Data Processing Agreement

1. Scope and roles

This Data Processing Agreement (“DPA”) is part of the Terms of Service between NoSix and the Customer. It applies to personal data that NoSix processes on the Customer’s behalf when providing the service.

For that data, the Customer is the controller and NoSix is the processor. Terms defined in the GDPR have the same meaning here.

Where NoSix decides the purposes itself, for example for account administration, billing and security, NoSix is a controller and the Privacy Policy applies.

2. Details of the processing

• Subject matter and purpose: providing the NoSix platform to the Customer as described in the Terms.
• Nature: hosting, storing, structuring, analysing (including with AI features), displaying and deleting data.
• Duration: the term of the agreement, plus the period until deletion under this DPA.
• Data subjects: the Customer’s users and other people named in the data or documents the Customer adds, such as staff, suppliers and contacts.
• Types of personal data: names, work contact details, roles, account and usage records, and personal data contained in uploaded documents such as utility bills and invoices.
• Special categories of personal data: none intended. The Customer does not add them.

3. Customer instructions

• NoSix processes the personal data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use of the features of the service are those instructions.
• NoSix tells the Customer if it believes an instruction breaks data protection law, and may pause that instruction until it is clarified.
• If the law requires NoSix to process the data in another way, NoSix tells the Customer first, unless the law forbids that.
• The Customer is responsible for having a legal basis for the data it adds and for informing the people concerned.

4. Confidentiality

NoSix makes sure that everyone it authorises to process the personal data is bound by confidentiality and has access only as far as their work requires.

5. Security

NoSix takes appropriate technical and organisational measures under Article 32 of the GDPR. They include:

• encryption of data in transit and at rest;
• role-based access control in the app and restricted access to production systems;
• logging of changes to data;
• regular updates and vulnerability checks of software dependencies.

NoSix may update these measures as long as the level of protection does not decrease.

6. Sub-processors

• The Customer gives NoSix general permission to use sub-processors. The current sub-processors are listed in Annex 1.
• NoSix binds each sub-processor to data protection duties that are no less protective than those in this DPA, and remains responsible for their work.
• NoSix announces a new or replacement sub-processor at least 30 days in advance, by email or on this page. The Customer may object on reasonable data protection grounds within that period. If the parties find no solution, the Customer may end the affected service and receives a refund of prepaid fees for the remaining period.

7. International transfers

NoSix stores Customer Data in the European Union.

If a sub-processor processes personal data outside the European Economic Area, NoSix makes sure a valid transfer mechanism applies: an adequacy decision or the European Commission’s standard contractual clauses.

8. Requests from individuals

NoSix helps the Customer, with suitable technical and organisational measures, to answer requests from people who exercise their rights under the GDPR. If NoSix receives such a request directly, it passes it to the Customer without undue delay and does not answer it itself, unless the law requires that.

9. Personal data breaches

NoSix notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach that affects the Customer’s data.

The notice describes what is known: the nature of the breach, the data and people affected, the likely consequences and the measures taken. NoSix adds information as it becomes available and helps the Customer meet its own notification duties.

10. Help with compliance

NoSix gives the Customer reasonable help with data protection impact assessments and with consulting the regulator, taking into account the nature of the processing and the information available to NoSix.

11. Return and deletion

During the agreement and for 30 days after it ends, the Customer can export its data or ask NoSix for an export.

After that, NoSix deletes the personal data within 90 days, unless the law requires it to be kept. Backups are overwritten on their normal cycle and are not used for anything else in the meantime.

12. Audits

On request, NoSix gives the Customer the information needed to show that it meets Article 28 of the GDPR.

If that information is not enough, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality. An audit takes place at most once a year, with at least 30 days’ notice, during working hours and without disturbing the service. The Customer bears its own costs. NoSix may charge reasonable costs for an audit that takes more than one working day.

13. Liability and precedence

The limits of liability in the Terms apply to this DPA.

If this DPA and the Terms conflict on the protection of personal data, this DPA prevails. If standard contractual clauses apply and conflict with this DPA, the clauses prevail.

Annex 1: Sub-processors

• Supabase: database, authentication and file storage.
• Vercel: hosting of the application.
• Anthropic: AI models that read documents and power the AI assistant.
• Resend: service emails such as invitations and notifications.
• Sentry: error monitoring.