Data Processing Addendum

011. Status of the parties

For Personal Data about Customer’s End Users, Customer is the controller and nulvless is the processor. Customer determines the purposes and means; we act on Customer’s documented instructions.

Customer’s instructions are: the Terms, this DPA, the configuration Customer sets in the Console, and the calls Customer makes to the API. We will not process the data for any other purpose.

If an instruction would in our view infringe applicable data protection law, we will inform Customer without undue delay and may suspend that processing until it is resolved.

For Personal Data about Customer itself — Account, billing, support — nulvless is the controller and the Privacy Policy governs it, not this DPA.

022. Processor obligations

We commit to the following for the duration of the Service:

• Process Personal Data only on Customer’s documented instructions, including for transfers, unless required otherwise by law — in which case we will inform Customer beforehand unless that law forbids it on important grounds of public interest.
• Ensure everyone authorised to process the data is bound by an obligation of confidentiality.
• Implement and maintain the technical and organisational measures set out in Annex 2.
• Respect the conditions in this DPA for engaging another processor.
• Assist Customer, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights.
• Assist Customer with security, breach notification and data protection impact assessments, taking into account the nature of processing and the information available to us.
• At Customer’s choice, delete or return the Personal Data at the end of the Service, and delete existing copies unless law requires retention.
• Make available the information necessary to demonstrate compliance with these obligations, and allow for and contribute to audits as described in section 6.

033. Sub-processing

Customer gives general authorisation for nulvless to engage sub-processors. The current list is set out in Annex 3 and names each provider, its activity and its location.

We will give at least thirty days’ notice before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, Customer may terminate the affected part of the Service without penalty and receive a refund for the unused period.

Each sub-processor is engaged under written terms offering protection no less than this DPA. We remain fully liable to Customer for their performance.

Where Customer configures its own delivery provider, that provider is Customer’s sub-processor under Customer’s own agreement, and this section does not apply to it.

A social identity provider also falls outside this section, for a different reason: it decides its own purposes and means for the end user data it holds, and acts as an independent controller towards both nulvless and Customer. It is the sub-processor of neither.

044. Data subject requests

The Service gives Customer the means to access, correct, export and delete an End User’s Personal Data directly, through the Console and the API. Customer should use those in the first instance.

If a data subject contacts us about data we process for Customer, we will not respond to the substance. We will refer them to Customer and inform Customer without undue delay.

Where Customer cannot fulfil a request through the Service, we will provide reasonable assistance at Customer’s cost, unless the law requires otherwise.

055. Personal data breach

We will notify Customer without undue delay, and in any event within seventy-two hours, after becoming aware of a personal data breach affecting Personal Data processed for Customer.

The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point. Where we cannot provide all of it at once, we will provide it in phases without undue delay.

We will document each breach and the remedial action taken, and make that documentation available to Customer.

Notifying Customer is not an acknowledgement of fault. Notifying a supervisory authority or affected data subjects is Customer’s responsibility as controller.

066. Audit and records

On request, we will make available the information necessary to demonstrate compliance with this DPA, including our current security documentation and any third-party assessment reports we hold.

Customer may audit no more than once in any twelve-month period, on thirty days’ written notice, during business hours, subject to confidentiality obligations, and without disrupting the Service or the data of other customers. A supervisory authority may audit where the law requires it.

Where an audit goes beyond the information we already make available, Customer bears the reasonable cost of our participation.

We maintain a record of processing carried out on Customer’s behalf, as required by article 30(2) of the GDPR.

077. International transfers

nulvless’s primary processing facilities are in the United States. That said, nulvless may process Personal Data anywhere it or its sub-processors maintain facilities, as identified in Annex 3. Part of the Service runs on a distributed edge network, where the place of processing follows the origin of the request.

Where Customer directs a specific region, nulvless will ensure the data is stored and primarily processed in that region, except for the features that depend on the edge network.

Where Personal Data is transferred out of the European Economic Area, Switzerland or the United Kingdom to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses, module two (controller to processor), which are incorporated into this DPA by reference.

For the purposes of those Clauses: Customer is the data exporter and nulvless is the data importer; the optional docking clause applies; Annex 1 supplies the description of the transfer and Annex 2 the technical and organisational measures.

