Data Processing Addendum

Customer is controller or business for Customer Personal Data. Nightvault FZE is Customer’s processor, service provider, or contractor through OperalonOS. Customer determines the purposes. Nightvault processes only to provide and secure the Services, according to documented configuration and instructions, as described in the Agreement and processing details, or as required by law.

If law requires processing outside instructions, Nightvault will inform Customer before processing unless notice is prohibited. Nightvault will notify Customer if an instruction reasonably appears to violate Applicable Data Protection Law and may suspend affected processing until the instruction is confirmed, modified, or withdrawn.

• Customer provides lawful and documented instructions and ensures required rights, notices, consents, and legal grounds.
• Customer configures available roles, permissions, feature-specific retention controls, and integrations appropriately and avoids unsupported sensitive or regulated data.
• Customer responds to Data Subject Requests for Customer-controlled data and assesses AI or automated use for consent, impact assessment, and human-review requirements.
• Customer is responsible for the accuracy, quality, lawfulness, and source of Customer Personal Data.

Nightvault requires personnel authorized to process Customer Personal Data to be bound by confidentiality, limits access according to assigned responsibilities, and requires access to be removed when it is no longer needed. These obligations are implemented through Nightvault’s then-current access-governance and personnel processes.

Nightvault maintains measures reasonably designed to protect Customer Personal Data against unauthorized or unlawful processing and accidental loss, destruction, damage, or alteration. Controls may evolve with technology and threats provided the overall protection is not materially reduced during the subscription term. No security measure eliminates all risk.

Customer generally authorizes Nightvault to appoint Subprocessors identified in the effective Register for configured production flows. Nightvault applies the confidentiality and data-protection terms available under the applicable provider agreement, remains responsible to the extent required by law and the Agreement, maintains the Register, and gives reasonable advance notice of a new material Subprocessor where practicable or as required by applicable law.

Customer may object promptly after receiving notice and before the planned activation date, where practicable, on reasonable documented data-protection grounds. The parties will attempt a good-faith resolution. If no commercially reasonable alternative exists, either party may terminate only the affected Service and Nightvault will refund unused prepaid Fees attributable to it. Urgent security, legal, or provider-failure replacements may occur sooner with prompt notice. Customer-directed integrations are not necessarily Nightvault Subprocessors.

Taking into account the nature of processing, Nightvault provides commercially reasonable assistance for Customer to respond to verified rights requests. If Nightvault receives a request concerning Customer Personal Data, it may direct the requester to Customer, notify Customer, and act only on documented instruction unless law requires otherwise. Customer verifies the requester and decides the response.

Nightvault escalates a credible suspected compromise under its incident procedures and will notify Customer without undue delay after determining that a Personal Data Breach affecting Customer Personal Data has occurred. Information may be supplied in phases as it becomes reasonably available. No fixed notification period applies unless required by law or an activated Order.

Available notice information includes the incident nature, affected systems and data, approximate affected people or records, known consequences, containment and remediation, and an incident contact. Nightvault preserves relevant evidence, investigates, contains, remediates, and assists with legally required notices. It does not notify Customer’s Data Subjects or publicly identify Customer unless authorized or legally required.

Nightvault reasonably assists with impact assessments, regulator consultations, processing records, and information needed to assess security and processing. Customer determines whether an assessment or consultation is required.

During the term, Customer may use available feature-specific exports and controls. Broader return, restriction, or deletion requests are handled through a verified manual process. After termination or verified instruction, Nightvault will assess and communicate the applicable return or deletion plan, accounting for the data inventory, technical dependencies, provider backup cycles, security and billing evidence, disputes, and legal requirements. Retained data remains protected and limited to its retention purpose.

Where legally permitted and reasonably practicable, Nightvault may notify Customer before compulsory disclosure, review a request for facial validity, seek limitation of an apparently overbroad request, and disclose only reasonably required data. Nothing requires Nightvault to violate law, obstruct lawful process, or disclose a confidential government request.

On written request, Nightvault provides reasonably necessary compliance information in this order: current security documentation and questionnaire; an available independent assessment or penetration-test summary if one exists and may be disclosed; a remote meeting; and a narrowly scoped audit where earlier material is insufficient or law requires it.

One routine audit may occur per 12 months, with additional audits following a substantiated breach or regulator requirement. Routine audits generally require 30 days’ notice, normal business hours, non-disruption, confidentiality, independent auditors, and no unapproved penetration testing or cross-customer access. Customer bears routine costs unless law or confirmed material noncompliance requires another allocation.

Customer acknowledges that configured providers may process data in the selected project region, the United States, the United Arab Emirates, and other locations identified in their then-current provider terms or subprocessor notices. Exact locations depend on the account and feature. Transfer requirements under UAE, EU, UK, or other law apply according to actual facts. This DPA does not itself incorporate EU Standard Contractual Clauses or the UK International Data Transfer Addendum; a restricted flow must remain limited until any required mechanism is executed or established.

• Nightvault processes Customer Personal Data only for the limited and specified purposes of hosting, authentication, Customer-instructed workflows and integrations, AI and reporting functions, support, security, billing, and lawful instructions.
• Nightvault does not sell or share Customer Personal Data, process it for targeted or cross-context behavioral advertising, or retain, use, disclose, or combine it outside the direct relationship and permitted purposes except as law permits or requires.
• Nightvault provides legally required privacy protection, notifies Customer if it can no longer comply, cooperates in corrective action, and uses applicable provider agreements and data-protection terms intended to impose protections appropriate to each Subprocessor’s role.
• Customer may take reasonable and appropriate steps to verify and stop unauthorized use. Nightvault FZE certifies that it understands and will comply with these restrictions.

Subject matter

Provision, security, support, billing administration, and operation of the Customer’s OperalonOS Workspace, authorized integrations, workflows, AI, reporting, and communications.

Duration

The subscription term and the category- and feature-specific retention actually configured or required, subject to verified instructions, disputes, security evidence, provider backup cycles, and law.

Nature

Collection, storage, retrieval, matching, classification, OCR, AI inference, summarization, drafting, routing, analysis, reporting, transmission, export, restriction, deletion, and security monitoring.

Data Subjects

Customer personnel and users; Customer’s customers and prospects; communication participants; people in tickets, orders, messages, and connected systems; suppliers, partners, business contacts, and support requesters.

Categories

Business contact, account, role, service communications, email, order, commerce, shipping, return, refund, CRM, collaboration, attachments, policy, prompts, Output, review evidence, usage, and operational metadata.

Nightvault may use effectively de-identified data while taking reasonable measures to prevent re-identification, maintaining it in de-identified form, not attempting re-identification except to test effectiveness, and requiring recipients to preserve those protections. Nightvault maintains records reasonably necessary to demonstrate material processing activities.

Liability under this DPA is subject to the Agreement’s exclusions, caps, and procedures unless Applicable Data Protection Law prohibits their application. This DPA remains in effect while Nightvault processes Customer Personal Data on Customer’s behalf.