nadicode Data Processing Agreement

1. Parties and Scope

1.1. This Data Processing Agreement ("DPA") is between NADICODEAI S.R.L. ("nadicode") and the business that accepted the nadicode Terms of Service ("Customer"). It forms part of the Terms, and words defined in the Terms have the same meaning here. For the processing of personal data on Customer's behalf, this DPA prevails over the rest of the agreement, as clause 2.2 of the Terms provides.

1.2. This DPA applies when nadicode processes personal data contained in Customer Content on Customer's behalf. That happens when nadicode:

(a) passes an Agent's requests to AI models through the model access nadicode provides;

(b) relays an Agent's actions in a connected app through the Portal;

(c) stores, in the Portal, the reports Customer's installations send about their Agents, their settings and their work; and

(d) gives support that Customer asks for and that requires access to Customer Content.

1.3. Customer Content that stays on Customer's own computers, including what Nadia keeps and the messages and files of an Alveare workspace run with Alveare Server, is not processed by nadicode, and this DPA does not apply to it.

1.4. nadicode's processing as a controller, such as account, billing and usage data, is described in the Privacy Policy and is outside this DPA.

2. Roles and Instructions

2.1. Customer is the controller of the personal data in Customer Content, and nadicode is its processor.

2.2. nadicode processes that data only on Customer's documented instructions, including about transfers outside the European Economic Area, unless the law requires otherwise; in that case nadicode tells Customer first, unless the law forbids it. Customer's use and configuration of the Service, including what each Agent may do and use, are its instructions.

2.3. nadicode tells Customer at once if it believes an instruction infringes data protection law.

3. Details of the Processing

3.1. Subject matter and purpose: providing the Service described in the Terms and the Service Terms.

3.2. Nature: transmission to AI model providers and to connected apps, storage of installation reports, and access for support.

3.3. Duration: while the Terms last, and afterwards until deletion under clause 9.

3.4. Data subjects: Customer's personnel, and the people whose personal data appears in the business communications, documents and records Customer's Agents work with, such as Customer's customers and suppliers.

3.5. Categories of data: contact details, identifiers and the content of business communications, documents and records that Customer's Agents work with, and any other personal data Customer chooses to give them. nadicode does not intend to process special categories of data; if Customer gives such data to an Agent, Customer is responsible for its lawful basis.

4. Confidentiality and Security

4.1. nadicode ensures that the people it authorises to process the data are bound to confidentiality, and limits access to those who need it.

4.2. nadicode keeps technical and organisational measures appropriate to the risk, as Article 32 GDPR requires, including encryption in transit, access control, and a primary database in the European Union.

5. Sub-processors

5.1. Customer authorises nadicode to use sub-processors. The current list is published at portal.nadicode.ai/legal/subprocessors.

5.2. nadicode binds each sub-processor by contract to data protection obligations no less protective than this DPA, and remains liable to Customer for its sub-processors' performance.

6. Data Subject Requests and Assistance

6.1. nadicode helps Customer, as far as it can, to answer requests from people exercising their rights under the GDPR. If nadicode receives such a request about Customer Content, it forwards it to Customer and does not answer it itself.

6.2. nadicode helps Customer meet its obligations on security, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR, taking into account the information available to it.

7. Changes to Sub-processors

7.1. nadicode notifies Customer's administrators by email at least 15 days before a new sub-processor starts processing Customer Content.

7.2. Customer may object on reasonable data-protection grounds within that period, and the parties then try in good faith to resolve the objection.

7.3. If they cannot, Customer may end the affected subscription and the Terms before the change takes effect, without any fee.

8. Personal Data Breaches

8.1. nadicode notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Content, and gives Customer the information it needs to meet its own obligations under Articles 33 and 34 GDPR.

9. Deletion and Return

9.1. When the Terms end, Customer may export its Customer Content during the period clause 16.3 of the Terms provides. After that period nadicode deletes the personal data in Customer Content it holds, unless the law requires it to keep it, and confirms the deletion on request.

10. Audits

10.1. nadicode makes available the information needed to show that it complies with this DPA. Where that information is not enough, Customer may, on reasonable notice and at most once a year, audit nadicode itself or through an independent auditor bound to confidentiality, at its own cost, in a way that limits disruption to nadicode's business. A supervisory authority's request, or a breach, allows a further audit.

11. Transfers Outside the European Economic Area

11.1. Where a sub-processor processes personal data in Customer Content outside the European Economic Area, the transfer relies on an adequacy decision, including the EU-U.S. Data Privacy Framework for certified recipients, or on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, which are incorporated into this DPA for that transfer. The sub-processor list names the safeguard for each provider.

12. Liability and Governing Law

12.1. Each party's liability under this DPA is subject to clause 13 of the Terms.

12.2. This DPA is governed by the law, and subject to the courts, that the Terms name.