Data Processing Agreement

1.Parties, scope and roles

This Data Processing Agreement (DPA) forms part of the agreement between Node AI Limited (NZ company number 8781328) (Node AI) and the customer that has accepted Node AI’s Terms of Service or signed an Order Form (Customer) for the Node service (the Agreement).

1.1 This DPA applies when Node AI processes Customer Personal Data on the Customer’s behalf in providing the service.

1.2 Customer is the controller. Node AI is the processor. Where Customer acts as processor for its own clients, Node AI is a sub-processor and Customer confirms it has authority to appoint Node AI.

1.3Data Protection Laws means the New Zealand Privacy Act 2020, the EU General Data Protection Regulation (GDPR), the UK GDPR, and any other privacy law that applies to the processing. Customer Personal Data, processing, personal data breach and data subject have the meanings given in the GDPR.

1.4 If this DPA conflicts with the Agreement, this DPA prevails on data protection. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

1.5 This DPA lasts as long as Node AI processes Customer Personal Data.

2.Details of processing

These details also form Annex I of the Standard Contractual Clauses.

3.Node AI’s obligations

3.1 Instructions. Node AI processes Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA and Customer’s use of the service settings are those instructions. Node AI will tell Customer if it believes an instruction breaks Data Protection Laws.

3.2 Legal requirement. If law requires Node AI to process data otherwise, Node AI will tell Customer first, unless that law forbids it.

3.3 Confidentiality. Everyone Node AI authorises to process Customer Personal Data is bound by a written duty of confidentiality that continues after their engagement ends.

3.4 Security. Node AI maintains the technical and organisational measures in Annex 1, which reflect its ISO/IEC 27001 information security management system. Node AI may update them, but will not reduce the overall level of protection.

3.5 No other use. Node AI does not sell Customer Personal Data or use it to train AI models. Node AI’s AI providers do not train on Customer Personal Data and do not retain it, except that some providers may keep prompts for a limited period for safety and abuse monitoring.

3.6 Customer’s duties. Customer is responsible for having a lawful basis and giving any required notices for the data it connects, and for the accuracy of its instructions.

4.Subprocessors

4.1 Customer gives general authorisation for Node AI to use the subprocessors listed at https://trust.nodehq.ai, which shows what each does and where it processes data.

4.2 Node AI will give at least 30 days’ notice before adding or replacing a subprocessor, by updating that list and notifying Customers who subscribe to updates.

4.3 Customer may object on reasonable data protection grounds within that notice period. The parties will try to resolve the objection in good faith. If they cannot, Customer may end the affected part of the service and receive a refund of prepaid fees for the unused period.

4.4 Node AI imposes data protection terms on each subprocessor that are no less protective than this DPA, and remains liable to Customer for each subprocessor’s performance.

5.Breaches and assistance

5.1 Breach notice. Node AI will notify Customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe what happened, the data and people likely affected, likely consequences, and the steps taken. Information not yet known will follow as it becomes available.

5.2 Node AI will take reasonable steps to contain the breach and help Customer meet its own notification duties. Notifying Customer is not an admission of fault.

5.3 Data subject requests. Node AI will promptly pass to Customer any request it receives from a data subject about Customer Personal Data. Node AI will help Customer respond, including through features of the service.

5.4 Other assistance. Node AI will give reasonable help with Customer’s data protection impact assessments and consultations with regulators, taking into account the nature of the processing and the information available to Node AI.

6.Deletion and return

6.1 Customer can export its content through the service at any time before the Agreement ends.

6.2 Within 30 days after the Agreement ends, Node AI will delete Customer Personal Data, unless law requires Node AI to keep it. Copies in backups expire within a further 7 days and are not restored to ordinary use. On request, Node AI will confirm deletion in writing.

7.Audits

7.1 Node AI will make available the information needed to show compliance with this DPA, including its ISO/IEC 27001 certificate and Statement of Applicability once issued, and answers to reasonable security questionnaires.

7.2 If that information is not enough to meet a legal or regulatory requirement, Customer may audit Node AI once in any 12 months, on at least 30 days’ notice, during business hours, at Customer’s cost, and under confidentiality terms. Audits after a personal data breach are not limited to once a year.

8.International transfers

8.1 Where Customer Personal Data subject to the GDPR is transferred to Node AI or a subprocessor in a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference: Module 2 where Customer is a controller and Module 3 where Customer is a processor. For those clauses:

• Clause 7 (docking clause) applies
• Clause 9 uses Option 2, general authorisation, with the notice period in section 4.2
• the optional wording in Clause 11 does not apply
• Clauses 17 and 18: the law and courts of Ireland
• Annex I is section 2 of this DPA; Annex II is Annex 1 of this DPA; Annex III is the subprocessor list at https://trust.nodehq.ai

8.2 For data subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies, with Tables 1 to 3 completed from this DPA and either party able to end it under its Section 19.

8.3 For data subject to the New Zealand Privacy Act 2020, Node AI discloses personal information outside New Zealand only under comparable safeguards, as Information Privacy Principle 12 requires.

9.Liability and general

9.1 Each party’s liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow that.

9.2 This DPA is governed by the law that governs the Agreement, except as section 8 says.

9.3 Customers who need a signed copy can request one at privacy@nodehq.ai.

Annex 1: Security measures

• Access to production systems limited to named staff, with multi-factor authentication; privileged access reviewed every six months and all other access annually
• Encryption of data in transit and at rest
• Each piece of information keeps its source’s permissions; AI features act only with the requesting user’s access
• Code changes pass automated checks and need approval before reaching production; every deployment is recorded
• Vulnerabilities fixed within set deadlines: critical within 7 days, high within 30 days
• Backups with tested restoration, and a documented incident response process
• Staff confidentiality agreements, background screening and security training
• Supplier security reviewed before use and annually

Contact

Privacy Officer, privacy@nodehq.ai