Nodety Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Nodety Limited ("Nodety", "Processor") and the User ("Controller") and applies where Nodety processes personal data on the Controller's behalf in connection with the Services.

1. Definitions

1.1 "Data Protection Laws" means the UK GDPR, EU GDPR, and any other applicable data protection legislation.

1.2 "Personal Data", "Processing", "Data Subject", "Controller", "Processor", and "Sub-processor" have the meanings given in the Data Protection Laws.

1.3 Terms not defined herein have the meanings given in the Terms of Service.

2. Scope and Roles

2.1 The Controller determines the purposes and means of Processing Personal Data. Nodety processes Personal Data solely on the Controller's behalf and in accordance with the Controller's documented instructions.

2.2 The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are described in Annex 1.

2.3 This DPA does not apply to Personal Data for which Nodety is an independent controller (e.g., Account registration data, billing information, and usage analytics), which is governed by the Privacy Policy.

3. Controller's Obligations

3.1 The Controller is solely responsible for:

(a) ensuring it has a lawful basis for Processing Personal Data and for instructing Nodety to process such data;

(b) the accuracy, quality, and legality of all Personal Data provided to or processed through the Services;

(c) providing any required notices to, and obtaining any required consents from, Data Subjects;

(d) determining whether the Services provide an appropriate level of security for the Personal Data; and

(e) ensuring that its use of the Services complies with all applicable Data Protection Laws.

3.2 The Controller warrants that its instructions to Nodety will comply with Data Protection Laws. Nodety shall not be liable for any claim arising from the Controller's failure to comply with its obligations under this Section.

4. Nodety's Obligations

4.1 Nodety shall:

(a) process Personal Data only on the Controller's documented instructions, unless required by applicable law (in which case Nodety will inform the Controller unless legally prohibited);

(b) ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations;

(c) implement appropriate technical and organisational measures as described in Annex 2;

(d) comply with the conditions for engaging Sub-processors set out in Section 5; and

(e) taking into account the nature of the Processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible and at the Controller's cost, in responding to requests from Data Subjects to exercise their rights under Data Protection Laws.

4.2 Nodety shall, at the Controller's cost, assist the Controller in ensuring compliance with Articles 32–36 of the GDPR (or equivalent UK GDPR provisions) where applicable, taking into account the nature of Processing and the information available to Nodety.

5. Sub-processors

5.1 The Controller provides general authorisation for Nodety to engage Sub-processors for the purposes of providing the Services.

5.2 A list of current Sub-processors is available at nodety.com/legal/sub-processors.

5.3 Nodety shall notify the Controller by email at least fourteen (14) days before engaging a new Sub-processor or replacing an existing one. If the Controller objects in writing within fourteen (14) days of notification, the parties shall discuss the objection in good faith. If the objection cannot be resolved within thirty (30) days, the Controller may terminate the affected Services by written notice, and Nodety shall refund prepaid fees for the unused portion of the Subscription term.

5.4 Nodety shall impose contractual obligations on each Sub-processor that are no less protective than those in this DPA. Nodety remains liable for the acts and omissions of its Sub-processors to the same extent Nodety would be liable if performing the Processing directly, subject to the limitations of liability in the Terms of Service.

6. International Transfers

6.1 The Controller authorises Nodety to transfer Personal Data outside the United Kingdom and European Economic Area where necessary for the provision of the Services, provided Nodety ensures appropriate safeguards are in place as required by Data Protection Laws, including:

(a) transfers to countries with an adequacy decision; or

(b) the UK International Data Transfer Agreement or EU Standard Contractual Clauses (as applicable), which are hereby incorporated by reference and shall be deemed completed as follows: (i) Nodety is the data importer; (ii) the Controller is the data exporter; and (iii) the details in Annex 1 apply.

