Data Processing Agreement

1. When this agreement applies

In short: It applies when NINAWA handles personal data of your customers or visitors for you, for example through a website or system that NINAWA builds, hosts or maintains.

This Data Processing Agreement (DPA) forms part of the agreement between the client and the verified legal operator behind NINAWA. It applies whenever NINAWA processes personal data on the client's behalf to deliver the contracted service, for example contact or booking forms, customer accounts, order details or mailing lists on a website or system that NINAWA builds, hosts, maintains or supports.

It does not cover personal data that NINAWA processes for its own purposes, such as the client's own contact details, proposals, invoices or support messages. That processing is described in the Privacy notice.

2. Roles and instructions

In short: You decide what happens with the data; NINAWA only follows your documented instructions.

The client is the controller and the verified legal operator behind NINAWA is the processor. NINAWA processes the data only on documented instructions from the client, unless EU or Belgian law requires otherwise. In that case NINAWA informs the client before processing, unless that law forbids it.

• Documented instructions are this DPA, the accepted proposal and project schedule, and written requests sent through Client Studio or by email.
• NINAWA does not use the data for its own purposes, does not sell it and does not combine it with data of other clients.
• If NINAWA believes an instruction infringes data-protection law, it tells the client and may pause that instruction until it is confirmed or changed.

3. Processing details (Annex I)

In short: The table shows what is usually processed; your project schedule records the exact details for your project.

The accepted proposal or project schedule records the subject, duration, purposes, data categories and data subjects of each project. Where it differs from the table below, the project schedule applies.

4. Confidentiality

In short: Only people who need access to deliver the service can see the data, and they are bound to secrecy.

NINAWA gives access to personal data only to people who need it to deliver the service and who are bound by confidentiality, through a contract or a legal duty. Their access ends when it is no longer needed.

5. Security measures (Annex II)

In short: NINAWA protects the data with technical and organisational measures that fit the risk.

NINAWA applies appropriate technical and organisational measures, taking into account the state of the art, the cost, the nature of the processing and the risks for the people concerned. The current measures are:

• Encrypted transport (HTTPS/TLS) for websites, Client Studio and administration.
• Access only through personal accounts, with strong passwords, session protection and limits on repeated login attempts.
• Separation between clients: every request is checked against the client it belongs to, and automated tests cover this.
• Private storage for files, outside the public website, downloadable only after a permission check; uploads, downloads and deletions are logged.
• Regular encrypted backups, stored separately from the production server with Hetzner in the EU, kept for a limited period (currently 30 days), with a documented restore procedure.
• Email from websites and Client Studio is sent from NINAWA's own mail servers, and visitor statistics run on NINAWA's own server (self-hosted Umami): no third-party email or analytics provider receives the data.
• Software updates and security fixes as part of maintenance and Managed Care.
• A documented incident procedure, logging of important actions, and access for the team limited to what each role needs.

NINAWA may improve these measures over time, but does not lower the overall level of protection without informing the client.

6. Sub-processors

In short: NINAWA only uses other providers that are recorded for your project, and tells you before adding or replacing one.

The client gives a general authorisation for the sub-processors recorded in the project schedule. Today NINAWA's servers are hosted in the EU by Hetzner and by a Belgian hosting company, and encrypted backups are stored at Hetzner. The name of every provider used for a project is stated in the project schedule and given on request. Email and visitor statistics run on NINAWA's own servers, without a third-party email or analytics provider.

NINAWA informs the client by email and in Client Studio at least 14 days before adding or replacing a sub-processor. The client may object on reasonable data-protection grounds. If no reasonable solution is found, the client may end the affected service without penalty.

NINAWA imposes the same data-protection obligations on every sub-processor and remains responsible towards the client for their performance.

7. Help with your obligations

In short: If one of your customers exercises their rights, or you need to assess a risk, NINAWA helps you.

Taking into account the service and the information available to it, NINAWA assists the client with:

• requests from data subjects (access, correction, deletion, objection, portability): NINAWA forwards any request it receives to the client without undue delay and does not answer it unless instructed;
• the security of the processing, the assessment of breaches and the related notifications;
• data protection impact assessments and prior consultation of the supervisory authority where required.

Assistance beyond normal effort is charged at the agreed hourly rate, and only after the client has approved the estimate.

8. Personal-data breaches

In short: If something goes wrong with your data, NINAWA tells you quickly so you can meet your own deadlines.

NINAWA informs the client without undue delay, and aims to do so within 48 hours, after becoming aware of a personal-data breach affecting client data. As far as known, the notice describes:

• what happened and when;
• the categories and approximate number of people and records concerned;
• the likely consequences;
• the measures taken or proposed to limit the harm;
• a contact person.

NINAWA adds information as it becomes available. As controller, the client decides whether to notify the supervisory authority (within 72 hours where required) and the people concerned; NINAWA helps with this.

9. Transfers outside the EEA

In short: Your data stays in the European Economic Area unless your project schedule says otherwise and a valid legal safeguard applies.

NINAWA does not transfer client data outside the European Economic Area unless this is recorded in the project schedule and covered by a valid safeguard, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

10. End of the service: return and deletion

In short: When the service ends, you choose: you get your data back or it is deleted. Backups follow within their normal cycle.

At the end of the service the client chooses whether NINAWA returns the client data (an export of the website, its content and its data) or deletes it. NINAWA then:

• returns or deletes the data as instructed and confirms this in writing;
• lets backups expire through their normal cycle, currently within 30 days, and restores them only to return data to the client;
• keeps only what EU or Belgian law requires, for the required period.

The steps of leaving (export, transfer of domain and accounts, deletion instructions and backup expiry) are shown to the client in Client Studio.

11. Audits and information

In short: You can ask NINAWA to show that it respects this agreement.

NINAWA makes available the information reasonably needed to demonstrate compliance with Article 28 GDPR, first through documentation and written answers. Where that is not enough, the client or an auditor bound by confidentiality may carry out a proportionate audit after reasonable notice, during business hours and without affecting the security of other clients. Each party bears its own audit costs, unless the audit reveals a material breach by NINAWA.

12. Duration, liability and precedence

In short: This agreement lasts as long as NINAWA processes your data, and on data protection it takes precedence over the general Terms.

This DPA applies for as long as NINAWA processes client data, including the return and deletion period. Liability follows the Terms, subject to mandatory law and Article 82 GDPR. If this DPA conflicts with the Terms or another general contract document on data protection, this DPA prevails; a project schedule accepted for a specific project prevails over this standard text for that project.

The English and Dutch versions of this DPA are binding; other languages are translations for convenience. Questions: support@ninawa.net.