Data Processing Agreement
This agreement (Art. 28 GDPR) applies when a business or organisation (the “Customer”) uses Nodi and puts personal data on its boards. It’s part of the Terms of Service and applies automatically; if you need a signed copy, write to [contact email – set LEGAL_EMAIL in config.php].
1. Parties and roles
The Customer is the controller. [company name – set LEGAL_COMPANY in config.php], ul. …, 00-000 Miasto, Poland, [registration, e.g. KRS number – set LEGAL_REGISTRATION in config.php] (the “Processor”) processes personal data on the Customer’s behalf only to provide the Service.
2. What is processed
- Subject and purpose: storing, displaying, sharing and backing up the content of the Customer’s boards; real-time collaboration.
- Duration: as long as the Customer uses the Service, plus the backup rotation period (14 days).
- Types of data: whatever the Customer puts on boards – typically names, work contact details, job roles, notes and images; account data of the Customer’s users.
- Data subjects: the Customer’s employees, contractors, clients and other people mentioned on boards.
- The Customer should not put special categories of data (Art. 9 GDPR) on boards unless it has a legal basis and has assessed the risk.
3. The Processor’s obligations
- Process data only on the Customer’s documented instructions (using the Service as designed counts as instructions), unless the law requires otherwise.
- Make sure everyone with access is bound to confidentiality.
- Keep appropriate security measures (Art. 32), including: HTTPS encryption in transit; passwords stored only as secure hashes; access control on every board and image; rate-limited sign-in; regular backups checked for restorability; access to production data limited to the people who run the Service.
- Help the Customer answer data subject requests and with security, breach notification and impact assessments, as far as reasonable.
- Notify the Customer without undue delay, and at the latest within 48 hours of becoming aware of it, about a personal data breach affecting its data.
- When the Customer stops using the Service, delete its data (the Customer deletes its boards or account in the app; backups are removed within 14 days), unless the law requires keeping it.
- Give the Customer the information needed to show compliance with Art. 28 and allow reasonable audits, on 30 days’ notice and at the Customer’s cost.
4. Sub-processors
The Customer authorises these sub-processors: [hosting company – set LEGAL_HOSTING in config.php] (hosting, EU), Liveblocks Inc. (real-time collaboration, USA), [email provider – set LEGAL_EMAIL_PROVIDER in config.php] (account emails). The Processor imposes the same data protection obligations on them and stays responsible for them. It will announce new sub-processors at least 14 days in advance; the Customer may object, and if no solution is found, may end the subscription.
5. Transfers outside the EEA
Transfers outside the European Economic Area (Liveblocks, USA) rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
6. Liability
Liability under this agreement follows the Terms of Service and Art. 82 GDPR.