Data Processing Agreement

Data Processing Agreement

This Data Processing Agreement forms part of the agreement between Nodavio and the customer concerning the provision of the Nodavio service.

1. Parties

Data Controller:
The customer identified in the applicable subscription or customer account.

Data Processor:
Nodavio
Kaj Munks Vej 11
7400 Herning
Denmark
Email: legal@nodavio.dk

For purposes of this Agreement, the customer is referred to as the Controller and Nodavio as the Processor.

2. Purpose

This Agreement governs the processing of personal data by Nodavio on behalf of the Controller in connection with the provision of the Nodavio service.

The Processor shall process personal data only as necessary to provide, secure, maintain and support the service and in accordance with the Controller's documented instructions.

3. Controller's responsibilities

The Controller is responsible for:

1. determining the purposes and means of processing;
2. ensuring that processing is lawful;
3. providing any required information to data subjects;
4. determining which personal data is entered into Nodavio;
5. ensuring that users are appropriately authorised;
6. ensuring that processing complies with applicable employment and data protection requirements; and
7. giving lawful and documented instructions to the Processor.

The Controller shall not instruct the Processor to process personal data in a manner that would violate applicable law.

4. Processor's responsibilities

The Processor shall:

1. process personal data only on documented instructions from the Controller;
2. ensure that persons authorised to process personal data are subject to confidentiality obligations;
3. implement appropriate technical and organisational security measures;
4. assist the Controller in complying with applicable data protection obligations;
5. notify the Controller of relevant personal data breaches without undue delay;
6. assist with data subject requests where reasonably necessary;
7. assist with security, impact assessment and consultation obligations where required;
8. delete or return personal data following termination as required by this Agreement; and
9. make available information reasonably necessary to demonstrate compliance with the Processor's obligations.

5. Processing instructions

The Processor is authorised to process personal data for the following purposes:

1. providing the Nodavio service;
2. hosting and storing customer data;
3. enabling customer users to access and manage customer data;
4. maintaining audit and activity records;
5. providing support;
6. securing the service;
7. maintaining backups;
8. diagnosing technical problems;
9. maintaining and improving the reliability and security of the service; and
10. complying with legal obligations applicable to the Processor.

The Processor shall not use customer personal data for independent advertising or sale of personal data.

6. Categories of personal data

Depending on the Controller's use of the service, personal data may include:

1. names;
2. professional email addresses;
3. user account information;
4. organisation and department information;
5. device assignment information;
6. computer and device identifiers;
7. IP addresses;
8. device and operating system information;
9. maintenance and repair records;
10. notes and other free text entered by users;
11. audit and activity records;
12. authentication and security information; and
13. other personal data entered by the Controller or its users.

7. Categories of data subjects

The personal data may concern:

1. employees;
2. contractors;
3. temporary workers;
4. customer personnel;
5. other authorised users;
6. individuals associated with IT equipment; and
7. other individuals whose information is lawfully entered into the service by the Controller.

8. Special categories of personal data

Nodavio is not designed as a service for processing special categories of personal data.

The Controller shall not intentionally enter special categories of personal data into free text fields unless such processing is necessary, lawful and appropriate.

If the Processor becomes aware that special category data has been entered, the Processor may take reasonable steps to protect the information, including requesting that the Controller remove it.

9. Confidentiality

The Processor shall ensure that persons authorised to process personal data are bound by appropriate confidentiality obligations.

The Processor shall not disclose customer personal data except as authorised by the Controller, required to provide the service, required by law or otherwise permitted by this Agreement.

10. Security measures

The Processor shall maintain appropriate technical and organisational measures appropriate to the risks associated with the processing.

Measures currently include, where applicable:

1. encryption in transit;
2. password hashing;
3. two factor authentication;
4. role based access controls;
5. tenant isolation;
6. rate limiting;
7. access logging;
8. action logging;
9. backups;
10. controlled access to production systems; and
11. security monitoring appropriate to the service.

The Processor may update its security measures provided that the overall level of protection is not materially reduced.

11. Subprocessors

The Controller gives the Processor general authorisation to use subprocessors, on the terms in this section.

