1Roles
The Customer is the controller of Customer Personal Data and NLS is the processor. Where the Customer itself acts as a processor for a third party, NLS acts as a subprocessor and the Customer warrants that its instructions to NLS are authorised by the relevant controller.
2Subject matter and details of processing
| Subject matter | Provision of the Services under the Terms |
| Duration | The term of the Terms and the export period after it |
| Nature and purpose | Hosting, storing, structuring, analysing and displaying data that the Customer collects through the Services; executing actions the Customer requests on Third-Party Platforms; generating AI Assistant responses |
| Categories of data subjects | The Customer's Members; End Users whose clicks and conversions are tracked through the Customer's domains and campaigns; users of advertising accounts the Customer connects |
| Categories of personal data | Members: name, email, avatar, activity records. End Users: IP address, approximate location, device, operating system, browser, language, referrer, click identifiers, campaign parameters, conversion events. Advertising accounts: account identifiers, session data, proxy details |
| Special categories | None intended. The Customer must not collect special categories of data through the Services |
3Instructions
NLS processes Customer Personal Data only on the Customer's documented instructions, which consist of the Terms, this DPA and the Customer's configuration and use of the Services. NLS will inform the Customer if, in its opinion, an instruction infringes applicable data protection law, and may suspend the processing concerned until the instruction is clarified.
4Confidentiality
NLS ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations and have access only to the extent needed to provide and support the Services.
5Security
NLS implements technical and organisational measures appropriate to the risk, including: encryption of data in transit; encryption of advertising account session data and proxy credentials at rest; isolation of each Customer's hosted landing pages; role-based access control enforced on the server; two-factor authentication; logging of changes to data and settings; regular backups; and restriction of NLS staff access to Customer Personal Data to support and maintenance purposes.
6Subprocessors
The Customer authorises NLS to engage the subprocessors listed below. NLS will notify the Customer by email or in the Services at least 14 days before adding or replacing a subprocessor. If the Customer objects on reasonable data protection grounds and NLS cannot offer a workable alternative, the Customer may terminate the Terms with respect to the affected Services with a pro rata refund of prepaid fees. NLS imposes on each subprocessor data protection obligations no less protective than those in this DPA and remains responsible for their performance.
| Subprocessor | Location | Purpose |
|---|---|---|
| Hetzner Online GmbH | Germany | Hosting and storage |
| Cloudflare, Inc. | USA / EU edge | Content delivery, DNS, protection against attacks |
| Google LLC | USA (EU data centres where available) | Service emails, sign-in |
| Anthropic, PBC | USA | AI Assistant responses |
| OpenAI, L.L.C. | USA | AI Assistant responses |
| Google LLC (Gemini) | USA | AI Assistant responses |
| TypeSafe AI, Inc. | USA | AI Assistant responses |
Payment processors (Stripe, Plisio) and the sales CRM (Bitrix24) process the Customer's own account and billing data, for which NLS is the controller, and are listed in the Privacy Policy.
7International transfers
Customer Personal Data is stored in Germany. Transfers to subprocessors outside the European Economic Area are made under the European Commission's standard contractual clauses or, where the subprocessor is certified, the EU-US Data Privacy Framework.
8Assistance
Taking into account the nature of the processing, NLS assists the Customer with reasonable measures to respond to data subject requests and to meet the Customer's obligations regarding security, breach notification and data protection impact assessments. NLS will forward to the Customer, without responding itself, any data subject request it receives that relates to Customer Personal Data. NLS may charge a reasonable fee for assistance that goes beyond the standard functions of the Services.
9Personal data breach
NLS will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to it to help the Customer meet its own notification obligations.
10Audit
On the Customer's written request, no more than once per year, NLS will provide the information reasonably necessary to demonstrate compliance with this DPA, including summaries of relevant third-party reports or certifications where available. If this is insufficient, the Customer may conduct an audit at its own cost, with at least 30 days' notice, during business hours, in a manner that does not disrupt NLS's operations and subject to confidentiality.
11Deletion and return
During the term, the Customer can export Customer Personal Data using the export functions of the Services. After the Terms end, NLS keeps Customer Personal Data available for export for 30 days and then deletes it, except for copies that NLS must retain by law or that remain in backups until overwritten in the ordinary course, in which case they stay protected by this DPA.
12Liability
The liability of each party under this DPA is subject to the exclusions and limitations set out in the Terms.
13Precedence
In case of conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails.
14Contact
Data protection enquiries: abuse@nlscrm.com