Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the nifdi Terms of Service available at nifdi.app/legal/terms, as updated in accordance with section 17 of those terms (the “Terms”), between you and Nifdi Systems Limited (“nifdi”, “we”, “us”). This DPA is published at nifdi.app/legal/dpa. In this DPA, “you” means a customer that uses the Service for business purposes.

1. Application and definitions

1.1 This DPA applies where Your Content includes personal data for which you are a controller, or a processor acting on behalf of another controller (“Customer Personal Data”). It does not apply if you use the Service for purely personal purposes.

1.2 In this DPA, “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “supervisory authority” have the meanings given in Data Protection Law. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and, where it applies to the processing, Regulation (EU) 2016/679 (the “EU GDPR”), each as amended or replaced from time to time. “Subprocessor” means any third party we engage to process Customer Personal Data.

1.3 Capitalised terms not defined in this DPA have the meanings given in the Terms.

2. Roles of the parties

2.1 You are the controller (or a processor on behalf of the controller) of Customer Personal Data, and we are your processor (or subprocessor).

2.2 We act as an independent controller, and this DPA does not apply, to the extent that we determine the purposes and means of processing of each of the following, as described in our Privacy Policy: account and sign-in data; authentication, security monitoring, abuse-prevention and other security and operational records needed to operate sharing and access controls; usage statistics; product analytics; marketing emails; error reports; security and operational logs; subscription records; support correspondence; abuse reports; legal demands; and incident records. A single record may involve processing in both capacities. Diagram content or other Customer Personal Data that you supply to us for support remains Customer Personal Data processed under this DPA, except to the extent we independently process a copy for security, compliance with law or the establishment, exercise or defence of legal claims.

2.3 Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

2.4 Each party will comply with its obligations under Data Protection Law in relation to Customer Personal Data that it processes under or in connection with the Terms.

3. Your obligations

3.1 You are responsible for ensuring that you have a lawful basis for the processing of Customer Personal Data, that you have given any notices and obtained any consents required by Data Protection Law, and that your instructions to us comply with Data Protection Law.

3.2 You will not store in the Service the data described in “What not to store” in section 5 of the Terms, including special category personal data, personal data relating to criminal convictions and offences, payment card data, government-issued identification numbers and secrets, and you are responsible for the consequences of doing so. If such data is nevertheless processed, it remains Customer Personal Data and subject to this DPA, without prejudice to our rights to suspend, delete or terminate under the Terms.

3.3 You are responsible for the sharing and access decisions you make in the Service, including who you share a diagram with and the permissions you give them.

3.4 You will maintain any registrations and notifications required of you under Data Protection Law.

3.5 Without limiting our obligations under section 6, you are responsible for appropriate security measures for personal data in your possession or control, including your devices, accounts and credentials, and for keeping your own copies of personal data so that you can recover it if it is lost or corrupted.

3.6 You confirm that, based on the information we have provided, you have assessed the Service and are satisfied that it is suitable for your purposes and that we provide sufficient guarantees to implement appropriate technical and organisational measures that meet the requirements of Data Protection Law. This confirmation does not limit our obligations under this DPA or Data Protection Law, or our liability for inaccurate information or for failing to maintain the measures described in this DPA.

3.7 Subject to section 14, neither party is liable to the other for any loss arising from a breach of Data Protection Law or this DPA to the extent that the loss was caused by the other party’s breach of this DPA or Data Protection Law, unlawful instructions or negligent acts or omissions (including, in your case, those of your users or anyone acting on your instructions). This section does not affect either party’s obligations under Data Protection Law.

3.8 Where you act as a processor on behalf of another controller, you warrant that you are authorised by that controller to appoint us as your subprocessor and to give the instructions set out in the Terms and this DPA, and you will be the sole point of contact for that controller unless the law requires otherwise.

4. Processing on your instructions

4.1 We will process Customer Personal Data only on your documented instructions, including with regard to transfers outside the United Kingdom, unless the law requires us to do otherwise. In that case, we will tell you of that legal requirement before processing, unless the law prohibits us from doing so on important grounds of public interest.

