Data Processing Agreement

1. Parties, scope, and priority

This Data Processing Agreement (“DPA”) supplements the service agreement or order form that expressly incorporates it (the “Agreement”). The parties are Nurvia Inc. (“Nurvia”) and the customer identified in the Agreement (“Customer”).

2. Definitions

“Applicable Data Protection Law” means privacy and data-protection law applicable to the relevant processing, including, where applicable, the EU GDPR, UK GDPR and Data Protection Act 2018 as amended, Swiss Federal Act on Data Protection, and applicable United States state privacy laws, including the California…

3. Customer instructions and responsibilities

Nurvia will process Customer Personal Data only on Documented Instructions, including with respect to international transfers, unless legally required otherwise.

4. Purpose limitation and AI data use

Nurvia will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it for targeted advertising, or use it to build profiles for unrelated customers or third parties.

5. Confidentiality and personnel access

Nurvia will ensure that personnel authorized to process Customer Personal Data are subject to enforceable confidentiality duties or an appropriate statutory duty. Access must be limited to personnel who need it for an authorized purpose and the minimum necessary data and time.

6. Technical and organizational measures

Nurvia will implement and maintain the measures in Annex 2 and additional measures necessary to meet applicable security obligations, taking account of the state of the art, costs, nature and scope of processing, and risks to individuals.

7. Subprocessors

Customer gives general written authorization for Nurvia to engage Subprocessors under this section. app. The list will identify the relevant legal entities, services, processing locations, and data-processing activities. It is provided directly to customers rather than published as a public directory.

8. Assistance with individual rights

Taking account of the nature of processing, Nurvia will provide appropriate technical and organizational assistance for Customer to respond to requests concerning access, correction, erasure, restriction, portability, objection, and other applicable rights.

9. Security incidents and breach notice

Nurvia will notify Customer without undue delay after becoming aware of a Personal Data Breach and no later than 48 hours after that awareness. This maximum period does not postpone a notification that can reasonably be provided earlier. A shorter mandatory period or stronger agreed term controls.

10. Impact assessments and regulatory cooperation

Nurvia will provide reasonably necessary information and assistance for Customer’s data-protection impact assessments, transfer assessments or data-protection tests, prior consultations, risk assessments, and regulatory inquiries relating to the covered processing.

11. Return, deletion, and end of processing

On Customer’s choice following termination or a valid deletion instruction, Nurvia will return available Customer Personal Data in a commonly usable format and/or delete it under the Data Retention and Deletion Policy, except to the extent applicable law requires retention.

12. Audits and evidence

Nurvia will make available information reasonably needed to demonstrate compliance with this DPA and allow and contribute to audits and inspections by Customer or an appropriately qualified independent auditor.

13. Restricted international transfers

Nurvia will not make a restricted transfer without a valid applicable mechanism and the required assessments and safeguards. Information about processing locations, remote access, onward transfers, and Subprocessors will be provided to Customer under Annex 3 and Section 7.

14. United States state-law terms

Where Nurvia processes information as Customer’s service provider or contractor under the CCPA, Customer discloses it only for the limited, specific business purposes in Annex 1.

15. Changes, survival, and signatures

The parties may amend this DPA in writing, including a valid electronic acceptance. Mandatory legal updates may be incorporated by agreement without weakening agreed safeguards. General website edits do not retroactively authorize new processing or reduce existing rights.

Annex 1. Description of processing

Subject matter. Processing personal data to provide the Nurvia Services selected in the Agreement and maintain Customer’s authorized workspaces and tasks.

Annex 2. Technical and organizational measures

The Security and AI Data Handling Addendum incorporated into the Agreement forms this annex. Additional or alternative measures must be agreed in writing and provide the protection required by applicable law and this DPA. Nurvia will provide supporting security information through the assurance process in Section 12.

Annex 3. Processing and transfer documentation

Current Subprocessor details, processing locations, applicable transfer instruments, and related information are provided directly to Customer during onboarding and on request. The applicable materials identify their version or provision date. Subprocessor changes remain subject to Section 7.

Related

• Legal Nurvia’s agreements and policies: terms, privacy, data processing, security, retention, cookies, messaging, acceptable use, and vulnerability disclosure.
• Terms of Service The terms governing Nurvia, Nuri, Autoflow, accounts, subscriptions, and authorized actions.
• Privacy Policy How Nurvia collects, uses, protects, and shares personal information, and the choices available to you.
• Cookie Notice How cookies and similar technologies are used, and how to manage your choices.
• Acceptable Use Policy Requirements for lawful, authorized, and responsible use of the Services.
• Trust & Security Privacy, security, and AI data handling at Nurvia: no model training on your content, permission-based actions, and clear retention.