Appendix A (nature of the processing), Appendix B (sub-processors) and Appendix C (security measures).
20.2. For processing where Mandora itself is the controller (account administration, security, service improvement, etc.), Mandora’s privacy statements apply, available at takiregnskap.no and in the product and the app. Privacy enquiries should be directed to privacy@mandora.no.
20.3. The Customer’s responsibility as controller. The Customer confirms that the Customer (i) complies with applicable data protection law, (ii) has a legal basis for the processing and for transferring the personal data to the System and to Mandora and its sub-processors, (iii) has fulfilled its duty to inform the data subjects, and (iv) that instructions given to Mandora are lawful. The Customer shall not upload special categories of personal data without express agreement with Mandora.
20.4. Precedence. In the event of conflict between the Data Processing Agreement (D1–D10 with Appendices A–C) and other provisions of the Terms, the Data Processing Agreement prevails on matters concerning the processing of personal data.
Data Processing Agreement
D1. Purpose and instructions. Mandora processes personal data exclusively on behalf of the Customer and in accordance with the Customer’s documented instructions, as set out in the Terms, the Data Processing Agreement and the Customer’s use of the System’s functionality, and not for any other purposes. Operation, security, troubleshooting and error correction under section 15.2 item (a) form part of the service delivered to the Customer. The categories of data subjects and personal data are set out in Appendix A. Anonymised and aggregated data that no longer constitutes personal data may be used in accordance with section 15.2 item (c). Mandora shall, when it becomes aware of it, notify the Customer without undue delay if, in Mandora’s opinion, an instruction infringes the GDPR or other applicable data protection law. For Mandora’s evaluation and improvement of the System against minimised and pseudonymised accounting data, Mandora is an independent controller; that processing is based on a completed legitimate interest assessment, is described in the privacy statement and is not covered by the Data Processing Agreement, see section 15.2 item (b).
D2. Security. Mandora implements technical and organisational measures in accordance with Article 32 of the GDPR, as described in Appendix C, and ensures that persons with access to the personal data are subject to a duty of confidentiality. Access is limited to personnel with a business need. The duty of confidentiality also applies after the Data Processing Agreement has ended. The Customer is itself responsible for adequate security in its own IT environment, including secure administration of user accounts, access management on the Customer’s side and protection of login credentials.
D3. Assistance. Mandora assists the Customer, through appropriate technical and organisational measures, in fulfilling the Customer’s obligations under Chapter III of the GDPR (the rights of data subjects) and Articles 30–36. Mandora does not respond to enquiries from data subjects directly without the Customer’s instruction, unless otherwise required by law, and notifies the Customer without undue delay of any such enquiries Mandora receives, unless notification is prohibited by law. Mandora may claim coverage of documented costs for assistance beyond the standard service under the Terms, provided the Customer is notified of the expected scope before the work begins.
D4. Personal data breaches. In the event of a personal data breach, Mandora notifies the Customer without undue delay after becoming aware of the breach, with the information the Customer needs to comply with Articles 33 and 34 of the GDPR. Information not available at the time of the first notification is provided as it becomes available.
D5. Government requests. Mandora does not disclose personal data to public authorities without a legally binding order, notifies the Customer of such requests to the extent permitted by law, challenges disproportionate or unlawful requests, and discloses no more than what is legally required.
D6. Sub-processors. The Customer gives a general prior authorisation for the use of the sub-processors in Appendix B. Mandora enters into a written agreement with each sub-processor imposing obligations equivalent to those in the Data Processing Agreement, and is fully liable for the sub-processors’ processing. Changes of sub-processors are notified to the Customer with at least 30 days’ notice, allowing the Customer to object. In the event of a justified objection that cannot be resolved, either party may terminate the agreement with effect from the change; the commitment period does not then apply.
D7. Transfers to third countries. Transfers of personal data out of the EU/EEA take place only where a valid transfer mechanism exists under Chapter V of the GDPR (an adequacy decision, including the EU-US Data Privacy Framework, or the EU Standard Contractual Clauses with necessary supplementary measures), as set out in Appendix B. The Customer instructs and authorises Mandora to make such transfers to the sub-processors listed in Appendix B, and to enter into the EU Standard Contractual Clauses and other necessary transfer mechanisms on the Customer’s behalf vis-à-vis such sub-processors.
D8. Audits. The Customer may audit Mandora’s compliance with the Data Processing Agreement up to once per year, with at least 4 weeks’ written notice. Relevant third-party audit reports (ISAE 3402, ISO 27001 or equivalent) from the last 12 months may be relied upon instead of a separate audit. Because the System is delivered in a multi-tenant environment, Mandora may for security reasons require that an audit be carried out by an independent third-party auditor approved by Mandora. The frequency and notice limitations do not apply where there is concrete suspicion of a personal data breach or an order from a supervisory authority. The Customer bears its own audit costs, and Mandora may invoice documented assistance for audits beyond the standard service.
