Data Processing Agreement

This Data Processing Agreement ("DPA") is between the Customer and Nimtelligence AB, org. no. 559401-7476 ("Nimt"), as those parties are described in the terms of service. It forms part of the terms and applies automatically whenever Nimt processes personal data on the Customer's behalf. If you need a signed copy, email privacy@nimt.ai.

1. Roles and scope

1.1 The Customer is the controller, and Nimt is the processor, of the personal data that Nimt processes on the Customer's behalf to provide the Service ("Customer Personal Data"). Annex I describes that processing. If the Customer is itself a processor, Nimt is its sub-processor and this DPA applies in the same way.

1.2 Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the GDPR (Regulation (EU) 2016/679).

1.3 Personal data that Nimt uses for its own purposes, such as billing, security and its own marketing, is not covered by this DPA. Nimt's privacy policy describes it.

2. Instructions

2.1 Nimt processes Customer Personal Data only on the Customer's documented instructions, unless EU or Member State law that applies to Nimt requires otherwise. In that case Nimt will tell the Customer first, unless that law forbids it on important grounds of public interest.

2.2 The terms, this DPA, the Customer's settings and its use of the Service are the Customer's instructions. Further instructions must be in writing and consistent with the terms.

2.3 Nimt will tell the Customer if it believes an instruction breaks data protection law.

2.4 Unless the Customer has opted out as described in the terms, the Customer authorises Nimt to use its work with Nimt's AI features (instructions, results and feedback), after removing direct identifiers, to train and evaluate models that only power Nimt. For that use Nimt acts as an independent controller, as described in its privacy policy. Nimt never uses files or data from connected apps for training.

2.5 The Customer is responsible for having a legal basis for the processing and for the lawfulness of its instructions and of the personal data it provides.

3. Confidentiality

Nimt ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality.

4. Security

4.1 Nimt takes appropriate technical and organisational measures to protect Customer Personal Data, as required by article 32 of the GDPR. Annex II describes them.

4.2 Nimt may update these measures, as long as the overall level of protection does not decrease.

5. Sub-processors

5.1 The Customer gives Nimt general authorisation to use sub-processors. The current sub-processors are listed on our list of sub-processors.

5.2 Nimt will update that list at least 14 days before a new or replacement sub-processor starts processing Customer Personal Data. Customers can get these updates by email by asking at privacy@nimt.ai.

5.3 The Customer may object on reasonable data protection grounds within that period, by emailing privacy@nimt.ai. The parties will then try to find a solution in good faith. If they can't, the Customer may end the affected part of the Service and get a refund of prepaid fees for the period after it ends.

5.4 If a sub-processor must be replaced urgently, for example for security or to keep the Service running, Nimt may do so at once and will tell the Customer as soon as possible. Section 5.3 still applies.

5.5 Nimt imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible to the Customer for its sub-processors.

6. Transfers outside the EU/EEA

6.1 Nimt and its sub-processors may process Customer Personal Data outside the EU/EEA when the transfer is protected by an EU adequacy decision (including the EU-US Data Privacy Framework), by standard contractual clauses or by another transfer mechanism allowed under the GDPR.

6.2 Nimt ensures that an appropriate transfer mechanism, such as the standard contractual clauses (Commission Implementing Decision (EU) 2021/914), is in place with a sub-processor outside the EU/EEA before it receives Customer Personal Data.

7. Assistance

7.1 Taking into account the nature of the processing, Nimt helps the Customer respond to requests from people exercising their rights under the GDPR. If Nimt receives such a request directly, it will pass it on to the Customer and not respond itself unless the Customer asks it to.

7.2 Nimt gives the Customer reasonable help with security, personal data breach notifications, data protection impact assessments and prior consultations with authorities, taking into account the nature of the processing and the information available to Nimt. Nimt may charge for help that requires significant effort.

8. Personal data breaches

8.1 Nimt will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notification will describe, as far as Nimt knows at the time, the nature of the breach, the data and people affected, its likely consequences and the measures taken or proposed. Nimt will add information as it becomes available.