4.2 The Terms, this DPA and your use and configuration of the Service (including creating, editing, sharing, exporting and deleting diagrams, and connecting agents or integrations) are your complete instructions. Any additional instructions must be agreed in writing.

4.3 Any action taken in the Service by you, your users, or an agent, integration or other third party you instruct (including deleting Customer Personal Data) is an instruction for the purposes of this DPA. You are responsible for ensuring that such actions are authorised by you and any other relevant controller. If Customer Personal Data is deleted on such an instruction, we are not obliged to restore it, except as the Service ordinarily allows.

4.4 We will tell you promptly if, in our opinion, an instruction infringes Data Protection Law. We are not required to carry out an instruction we reasonably believe to be unlawful. We may suspend the affected processing or part of the Service immediately where necessary to avoid unlawful processing or a material security risk, and otherwise after notifying you. We will discuss with you in good faith a lawful alternative. If no lawful alternative can be agreed within a reasonable period, either party may terminate the affected processing or Service on written notice.

4.5 We do not use Customer Personal Data to train AI models, sell it, use it for advertising, or send it to analytics. We do not send Customer Personal Data to an AI model on our own initiative. If you connect an AI agent or other third-party tool that you independently select and contract with, Customer Personal Data is sent to that tool on your instruction, and that tool and its provider act as your processor or an independent controller, not as our Subprocessor. Any provider that we select, contract with or control to deliver an integrated feature of the Service is our Subprocessor and is listed in the Register.

5. Confidentiality

We will ensure that everyone we authorise to process Customer Personal Data is bound by an appropriate duty of confidentiality and processes it only as this DPA permits.

6. Security

6.1 We will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of individuals. As appropriate, these include encryption and pseudonymisation, measures to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, the ability to restore access to Customer Personal Data in a timely manner after an incident, and a process for regularly testing and evaluating the effectiveness of these measures, including the measures described in Schedule 2.

6.2 We may update our security measures from time to time, provided that the overall level of security is not materially reduced. Where practicable, we will give you reasonable advance notice of any material change to the architecture of the measures described in Schedule 2. Urgent security improvements do not require advance notice. We will keep the current version of Schedule 2 available to you.

7. Subprocessors

7.1 You give us general authorisation to engage Subprocessors. Our current Subprocessors are listed in our Providers and Data Transfers register at nifdi.app/legal/providers (the “Register”), which identifies each Subprocessor, its function, the data it receives, where it processes data and the transfer safeguard used.

7.2 We will update the Register and give you at least 30 days’ notice by email or in the product before adding or replacing a Subprocessor, and the new Subprocessor will not process your Customer Personal Data before that period expires. You may object on reasonable data protection grounds within that period. If you object, we will use reasonable efforts to avoid using the proposed Subprocessor for your Customer Personal Data, change your configuration or offer an alternative. If no lawful and commercially reasonable solution is available, either party may terminate the affected Service before the Subprocessor processes your Customer Personal Data, and you will receive a refund of the unused part of your billing period. Where we must engage a Subprocessor urgently because of a genuine security or service-continuity emergency, we may do so with shorter notice, will notify you as soon as possible, and you may exercise the objection and termination rights in this section within 30 days of that notice.

7.3 We will impose on each Subprocessor, by written contract, substantially the same data protection obligations as are imposed on us under this DPA, to the extent applicable to the Subprocessor’s services, including sufficient guarantees to implement appropriate technical and organisational measures. We remain liable to you for the performance of each Subprocessor’s obligations, subject to section 14.

7.4 Paddle acts as an independent controller for purchases and is not our Subprocessor. Paddle does not ordinarily receive diagram content or other Customer Personal Data through the Service. If you voluntarily submit such data to Paddle, Paddle handles it under its own terms and privacy notice. This does not change our responsibility for any disclosure we make ourselves.