D9. Duration and deletion. The Data Processing Agreement applies for as long as Mandora processes personal data on behalf of the Customer. Upon termination, Mandora shall, at the Customer’s choice, either return the personal data to the Customer in a structured, commonly used and machine-readable format and then delete remaining copies, or delete it, unless further storage is required by law. If the Customer does not make a choice within 60 days of termination, the personal data is deleted. The Customer’s data remains available for export for 60 days after termination. Copies in backups and operational logs are deleted through ordinary deletion routines, and no later than 90 days after termination. Until deleted, they are protected under section D2 and are not used for any other purpose.
D10. Liability. Liability is governed by section 18, provided always that data subjects’ right to compensation under the GDPR is not limited. The limitation of liability in section 18 does not cover administrative fines or compensation claims imposed on a party by a supervisory authority or court under Articles 82 or 83 of the GDPR; such fines and claims are borne by the party on which they are imposed, unless that party demonstrates that the other party is primarily responsible for the underlying breach.
21.Changes to the Terms
21.1. Mandora may amend the Terms with at least 1 month’s written notice. Material changes to the Customer’s detriment are notified with at least 2 months’ notice and do not take effect during the commitment period; in such cases, the Customer may terminate the agreement with effect from the change’s entry into force. Price changes follow the Subscription Terms. Written notice under the Terms is given by email to the Customer’s registered administrator and as a message in the Platform.
21.2. Mandora may decide that the Visma group’s standard terms of service shall replace these Terms. Such a transition is notified with at least 2 months’ notice and is carried out so that the Customer’s key rights under these Terms are continued, including the Data Processing Agreement with its appendices.
22.Miscellaneous
22.1. Mandora may assign rights and obligations under the agreement to other companies within the same group. Otherwise, neither party may assign the agreement without the other party’s written consent.
22.2. Force majeure. Neither party is liable for delay or non-performance caused by circumstances beyond the party’s control that the party could not reasonably have foreseen or avoided (force majeure), for example natural disasters, pandemics, war, riots, labour disputes, orders from public authorities and changes in legislation, cyberattacks that the party could not have prevented with reasonable security measures, and failures at subcontractors or in third-party cloud infrastructure caused by such circumstances. The affected party shall notify the other without undue delay of the event and its expected duration, and do what can reasonably be required to limit its effects and resume performance. Force majeure does not release a party from its obligations under the Data Processing Agreement to implement security measures and to notify personal data breaches. If force majeure makes the System unavailable for more than 30 consecutive days, the consideration is reduced proportionately for the entire period of unavailability. If force majeure prevents material performance for more than 60 days, either party may terminate the agreement with immediate effect by written notice, without liability towards the other party. Prepaid consideration for the period after termination is refunded.
22.3. The agreement is governed by Norwegian law. Disputes not resolved amicably within 30 days are decided by the ordinary courts, with Oslo District Court as the legal venue.
22.4. If any provision of the Terms should be invalid or unenforceable, the remaining provisions remain in full force. The invalid provision shall be replaced by a valid provision that, to the extent possible, achieves its purpose.
Appendix D – Plans, service content and conditions
D.1The Pro plan
The Pro plan includes: access to the System with AI-based accounting and AI usage covering normal accounting activity (see section 7.2 of the Subscription Terms); an authorised accountant (Accounting Partner) with ongoing bookkeeping review, reconciliations and bank reconciliation; VAT reporting where the Customer is VAT-registered; ongoing assistance under section 8.2; reminders and document collection via the Platform; and ongoing engagement documentation and anti-money laundering follow-up. Year-end reporting is delivered at a separate fixed price, see section 5 of the Subscription Terms. Payroll functionality is not included, see section 16.1.
D.2Conditions underlying the standard prices
- Transaction volume within the chosen package: Small up to 100, Medium up to 300, Large up to 600 transactions per transaction year (above 600: individual agreement).
- A dedicated business bank account connected via Taki’s bank integration; the business’s payments are made without commingling with private payments. Up to 2 bank accounts, both of which must be dedicated business accounts (an operating account and, where applicable, a tax withholding account); private accounts cannot be connected to the System.
- The accounts for earlier periods have been closed in the previous system or with the previous accountant, see section 4.
- No more than 2 shareholder-change events per year (change of ownership, capital changes, share splits/reverse splits, etc.; ordinary dividend distributions do not count).
