Data processing agreement

This agreement forms part of the terms of service between Niko Developments Ltd ("Processor") and the Customer ("Controller") for the Service. It applies where we process personal data on the Customer's behalf, and meets the requirements of Article 28 of the UK GDPR and, where it applies, the EU GDPR.

1. Subject matter and duration

We process personal data to provide the Service to the Customer, for as long as the Customer uses it and until the data is deleted under section 9.

2. Nature, purpose and data

• Purpose: generating, publishing and measuring the Customer's marketing content and links.
• Data subjects: people who interact with the Customer's links and content; people named or quoted in Customer Content or public reviews; the Customer's members.
• Personal data: click metadata (device, browser, referrer, approximate location, language, a daily-rotating keyed hash of the IP address), app install identifiers, public review excerpts, and any personal data the Customer puts in content. No special category data is intended to be processed.

3. Our obligations

• We process personal data only on the Customer's documented instructions, which are these terms and the Customer's use of the Service, and will tell the Customer if we believe an instruction breaks data protection law.
• Everyone we authorise to process the data is bound by confidentiality.
• We apply appropriate technical and organisational measures, including two-factor sign-in, encryption in transit and of stored credentials, workspace isolation, least-privilege access, logging and encrypted backups.
• We help the Customer respond to data subject requests and with security, breach notification, impact assessments and consultations with regulators, taking into account the nature of the processing.

4. Subprocessors

The Customer authorises the subprocessors below. We will give at least 30 days' notice of a new subprocessor by updating this page and emailing workspace owners; the Customer may object on reasonable data protection grounds and, if we cannot address the objection, end the subscription. We remain responsible for our subprocessors and impose equivalent data protection obligations on them.

Social media, app store and analytics platforms the Customer connects (such as Meta, X, Google, TikTok, Apple and RevenueCat) are not our subprocessors: the Customer chooses them and their terms govern the data exchanged with them.

5. International transfers

Where personal data is transferred outside the United Kingdom, we ensure it is protected by adequacy regulations or the UK International Data Transfer Addendum to the EU standard contractual clauses.

6. Security incidents

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information the Customer needs to meet its own obligations.

7. Audits

We make available the information needed to demonstrate compliance with this agreement and allow for audits by the Customer or its auditor on reasonable notice, at most once a year unless required by a regulator or following a breach, subject to confidentiality.

8. Customer obligations

The Customer is responsible for having a lawful basis for the processing it instructs, for the information it gives its audience (for example in its own privacy notice), and for the content it publishes.

9. Deletion and return

When the subscription ends, we provide an export of the Customer's data on request for 30 days, after which we delete personal data processed for the Customer, including from backups within a further 35 days, unless the law requires us to keep it.

10. Contact

Data protection questions and requests: support@nikodev.co.uk.