8. International transfers

We will not transfer Customer Personal Data outside the United Kingdom (or, where the EU GDPR applies, the European Economic Area) unless the transfer is covered by one of the following, applied in this order: (a) adequacy regulations or an adequacy decision covering the destination country; (b) if (a) does not apply, the recipient’s certification under an approved framework, such as the UK Extension to the EU-US Data Privacy Framework; or (c) otherwise, the contractual safeguard specified in Schedule 3 for that transfer. This section constitutes your instructions regarding transfers under section 4. The Register identifies the mechanism actually relied on for each Subprocessor, and we will provide a copy of the relevant safeguard on request. Where we rely on a contractual safeguard, we will carry out any transfer risk assessment, data protection test or supplementary-measures assessment required by Data Protection Law. You are responsible for selecting and authorising any recipients in other countries (including people you share with and agents or integrations you connect) and for ensuring that your instructions to make such transfers are lawful. We remain responsible for complying with our processor obligations for any transfer we make, including following your documented instructions, applying safeguards where required and providing information you reasonably need.

9. Data subject requests

9.1 If we receive a request from a data subject concerning Customer Personal Data, we will forward it to you promptly where we can identify you, with sufficient information to identify the request and the date we received it. We will not respond to the request ourselves except on your documented instructions or where the law requires it, other than to direct the data subject to you. We may tell the data subject that you are the relevant customer.

9.2 Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance, through appropriate technical and organisational measures, to help you respond to such requests and to related correspondence from supervisory authorities. You can export any diagram from the editor at any time, and edit or delete diagrams directly in the Service. Ordinary assistance required by Data Protection Law is included in the Service fees. We may charge reasonable, documented costs, agreed with you in advance where practicable, only for unusually extensive or bespoke assistance, and not where the assistance is needed because of our breach of this DPA.

10. Personal data breaches

10.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Our initial notice may be based on the information reasonably available at the time and will not be delayed pending a full investigation. We may also notify you of significant suspected incidents without admitting that a personal data breach has occurred.

10.2 Our notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where information is not available at the time, we will provide it in phases as it becomes available.

10.3 We will take reasonable steps to contain, investigate and mitigate the breach, and will keep you informed of material developments. Our notification of a breach is not an acknowledgement of fault or liability.

11. Assistance

If we become aware that our processing of Customer Personal Data is likely to result in a high risk to the rights and freedoms of data subjects, we will inform you promptly. Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to help you meet your obligations under Articles 32 to 36 of the UK GDPR, including in relation to data protection impact assessments and prior consultation with a supervisory authority. Ordinary assistance is included in the Service fees. We may charge reasonable, documented costs, agreed with you in advance where practicable, only for unusually extensive or bespoke assistance, and not where the assistance is needed because of our breach of this DPA.

12. Deletion and return

12.1 You may export Your Content at any time during the term of your account and, where section 13 of the Terms allows, for 30 days after your access ends. At your choice, and unless the law requires retention, after the Service ends we will either return Customer Personal Data to you through the available export tools or delete it. You must make your choice and complete any export within that 30-day period. Where export through the Service is unavailable under section 13 of the Terms, we will provide another lawful method of return where reasonably possible, and suspension or termination for an ordinary breach of the Terms will not by itself remove your right to return. If you close your account yourself, that closure is your instruction to delete Customer Personal Data under section 12.2, and you will not be able to export Your Content after closure, so you should export anything you want to keep before closing your account.

12.2 When you delete a cloud diagram, we remove it from the live Service immediately, so that it can no longer be accessed through the Service, and keep it for 30 days so that it can be restored if it was deleted by mistake. At the end of that 30-day period, we destroy the keys used to encrypt the diagram, so that all stored copies of it, including its backups, can no longer be read and are put beyond use. We then delete the backup copies within a further 28 days, and the copies of those keys held in our hosting provider’s recovery history within a further 30 days, after which no readable copy of the diagram remains. These periods apply in place of the backup retention periods described in Schedule 2. If you close your account, or we close it at the end of the period in section 12.1, the account can no longer be used to sign in, and the cloud diagrams it owns are deleted in the same way, counted from the date of closure. Any other Customer Personal Data associated with the account, including the email addresses and permissions of people diagrams are shared with, is deleted or put beyond use within the same periods.