8.3 Notifying the Customer is not an admission of fault or liability.

9. Deletion and return

9.1 The Service ends for the purpose of this section when the Customer asks Nimt to delete its workspace, or when Nimt tells the Customer by email that it will delete an inactive workspace. If a trial or subscription ends without that, Nimt keeps the data so that the Customer can reactivate the workspace.

9.2 When the Service ends, Nimt returns or deletes Customer Personal Data, at the Customer's choice. The Customer can ask for its data to be returned in a commonly used format before it is deleted.

9.3 Nimt deletes Customer Personal Data within 30 days after the Service ends, and from backups within a further 35 days, unless EU or Member State law requires Nimt to keep it. Security and technical logs, which can contain user identifiers, are deleted when their normal retention ends. Nimt will confirm the deletion in writing if the Customer asks.

10. Audits

10.1 Nimt makes available the information needed to show compliance with this DPA and article 28 of the GDPR, for example by answering reasonable security questionnaires and providing documentation of its security measures.

10.2 If that information is not enough, or if a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality. Audits take place at most once every 12 months, unless a supervisory authority requires otherwise, after a personal data breach, or when the Customer has reasonable grounds to suspect a material breach of this DPA. The Customer must normally give at least 30 days' notice; shorter notice applies where a supervisory authority requires it or after a personal data breach. Audits are remote and document-based where possible, take place during business hours without disrupting the Service, and are paid for by the Customer.

11. Liability and term

11.1 The limitations of liability in the terms apply to this DPA.

11.2 This DPA applies for as long as Nimt processes Customer Personal Data.

11.3 For the processing of personal data, this DPA takes precedence over the terms. An Order Form may add to this DPA but not reduce its protections.

Annex I: Description of the processing

Controller	The Customer, as described in the terms of service
Processor	Nimtelligence AB, Redaregatan 48, c/o Hetch, 252 36 Helsingborg, Sweden. Contact: privacy@nimt.ai
People whose data is processed	The Customer's Users, people in content and connected apps the Customer adds to the Service, and people mentioned in tracked AI answers
Types of personal data	Names, email addresses, roles and usage data of Users; names of people, or links to their pages, that appear in tracked AI answers; and any personal data the Customer chooses to include in its content or connected apps
Sensitive data	None intended. The Customer should not add special categories of personal data.
Nature and purpose	Hosting, storing, analysing and transmitting data to provide the Service, including AI processing and connected apps, and to support and secure it. Training under section 2.4 is Nimt's own processing as an independent controller.
Frequency	Continuous, while the Customer uses the Service
Duration and retention	While the workspace exists, then deleted as described in section 9
Supervisory authority	The authority competent for the Customer under the GDPR

Annex II: Security measures

• Hosting: production databases and file storage are in the EU on Amazon Web Services, in separate accounts with organisation-wide guardrails. Sub-processors may process data elsewhere, as listed in Annex III.
• Encryption: data is encrypted in transit with TLS and at rest.
• Access control: access to production systems is limited to the people who need it, uses individual accounts and least privilege, and is logged, including every connection to the production database.
• Customer access: Users sign in with an email code or through Google or Microsoft. Workspace roles and project permissions are enforced by the server, and API and MCP access can be limited to read-only.
• Network and application protection: traffic passes through a web application firewall, and requests from untrusted origins are blocked.
• Monitoring: audit logs, threat detection and configuration checks run across our cloud accounts, and alerts go to the team.
• Logging and minimisation: cookies and request bodies are not kept in request logs, and error reports are filtered to remove sensitive data such as email addresses, IP addresses and request bodies.
• Vulnerability management: dependencies and container images are scanned, and reported issues are handled through our vulnerability disclosure policy.
• Backups: databases are backed up daily and backups are kept for a limited time.
• AI providers: apart from the public AI services queried to track the Customer's brand, AI providers are used only under terms that don't allow training on the data.
• Staff: everyone with access to personal data is bound by confidentiality.

Annex III: Sub-processors

The current sub-processors are listed below and on our list of sub-processors.