6.2 Where required, the applicable transfer mechanism is available upon request at info@nodety.com.

7. Security

7.1 Nodety shall implement and maintain appropriate technical and organisational security measures as described in Annex 2. Nodety may update these measures from time to time, provided the overall level of security is not materially reduced.

7.2 The Controller acknowledges that security measures are subject to technical progress and development and that Nodety may update its measures accordingly.

8. Personal Data Breach

8.1 Nodety shall notify the Controller without undue delay after becoming aware of a Personal Data breach affecting the Controller's data. Notification shall be made to the email address associated with the Controller's Account.

8.2 Such notification shall include, to the extent reasonably available: (a) a description of the nature of the breach; (b) the categories and approximate number of Data Subjects affected; (c) the likely consequences; and (d) the measures taken or proposed to address the breach.

8.3 Nodety's obligation to notify does not include an assessment of the impact of the breach on the Controller's operations, which remains the Controller's responsibility. Nodety shall provide reasonable cooperation to the Controller in investigating the breach, at the Controller's cost.

9. Audit

9.1 Nodety shall make available to the Controller, upon written request and no more than once per twelve (12) month period, information reasonably necessary to demonstrate compliance with this DPA.

9.2 The Controller's audit rights may be satisfied by Nodety providing: (a) written responses to the Controller's reasonable compliance questionnaire; (b) a summary of relevant third-party security assessments, penetration test results, or certification reports, if and to the extent available; or (c) existing security documentation that Nodety maintains in the ordinary course of business.

9.3 If the Controller reasonably demonstrates that the information provided under the preceding paragraph is insufficient to verify compliance, Nodety shall permit an audit conducted by the Controller or a qualified independent auditor (acceptable to both parties), subject to: (a) thirty (30) days' advance written notice; (b) the audit being conducted during normal business hours; (c) the auditor executing a confidentiality agreement acceptable to Nodety; (d) the audit not unreasonably interfering with Nodety's operations; and (e) the Controller bearing all costs of the audit.

9.4 The Controller shall promptly share audit findings with Nodety and the parties shall discuss remediation of any identified non-compliance in good faith.

10. Data Deletion and Return

10.1 Upon termination of the Services or upon the Controller's written request, Nodety shall, at the Controller's election: (a) return the Personal Data to the Controller in a structured, commonly used, and machine-readable format; or (b) delete all Personal Data, except where retention is required by applicable law.

10.2 The provisions of the Terms of Service regarding post-termination data retrieval apply. Unless otherwise specified in the Regional Terms or agreed in writing, the retrieval period is thirty (30) days from termination of the Services. After expiry of the applicable retrieval period, Nodety shall delete remaining Personal Data within ninety (90) days.

11. Liability

11.1 Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service.

11.2 The Controller shall indemnify Nodety against any costs, claims, damages, or expenses arising from the Controller's breach of its obligations under this DPA or its instructions that cause Nodety to breach Data Protection Laws.

12. Term

12.1 This DPA takes effect upon the Controller's acceptance of the Terms of Service and remains in effect for the duration of Nodety's Processing of Personal Data on the Controller's behalf.

12.2 The provisions regarding data deletion and return, and liability, survive termination.

Annex 1: Processing Details

Annex 2: Technical and Organisational Measures

Nodety implements and maintains the following categories of security measures (specific details available at nodety.com/legal/security):

Access Controls: Role-based access controls; multi-factor authentication for Nodety personnel; principle of least privilege.

Encryption: Encryption of data in transit and at rest using industry-standard encryption.

Infrastructure: Hosted on reputable cloud infrastructure providers with industry-standard physical and environmental controls.

Monitoring: Logging and monitoring of access to systems containing Personal Data; intrusion detection.

Personnel: Confidentiality obligations for all personnel; security awareness training.

Incident Response: Documented incident response procedures.

Business Continuity: Regular backups; disaster recovery procedures.

Nodety may update these measures from time to time to reflect changes in technology, threats, or best practices, provided the overall level of protection is not materially reduced.

Last updated: 19 July 2026