D.3The out-of-scope list
The following is not covered by the System or the standard prices, and is handled under a separate agreement – or falls outside the service: inventory accounting, project reporting, fixed-asset accounting beyond an ordinary depreciation schedule, cash-intensive businesses, foreign currency accounts, group accounts and consolidation (companies within the same ownership structure are served as separate customers), structural advisory (demergers, the participation exemption method, generational transfers, etc.), and the following industries: cryptocurrency, agriculture, insurance, banking/finance, commercial real estate with VAT-liable lettings, and other specially regulated or high-risk industries, unless support is expressly agreed.
D.4Standard plan
The Standard plan will be launched later. A plan appendix with service content, prices and terms will be published upon launch, see section 16.3.
Appendix A – Nature of the processing (to the Data Processing Agreement)
- Categories of data subjects: the Customer’s contact persons and employees; the Customer’s customers and suppliers and their contact persons; the owner of a sole proprietorship.
- Categories of personal data: contact details (name, telephone, address, email); job information; financial and accounting information in vouchers, invoices and bank transactions, including payroll-related entries, expense and travel information and payment information.
- Special categories: not processed as part of the service. Should such data incidentally appear in accounting material, it is processed under the Data Processing Agreement and is not used for other purposes.
- Purpose and nature of the processing: delivery of an AI-based accounting service – collection, recording, structuring, storage, quality control, reporting and filing.
- Duration: for as long as the agreement runs, see section D9.
Appendix B – Sub-processors
The following sub-processors are approved as of the date of the agreement, see section D6:
| Sub-processor | Service | Processing location | Transfer mechanism |
|---|---|---|---|
| Anthropic PBC | AI provider (the Claude language model) | USA | EU Standard Contractual Clauses (SCCs) |
| Google Ireland Limited | Backup AI (Gemini) and cloud infrastructure | EEA (europe-west4 and europe-north1) | Not applicable – within the EU/EEA |
| OpenAI Ireland Ltd. (OpenAI API) | Additional backup AI (GPT) | USA | EU Standard Contractual Clauses (SCCs) |
| Clerk Inc. | Authentication and login | USA | EU Standard Contractual Clauses (SCCs) + EU-US DPF |
| Vercel Inc. | Operation (hosting) of the web application | USA | EU Standard Contractual Clauses (SCCs) + EU-US DPF |
| Functional Software, Inc. (Sentry) | Error logging and troubleshooting | EU (Frankfurt); certain data in the USA | EU Standard Contractual Clauses (SCCs) + EU-US DPF |
| Linear Orbit, Inc. | Handling of customer issues and feedback | USA | EU Standard Contractual Clauses (SCCs) |
| SFDC Ireland Ltd. (Slack, Salesforce) | Internal communication, including about customer issues | EU (Frankfurt); certain data in the USA | EU Standard Contractual Clauses (SCCs) + EU-US DPF |
| Tripletex AS (Visma) | Underlying accounting platform and primary storage | Norway/EEA | Not applicable – within the EU/EEA |
| Visma Software International AS (Visma Machine Learning / Smartscan) | OCR/scanning of vouchers | EU/EEA (Google Cloud EMEA) | Not applicable – within the EU/EEA |
| Pipedrive OÜ (Estonia) | Customer relationship, support and communication (CRM) | EU/EEA; certain data in the USA | EU Standard Contractual Clauses (SCCs) + EU-US DPF |
| Contér Services AS | Accounting services (Pro plan) | Norway | Not applicable – within the EU/EEA |
| Lumi Accounting | Accounting services (Pro plan) | Norway | Not applicable – within the EU/EEA |
| Folq AS | Development, maintenance and support | Norway | Not applicable – within the EU/EEA |
| Besari AS | Development, maintenance and support (subcontractor to Folq AS) | Norway | Not applicable – within the EU/EEA |
| Shoqëria për shërbime informatike PROJEKT SHSHK Tetovë (“Project 0”) | Development, maintenance and support (subcontractor to Besari AS) | North Macedonia | EU Standard Contractual Clauses (SCCs) |
Appendix C – Security measures
- Encryption of stored data (AES-256) and of data in transit (TLS 1.2+).
- Role-based access control and two-factor authentication (2FA) for all users.
- Logging of access and changes; systems for detecting, handling and reporting security incidents.
- Backups with documented recovery procedures.
- Visma’s group-wide security programme, including data classification, vulnerability management and regular security assessments against Articles 32 and 25 of the GDPR.
- Data processing agreements with all sub-processors, see Appendix B.
Last updated: 21 October 2026.
© 2026 Mandora AS · Karenslyst allé 56, 0277 Oslo, Norway · hei@takiregnskap.no