1. Scope and purpose
This Data Processing Agreement ("DPA") forms part of the agreement between Namd ("Processor") and the customer ("Controller"). It sets out the terms on which the Processor processes personal data on the Controller's behalf.
2. Definitions
- Personal Data: Any information relating to an identified or identifiable natural person
- Processing: Any operation performed on personal data, including collection, storage, use, and deletion
- Data Subject: The individual to whom the personal data relates
- Sub-processor: A third party engaged by the Processor to process personal data
3. Scope of the processing
The Processor processes personal data only to provide the service: running a scan of publicly available pages on a domain the Controller submits, sending the resulting report, and preparing proposed changes to the Controller's repository.
The personal data involved is limited to an email address given so a report can be sent, and a hashed IP address used to enforce the scan rate limit. The Processor does not collect payment data, because it operates no payment processor.
4. Obligations of the Processor
The Processor shall:
- Process personal data only on documented instructions from the Controller
- Ensure that persons authorized to process personal data are bound by confidentiality obligations
- Implement appropriate technical and organizational security measures
- Assist the Controller in responding to data subject requests
- Delete or return all personal data upon termination of services
- Make available the information necessary to demonstrate compliance with this DPA
5. Security measures
- Personal data is held only in the systems named in section 6
- Data is encrypted in transit, and encrypted at rest by the database provider
- IP addresses are hashed before storage and are never written in raw form
- Access to production systems is limited to Namd personnel who need it
- No analytics, advertising or profiling systems have access to personal data
The Processor holds no security certifications of its own. Its infrastructure providers hold their own certifications, which they publish themselves.
6. Sub-processing
The Controller gives the Processor general authorization to engage sub-processors. The current sub-processors are:
- Neon: Postgres database hosting
- Resend: transactional email delivery
- Vercel: application hosting
The Processor shall notify the Controller before adding or replacing a sub-processor. The Controller may object in writing within 30 days of that notice, stating reasonable data protection grounds. The parties shall try to resolve the objection in good faith; if it cannot be resolved, the Controller may terminate the affected service.
The Processor shall impose data protection obligations on each sub-processor equivalent to those in this DPA, and remains liable for the sub-processor's performance.
Model providers are not sub-processors under this DPA. No personal data is sent to them.
7. Data transfers
Where personal data is transferred outside the European Economic Area, the Processor relies on the transfer mechanisms its sub-processors have in place, including standard contractual clauses published by those providers.
8. Data breach notification
The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data. The notification shall include:
- The nature of the breach
- Categories and approximate number of affected data subjects
- Likely consequences of the breach
- Measures taken or proposed to address the breach
9. Audit rights
The Controller may audit the Processor's compliance with this DPA once in any 12 month period, on 30 days written notice, during business hours, at the Controller's own cost, and without disrupting the Processor's operations. The Processor may satisfy an audit request by providing a relevant third-party report or its providers' published documentation, where that answers the Controller's questions.
10. Duration and termination
This DPA remains in effect for the duration of the service agreement. Upon termination, the Processor shall, at the Controller's choice, delete or return all personal data and confirm that it has done so.
11. Liability
Each party's liability under this DPA is subject to the limitations set out in the main service agreement. Nothing in this DPA limits either party's liability for breaches of data protection law.