Data processing agreement

Parties and scope

This agreement is between the customer that uses NodeHub (the controller) and Side By Tech LLC d/b/a NodeHub (the processor). It forms part of the terms of service and applies automatically to personal data NodeHub processes in the customer's workspace. No separate signature is needed; a countersigned copy is available on request to [email protected].

Processing schedule

Subject matter and nature: hosting, storing, organizing and transmitting workspace data to provide customer support, workflow automation and AI-assisted features, as configured by the customer.

Duration: the term of the subscription and any later use of the Free plan, until the customer asks us to delete its content, plus backup expiry as described in the privacy notice.

People involved: the customer's staff and users, and its customers, contacts and other people whose data it places in the workspace.

Data categories: contact details, conversation content, attachments, table records, workflow inputs and outputs, and any other data the customer chooses to process. The customer should not place special-category data in NodeHub unless it has a lawful basis and has assessed the risk.

Processor commitments

NodeHub processes the data only on the customer's documented instructions (the terms, the product settings and workflows the customer configures), unless the law requires otherwise, in which case we will tell the customer first where allowed.

Everyone with access is bound to confidentiality. We apply the security measures in the privacy notice, including encryption in transit and at rest, database tenant isolation, sealed credentials, restricted and logged production access, and tested backups.

The customer authorizes the subprocessors listed on the subprocessors page, under the change process described there. Each is bound by data protection terms at least as protective as these.

We help the customer answer requests from individuals and meet its security, breach and impact-assessment obligations, taking into account the information available to us.

We notify the customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting its data, with the information needed for its own notifications.

When a subscription ends, the customer's content stays available on the Free plan. On the customer's request we delete it, with backups expiring on their schedule, unless the law requires us to keep it.

We make available the information needed to show compliance with this agreement and allow audits on reasonable notice, at most once a year unless a breach or regulator requires more.

International transfers

Data is stored in the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, the parties agree to the Standard Contractual Clauses (controller-to-processor module, with the UK addendum where it applies), which are incorporated by reference, with New York as the place of this agreement for any matter the clauses leave open.