12.3 We may retain Customer Personal Data where the law requires us to do so. Any retained data remains subject to this DPA for as long as we hold it.

13. Information and audits

13.1 We will make available to you the information reasonably necessary to demonstrate our compliance with Article 28 of the UK GDPR, which may include written responses to reasonable security questionnaires (no more than once in any 12-month period unless you have reasonable grounds to suspect non-compliance with this DPA) and summaries of our policies.

13.2 Where a requested audit or questionnaire scope is addressed by an independent audit report, certification or industry-standard questionnaire issued within the previous 12 months that actually covers the relevant controls operated by us (or, for controls operated by a hosting Subprocessor, that Subprocessor’s report), and we confirm there have been no known material changes to those controls, you will accept that material instead. If the compliance materials we supply leave a material, reasonably identified compliance question unresolved, an audit is reasonably required to investigate a material incident, or a supervisory authority requires it, you may carry out an audit, or have one carried out by an independent auditor bound by confidentiality, on at least 30 days’ written notice (or shorter notice where reasonably required following a personal data breach or by a supervisory authority), no more than once in any 12-month period (except after a personal data breach or where a supervisory authority requires it), during normal business hours and in a way that minimises disruption to the Service. You will bear your own costs and reimburse our reasonable, documented costs of supporting the audit, agreed in advance where practicable, except that we will bear our own costs where the audit identifies a material breach of this DPA by us. Audits will not extend to other customers’ data or to information that would compromise the security of the Service.

14. Liability and precedence

14.1 Our liability to you under or in connection with this DPA is subject to the exclusions and limits in section 16 of the Terms. Those exclusions and limits apply only to claims between you and us. Nothing in this DPA or the Terms limits either party’s obligations under Data Protection Law, the rights of data subjects, or the powers of the Information Commissioner or any other supervisory authority.

14.2 If this DPA conflicts with the rest of the Terms, this DPA prevails solely in relation to the processing of Customer Personal Data, as section 18 of the Terms provides. Any International Data Transfer Agreement, International Data Transfer Addendum or EU Standard Contractual Clauses that apply under section 8 and Schedule 3 prevail over this DPA and the Terms to the extent required by Data Protection Law.

15. Duration

This DPA applies for as long as we process Customer Personal Data on your behalf, and continues after the Terms end until all Customer Personal Data has been returned or deleted.

16. Changes to this DPA

We may change this DPA in accordance with section 17 of the Terms. Changes required by Data Protection Law, or that do not materially reduce the protection given to Customer Personal Data, may take effect on reasonable notice. We will give you advance notice of any materially adverse change, and you will have the same cancellation and refund rights as apply to material changes to the Terms. Changes to any International Data Transfer Agreement, International Data Transfer Addendum or EU Standard Contractual Clauses will be made only as those instruments permit.

Schedule 1: Details of processing

• Subject matter: provision of the Service, including the hosting, storage and sharing of cloud diagrams.
• Duration: for the term of your account and until Customer Personal Data is deleted under section 12.
• Nature of the processing: storing, syncing, rendering, backing up, transmitting, displaying, exporting and deleting cloud diagrams and their edit history, and giving access to the people you share with.
• Purpose: to provide and support the Service for you and the people you share with, in accordance with the Terms. Where we access diagram content to comply with a legal obligation or to act on a report of illegal content, we do so as an independent controller only to the extent we determine that legally required processing; otherwise we act as your processor.
• Categories of data subjects: any individuals whose personal data you or the people you share with include in cloud diagrams, which may include your personnel, contractors, customers, suppliers and other contacts, and the people you share diagrams with.
• Types of personal data: any personal data you include in cloud diagram titles, content, text, images and edit history, which may include names, job titles, contact details, organisational roles and relationships, and system, device or account identifiers; and the email addresses of people you share diagrams with, and the permissions you select for them, as supplied by the diagram owner, which we process on your behalf. We independently control the related authentication, security monitoring, abuse-prevention and operational records under section 2.2.
• Special category and criminal offence data: not intended or permitted to be processed. If such data is nevertheless processed, it is subject to this DPA in accordance with section 3.2.
• Diagrams stored only in your browser: diagrams you have not moved to the cloud stay in your browser’s storage and are never sent to us. We do not process them and this DPA does not apply to them.

