# Data Processing Agreement (Template)

**This is a template.** Executed only when countersigned by both parties.
Have your counsel review before signing.

This Data Processing Agreement ("**DPA**") forms part of the Master Services
Agreement or order form ("**Agreement**") between:

- **Customer:** {{CUSTOMER_LEGAL_NAME}}, of {{CUSTOMER_ADDRESS}} ("**Controller**")
- **Processor:** Nabii.Space ("**Nabii.Space**", "**Processor**"),
  contact: legal@nabii.space

Effective on the later of the two signature dates below.

---

## 1. Definitions

Terms used but not defined here (including "personal data", "processing",
"data subject", "controller", "processor", "sub-processor") have the meanings
given in the EU General Data Protection Regulation 2016/679 ("**GDPR**") and
the UK GDPR, as applicable.

## 2. Roles and scope

2.1. Customer is the Controller and Nabii.Space is the Processor of the personal
data described in **Annex I**.

2.2. Nabii.Space will process personal data only on documented instructions from
Customer, which are set out in the Agreement, this DPA, and Customer's
configuration of the service.

## 3. Nabii.Space's obligations

Nabii.Space will:

- (a) process personal data only for the purposes set out in Annex I;
- (b) ensure that personnel authorized to process personal data are bound by
  confidentiality;
- (c) implement the technical and organizational measures set out in **Annex II**;
- (d) assist Customer, taking into account the nature of the processing, to
  respond to data subject requests under Chapter III of the GDPR;
- (e) assist Customer in ensuring compliance with Articles 32–36 GDPR;
- (f) at Customer's choice, delete or return all personal data at the end of the
  Agreement, and delete existing copies unless retention is required by law;
- (g) make available to Customer all information reasonably necessary to
  demonstrate compliance with Article 28 GDPR.

## 4. Sub-processors

4.1. Customer provides general authorization for Nabii.Space to engage the
sub-processors listed in `subprocessors.md`, updated from time to time.

4.2. Nabii.Space will give Customer at least **30 days'** notice of the intended
addition or replacement of a sub-processor by updating the published list and,
where Customer has provided an email address for such notices, by email.

4.3. Customer may object on reasonable data-protection grounds within the notice
period. The parties will work in good faith to resolve the objection; failing
resolution, Customer may terminate the affected service without penalty.

4.4. Nabii.Space imposes on each sub-processor data-protection obligations no
less protective than those in this DPA.

## 5. International transfers

Where personal data is transferred outside the EEA, UK, or Switzerland to a
country without an adequacy decision, the parties agree that the Standard
Contractual Clauses (Module 2, Controller-to-Processor) approved by
Commission Implementing Decision (EU) 2021/914 are incorporated by reference,
with the following selections:

- Clause 7 (docking clause): **not** used
- Clause 9(a): **general written authorization**, 30 days
- Clause 11: independent dispute resolution **not** used
- Clause 17: governed by the law of **Ireland**
- Clause 18: courts of **Dublin, Ireland**
- Annexes I–III: as set out in this DPA

For UK transfers, the UK Addendum (issued by the Information Commissioner
under s.119A DPA 2018) is incorporated, with Table 4 set to allow either
party to terminate on 30 days' notice.

## 6. Security incidents

Nabii.Space will notify Customer of a personal-data breach affecting Customer
data without undue delay and in any event within **72 hours** of confirmation,
including the categories and approximate number of data subjects and records,
the likely consequences, and the measures taken.

## 7. Audits

7.1. Nabii.Space will make available to Customer, on request and no more than
**once per calendar year**, the current version of its SOC 2 report (when
issued), its written responses to a reasonable security questionnaire, and
the current version of the Trust Center documentation.

7.2. If the above materials do not reasonably satisfy Customer, and Customer
demonstrates a specific compliance concern, an on-site audit may be arranged
on 60 days' notice, at Customer's cost, subject to reasonable scope and
confidentiality controls.

## 8. Liability and term

Liability under this DPA is subject to the limitations in the Agreement. This
DPA continues for as long as Nabii.Space processes personal data on Customer's
behalf.

---

## Annex I — Processing details

| Item | Value |
|---|---|
| Subject-matter | Provision of the Nabii.Space service to Customer |
| Duration | Term of the Agreement plus deletion window |
| Nature and purpose | AI-assisted drafting, provenance verification, follow-through workflows |
| Categories of data subjects | Customer's authorized users; recipients of drafts Customer chooses to share |
| Categories of personal data | Name, email, IP address, user-generated content (drafts, voice samples, notes, uploads) |
| Special categories | None expected. Customer must not submit special-category data or PHI without a separately executed BAA. |
| Retention | While account is active; deletion within 30 days of termination request |

## Annex II — Technical and organizational measures

| Domain | Measure |
|---|---|
| Access control | Password + email verification; RLS on every user table; server-side role checks |
| Encryption | TLS 1.2+ in transit; AES-256 at rest via managed backend |
| Secrets management | Platform secret manager; no secrets in source |
| Change management | Code review on every production change; versioned schema migrations |
| Logging | Application logs; database audit log; runtime error capture |
| Data segregation | Per-tenant row-level isolation; no cross-tenant queries |
| Personnel | Confidentiality obligations; access on a need-to-know basis |
| Incident response | 72-hour notification; postmortem shared with affected customers |

## Annex III — Sub-processors

See `subprocessors.md` (published version). At execution, both parties confirm
the version reviewed and dated.

---

**Signed for Customer:** ___________________________  Date: __________
**Signed for Nabii.Space:** _____________________  Date: __________