Data processing addendum

1. Scope and roles

This addendum applies where nthparty processes personal data on your behalf in the course of providing the service. You are the controller and Corentis ApS, CVR 46654897, is the processor. It forms part of the terms of service and, where the two conflict on the processing of personal data, this addendum wins.

Where we process personal data for our own purposes — running our business, billing you, keeping the service secure, and compiling the public graph dataset — we are a controller in our own right and the privacy policy describes that instead.

2. Subject matter, duration, nature and purpose

The subject matter is the provision of subprocessor monitoring. The nature of the processing is storage, organisation, retrieval, structuring and transmission by automated means. The purpose is to operate the service you have subscribed to and nothing else. The duration is the life of your account, plus the backup window in section 12.

3. What is processed

Deliberately little. We do not ask for, and the product has no field for, special categories of personal data under Article 9, criminal offence data under Article 10, or data about children. Do not put any of it into a free-text field.

Categories of data subject

• the people at your organisation who hold accounts — owners and members
• people you invite to your account, from the moment you enter the address until the invitation is accepted — or, where it is declined, revoked or expires, until 30 days after that
• people at any destination you configure for alerts, where the destination is an individual address rather than a shared one

Categories of personal data

Your vendor inventory, your rules and the graph itself are about companies, not people, and are not personal data. They are still yours and are still confidential — see section 11 of the terms.

4. Your instructions

We process personal data only on your documented instructions, which include your configuration and use of the service and anything else you tell us in writing. If we believe an instruction breaches data protection law we will tell you, and we may pause that instruction until it is resolved. Where a law requires us to process without your instruction we will tell you first, unless that law forbids it.

5. Confidentiality and staff

Access to customer data is held by the founder alone, and everyone with access is bound by a written confidentiality obligation that survives their engagement. Staff access is granted per capability, not by job title, the staff console requires a second factor, and every administrative action against customer data is recorded in an append-only audit trail — including the ones that were refused.

6. Security

We implement the technical and organisational measures in Annex II, and we keep them under review. We may change a measure for one that is at least as protective; we will not weaken the overall level of security.

7. Subprocessors

You give general authorisation for the subprocessors listed on our subprocessor page, which is the current list and is maintained as a product surface. There are five, also listed in Annex III.

We give 30 days' notice before adding or replacing one. Notice is posted on that page and emailed to every account. If you object on reasonable data protection grounds within those 30 days, we will try to accommodate you; if we cannot, you may cancel for the remainder of your term, the same as any other cancellation. Each subprocessor is bound by written terms no less protective than these, and we remain fully responsible to you for its performance.

8. International transfers

Personal data is stored and processed in the European Union. Four of our five subprocessors are established in the EU — Hetzner Online GmbH in Germany, Stripe Payments Europe, Limited in Ireland, Mindbaz SAS (Sweego) in France and Better Stack s.r.o. in the Czech Republic. The fifth, Sentry (Functional Software, Inc.), is established in the United States and stores our error events in its EU region in Frankfurt, Germany.

Stripe Payments Europe is the contracting entity for European customers and makes onward transfers within the Stripe group, including to the United States, under that group's own standard contractual clauses. Where a transfer outside the EEA occurs — Stripe's onward transfers, or access to Sentry's data from the United States — it relies on the European Commission's standard contractual clauses of 4 June 2021, module three (processor to processor), which are incorporated into this addendum by reference, together with supplementary measures where a transfer impact assessment calls for them.

9. Assisting you

Taking into account the nature of the processing and the information available to us, we will assist you with

• Data subject requests. Some are answerable from the product itself — a person can correct their own name and settings and leave an account, and an owner can remove a membership. There is no self-serve export of a person's personal data; we provide a copy on request. Where you need that or anything else, we will help within 10 working days of a written request to privacy@nthparty.io.
• Security, breach notification and impact assessments. Articles 32 to 36, to the extent the information is ours to give.

If a data subject contacts us directly about your data, we will not answer them on your behalf. We will tell them to contact you, and tell you that they got in touch.

10. Personal data breach

We notify you without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting your data. The notice describes what we know at the time — what happened, which categories and roughly how many records, the likely consequences and what we are doing — and is followed up as we learn more. We do not wait for a complete picture before telling you.

11. Audit

We make available the information needed to demonstrate compliance with this addendum, and we answer reasonable written questions about our processing within 30 days. You may audit once in any twelve-month period, or after a breach affecting your data, on 30 days' notice and at your cost, subject to confidentiality and to not disrupting the service. We may satisfy an audit with an independent report where one covers the question asked.

12. Deletion and return

You can export your vendor inventory and its change history at any time while the account is open, and we provide a copy of the personal data in it on request. When an owner deletes the account, its data is deleted immediately, and the backups containing it roll off within 7 days. Take any copy you want before deleting. Cancelling a paid plan does not end the processing — the account continues on the Free plan until it is deleted. A person's own user record is deleted 30 days after their last membership ends. We keep only what law requires us to keep — principally billing records — and it stays subject to this addendum for as long as we hold it.

13. Liability

The limits in the terms of service apply to this addendum, except where data protection law does not allow them to.

Annex I: the processing

A. Parties

B. Description

C. Competent supervisory authority

Datatilsynet, the Danish Data Protection Agency, as the authority of the processor's place of establishment. Where you are established in another member state, your own lead authority is competent for you as controller.

Annex II: technical and organisational measures

Annex III: subprocessors

The authoritative and current list is our subprocessor page. At the date of this addendum it is