Schedule 2: Technical and organisational security measures

• Encryption: each cloud diagram is encrypted under its own key, covering its title, content, edit history and images, and its backups are encrypted under the same key.
• Key access: a diagram’s key is unlocked only for someone who has access to the diagram, or for the parts of the Service that work on it when no one is using it, such as checking that its backups can be restored or replacing its key.
• Separation from operational tools: our everyday tools cannot read diagrams. Querying our databases, exporting data or reading logs shows that a diagram exists, who owns it, who it is shared with, and when it was created, changed, backed up or opened, but not its title or content.
• Restricted staff access: we read a diagram’s content only when you ask us to, to repair or restore it after a fault, to act on a report of illegal content or a security incident, or when the law requires it. Doing so requires a separately protected key, and every use of that key is recorded.
• Access control: diagrams are shared only by adding a specific person’s email address, and that person must sign in with the verified address. We do not offer public or “anyone with the link” access. Diagram owners can change or remove access at any time, with immediate effect.
• Agent connections: an AI agent connected by a user acts with that user’s permissions. That user can disconnect it at any time from their account settings, and it then loses access immediately, and any further request it makes is refused. We may disconnect an agent where we reasonably suspect compromise or misuse.
• Data minimisation in analytics: analytics never contain diagram content or anything that could be used to reconstruct it. Where text is entered, analytics record only a measurement of the text, such as the number of characters typed. Product analytics accept only the properties listed in our code, and error reports have quoted text, web addresses, email addresses and identifiers removed before they are sent. Product analytics run only with the user’s consent.
• Payment data: card details are handled by Paddle and never reach us.
• Logging and monitoring: security and operational logs record events, by identifier, such as a diagram being created or opened, or an agent acting on it, to operate, debug and secure the Service and investigate abuse.
• Backups and resilience: cloud diagrams are backed up regularly. Daily backups are kept for 30 days and weekly backups for 12 weeks, and the most recent backup is kept for as long as the diagram exists. Our hosting provider also keeps its own recovery history of stored data, including encryption keys, for 30 days. When a diagram is deleted, section 12.2 applies in place of these periods.
• Encryption in transit: all traffic to and from the Service is encrypted using TLS, terminated by our hosting provider.
• Backup testing: backups are encrypted, and we regularly check that they can be restored.
• Administrative access: multi-factor authentication is required for all administrative access to the Service and to our hosting and service provider accounts.
• Vulnerability management: we use automated tools to identify and manage vulnerabilities in the Service and its dependencies.
• Security reporting: we publish a security.txt file so that security researchers can report vulnerabilities to us.

Schedule 3: International transfers

Our hosting provider is a Subprocessor. It receives Customer Personal Data at the data centre nearest the person sending it, which may be outside the United Kingdom, and does not restrict where that data is stored to a particular region. Where our hosting provider or any other Subprocessor processes Customer Personal Data outside the United Kingdom, we rely on the transfer mechanism shown for that Subprocessor in the Register: UK adequacy regulations, the recipient’s certification under the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Addendum to the EU Standard Contractual Clauses incorporated in that Subprocessor’s data processing terms. We will provide a copy of the relevant safeguard on request.

EU transfers: if you are subject to the EU GDPR and require EU Standard Contractual Clauses with us, please contact us at privacy@nifdi.app.