For transfers subject to the UK GDPR, the International Data Transfer Addendum to those Clauses applies.

For transfers subject to the LGPD, the parties rely on the mechanism permitted under article 33 that applies to the transfer in question.

088. Third-party and government access requests

If we receive a legally binding request from a public authority for Personal Data we process for Customer, we will notify Customer before responding, unless the law prohibits it.

We will challenge a request that appears unlawful or overbroad, disclose only the minimum the request requires, and keep a record of what was disclosed.

099. Deletion and return

On termination, Personal Data remains available for export for thirty days. After that we delete it from production systems.

Backups follow their own expiry cycle, after which the data is gone from those too. Until then it remains subject to this DPA.

We will confirm deletion in writing on request.

1010. Liability

Our liability under this DPA is subject to the limitations in the Terms, except where applicable data protection law does not permit that limitation.

Nothing in this DPA relieves either party of its own obligations or liability under applicable data protection law.

11Annex 1 — Description of processing

Subject matter and duration — provision of the Service under the Terms, for as long as Customer’s Account is active plus the deletion periods in section 9.

Nature and purpose — authenticating End Users, deciding what they may access, delivering the transactional messages those flows require, protecting against abuse, and maintaining the audit record.

Categories of data subjects — Customer’s End Users, and the members of Customer’s organization who use the Console.

Categories of Personal Data:

• Identifiers — email address, phone number and country code, username, and the profile fields Customer chooses to store.
• Credentials — passwords as salted hashes, multi-factor secrets, single-use recovery codes.
• Linked accounts — the identifier returned by a social identity provider.
• Session records — IP address, browser and operating system, device vendor, model and type, CPU architecture, and a hash derived from these.
• Approximate location derived from the IP address — city, region, country, coordinates and time zone, from an offline lookup table.
• Authentication context — methods used, assurance level, sign-in times, elevation state.
• Activity and audit — actor, target, category and time of each change.
• Delivery records — channel and outcome of each message sent.
• Custom metadata Customer chooses to attach.

The Terms prohibit Customer from placing payment card numbers, government identification numbers, biometric identifiers or health records in user metadata, profile fields or token claims. No special category data is processed by design.

Frequency — continuous, for as long as End Users interact with Customer’s product.

Retention — as set out in the Privacy Policy and section 9 of this DPA.

12Annex 2 — Technical and organisational measures

• Encryption of Personal Data in transit using current TLS.
• Passwords stored as salted hashes using an adaptive algorithm with a configurable work factor — bcrypt or PBKDF2, selectable per Project. Never recoverable in plaintext.
• Logical isolation between Projects, and between Environments within a Project, each with its own data and its own credentials.
• Access to production limited to personnel who require it, subject to confidentiality obligations, with every administrative action recorded.
• Credentials appearing in request URLs — tokens, one-time codes and API keys — masked at the gateway before any log entry is written, leaving only the final four characters. Request bodies are not logged.
• Rate limiting and optional bot protection in front of the authentication, recovery and lookup endpoints.
• Step-up authentication required for security-sensitive operations, configurable per Project.
• An audit trail recording actor, target, category and time for changes to configuration and identity data.
• Backups with a defined expiry cycle and documented restoration procedures.
• Segregation of duties and least-privilege access for internal systems.

We do not hold a SOC 2 or ISO 27001 certification at this time. This annex will be updated when that changes, rather than implying it beforehand.

13Annex 3 — Sub-processors

The following third parties are engaged to deliver the Service. Changes are notified as described in section 3.

Providers Customer configures with its own credentials — email and SMS senders, and the bot-protection provider — are not listed here. Customer instructs them directly under its own agreement, which makes them Customer’s sub-processors, not ours. SMS has no fallback sender: without a provider configured by Customer, no SMS is sent.

1411. General

This DPA takes effect when Customer accepts the Terms and remains in force while we process Personal Data for Customer.

This DPA is governed by the same law as the Terms, except where data protection law requires otherwise. Questions go to [email protected], or to NULVLESS CLOUD LTDA, R. Amélia Rodrigues, Cond. Vila Olímpica 1, CEP 44.430-716, Santo Antônio de Jesus, BA, Brazil.