At the date of this Agreement, the Processor uses the following subprocessors:

1. Simply.com A/S (Denmark): hosting of the application, its database and uploaded files; the backups kept on the server; and delivery of the email the service sends, such as password resets, alerts and digests. All of it is stored and processed in Denmark.
2. Stripe Payments Europe, Ltd. (Ireland): subscription billing. Stripe receives the customer's billing contact details and payment card details. It receives nothing entered into the service itself.

In addition, the Processor keeps a second copy of the backups on equipment it operates itself, in Denmark. This is not a subprocessor.

The Processor shall notify the Controller by email at least 30 days before adding or replacing a subprocessor. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the subscription with effect from the date the change takes effect, and is not charged for any period after that date.

The Processor shall impose data protection obligations on each subprocessor that are no less protective than those in this Agreement.

The Processor remains responsible for the performance of its subprocessors to the extent required by applicable law.

12. International transfers

Customer personal data is stored and processed in Denmark, and the Processor shall not transfer it outside the EEA unless a lawful transfer mechanism and appropriate safeguards are in place.

Stripe is part of a group headquartered in the United States, and some billing data may be transferred there. Such transfers rely on the EU-U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

13. Data subject rights

Taking into account the nature of the processing, the Processor shall reasonably assist the Controller in responding to requests from data subjects concerning their rights under applicable data protection law.

The Processor may direct a data subject to the Controller where the Controller is responsible for responding to the request.

The Processor shall not independently respond to a data subject request concerning customer data except where required by law or otherwise authorised by the Controller.

14. Personal data breaches

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting customer personal data.

Where reasonably available, the notification shall include:

1. the nature of the breach;
2. the categories of affected personal data;
3. the likely consequences;
4. measures taken or proposed to address the breach; and
5. information necessary for the Controller to assess and manage the incident.

The Processor shall reasonably cooperate with the Controller in relation to the breach.

15. Assistance with compliance

Taking into account the nature of the processing and the information available to the Processor, the Processor shall reasonably assist the Controller with:

1. security obligations;
2. notifications and assessments relating to personal data breaches;
3. data protection impact assessments;
4. consultations with supervisory authorities where required; and
5. other obligations under applicable data protection law.

The Processor may charge reasonable costs for assistance that is materially outside the ordinary scope of the service.

16. Audits and information

The Processor shall make available information reasonably necessary to demonstrate compliance with its obligations under applicable data protection law.

The Controller may request reasonable information concerning the Processor's security and data protection measures.

Audits shall:

1. be requested with reasonable advance notice;
2. take place during normal business hours;
3. avoid unnecessary disruption to the Processor's operations;
4. respect confidentiality and security requirements; and
5. not provide access to information concerning other customers.

Where appropriate, documentation such as security descriptions, certifications or independent assessments may be used instead of an on site audit.

17. Deletion and return

Following termination of the customer's subscription, access to the application ends. The Processor retains the Controller's data for 14 days following the final paid subscription period, during which the Controller may request a copy of it by writing to support@nodavio.dk.

Following that period, the Processor may delete customer data.

Within the active service, deleted records may be retained in a soft deleted state for up to 90 days before permanent deletion from the production database.

Backup copies may retain deleted information for a limited additional period until those backups are overwritten in accordance with the Processor's backup procedures.

The Processor shall not restore deleted customer data except where necessary for backup recovery, legal obligations or other legitimate technical purposes.

18. Duration

This Agreement remains in force for as long as the Processor processes personal data on behalf of the Controller.

The obligations relating to confidentiality, security, deletion and any other provisions that by their nature should survive termination shall continue for the relevant period.

19. Controller instructions

The Controller may provide documented instructions concerning the processing of personal data.

If the Processor reasonably believes that an instruction violates applicable data protection law, it shall inform the Controller before carrying out the instruction unless prohibited by law.

20. Liability

The parties' liability relating to processing of personal data is governed by the applicable agreement between the parties and applicable mandatory data protection law.

Nothing in this Agreement excludes or limits liability to the extent such exclusion or limitation is prohibited by applicable law.

21. Governing law

This Agreement is governed by Danish law.

Any dispute arising from this Agreement shall be subject to the jurisdiction of the Danish courts, subject to mandatory rules of applicable law.

22. Order of precedence

If this Agreement conflicts with the Terms of Service, this Agreement takes precedence concerning the processing of personal data.