Data Processing Addendum

This Data Processing Addendum is published for transparency and describes the data protection terms Nikufra expects to apply when it processes personal data on behalf of a business customer. It is informative and does not by itself amend or replace a signed customer agreement. Where required, the applicable processing terms will be agreed in the customer contract.

For customer production, operational, support, or system data processed under a customer agreement, the customer is normally the controller and Nikufra is normally the processor. For Nikufra's own website, sales, accounting, security, and business administration data, Nikufra acts as controller.

Nikufra processes customer personal data only on documented customer instructions, including the customer agreement, statement of work, support requests, authorized access procedures, and written instructions from authorized customer personnel.

Some customer engagements may involve authorized remote access to systems or data. Others may be fully on-site or handled inside the customer environment without remote access. The applicable model depends on the customer agreement and the technical environment.

• Remote access should be approved by the customer before use.
• Access should be limited to the people and systems needed for the agreed work.
• Where practical, access should be logged or otherwise traceable.
• Customer credentials, VPNs, remote sessions, or support channels should follow the customer's security rules.

Nikufra personnel who access customer data are subject to confidentiality obligations. Access to customer data is limited to people who need it to provide, secure, or support the agreed services.

• Access control and least-privilege practices.
• Use of business accounts and controlled collaboration tools.
• Confidential handling of customer data and project materials.
• Technical and organizational measures appropriate to the engagement and environment.
• Support for on-premises or customer-controlled environments where agreed.
• Human review and traceability for operational decision-support workflows where applicable.

Nikufra currently uses a limited set of service providers for hosting, analytics, email, and scheduling. The current list is published on the Subprocessors page. Nikufra does not currently appoint external subcontractors to access customer production systems unless this is agreed with the customer.

Unless expressly agreed in writing, Nikufra does not use customer production data, operational data, or customer personal data to train general-purpose models or unrelated third-party products.

Taking into account the nature of the processing and information available to Nikufra, we will provide reasonable assistance to customers with data subject requests, security, breach assessment, data protection impact assessments, and consultations with supervisory authorities where required by applicable law and the customer agreement.

If Nikufra becomes aware of a personal data breach affecting customer personal data processed by Nikufra as processor, we will notify the customer without undue delay and provide available information reasonably needed for the customer to meet its legal obligations.

At the end of the relevant services, Nikufra will return or delete customer personal data in accordance with the customer agreement, unless continued retention is required by law, legitimate business records, security records, or dispute-resolution needs.

Where processing involves transfers outside the European Economic Area, Nikufra will rely on appropriate transfer mechanisms where required, such as adequacy decisions, Standard Contractual Clauses, or other lawful safeguards.