Data processing agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between NakodaX Technologies Private Limited (“NakodaX”) and the customer. It applies when NakodaX processes personal data on the customer’s behalf through the Service. If this DPA and the Terms differ on how personal data is handled, this DPA applies.

The customer decides why and how personal data in Customer Content is processed, and is the controller of it (or the processor, where the customer handles it for someone else). NakodaX processes it on the customer’s behalf as a processor.

• Purpose: providing the Service to the customer.
• How long: while the account is active, and until deletion under section 9.
• What we do: store customer content in encrypted form, share it as the customer directs, record access history, and hold keys and licences.
• Personal data: account details of the customer’s users, email addresses of recipients, access history, and any personal data inside content the customer shares. That content is encrypted on the customer’s side before it reaches us.
• Whose data: the customer’s users, the people they share with, and people named in shared content.

NakodaX processes personal data only to provide the Service as described in the Terms and as the customer directs through the Service. It does not use it for any other purpose. If NakodaX believes an instruction would break the law, it will tell the customer.

People at NakodaX who can access personal data are bound by confidentiality.

NakodaX keeps the safeguards described on its Security page, including encryption on the customer’s side, controlled access, logging, and a written process for handling incidents.

The customer authorises NakodaX to use the sub processors listed on the sub processors page. NakodaX updates that list and notifies customers when it adds or replaces one, and remains responsible for the work its sub processors do.

NakodaX helps the customer respond to requests from people about their personal data, such as access, correction or deletion.

If NakodaX confirms a personal data breach that affects the customer’s data, it will tell the customer without undue delay, with the details it has.

When the account ends, the customer can retrieve its content for 90 days. After that, NakodaX deletes it, unless the law requires NakodaX to keep a copy.

NakodaX gives the customer the information it needs to show that this DPA is being followed, and answers security questionnaires. Send requests to security@nakodax.com.

When personal data moves between countries, NakodaX uses the safeguards the law requires, such as the standard contractual clauses approved for the purpose.

If you have questions about this DPA, contact us at security@nakodax.com.