Older versions:

This Data Processing Agreement ("DPA") is an integral part of the Terms of Service of Nord Services ("Terms") concluded between the Customer and Nord (hereinafter collectively referred to as the "Parties"). The main purpose of this DPA is to define how Nord processes data on behalf and under the Customer’s instructions while providing the Services.

1. DEFINITIONS
   1. Unless expressly stated in this DPA, the capitalized terms shall have the meanings indicated below:

      Personal Data	means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
      Customer’s Personal Data	means all Customer’s personal data in whatever form or medium which is (i) supplied to, or in respect of which access to the Nord is granted by the Customer or otherwise in connection with the Terms, or (ii) produced or generated by or on behalf of the Customer in connection with the Terms.
      EEA	means the European Economic Area.
      Data Protection Laws	means all applicable worldwide legislation relating to data protection and privacy which applies to the respective Party in the role of processing Personal Data in question under this DPA, including, without limitation, European data protection laws: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (hereinafter, the "GDPR"); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); (iii) the GDPR as it forms parts of the United Kingdom domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 (hereinafter, the "UK GDPR"); regulations of the United States of America, including the California Consumer Privacy Act of 2018, Cal. Civ. Code §1798.100 et. seq., and its implementing regulations (hereinafter, the "CCPA"), applicable to the processing of the Personal Data (or an analogous variation of such term); other applicable data protection and privacy laws.
      SCCs	means standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (Commission implementing decision 2021/914 of 4 June 2021) as updated or replaced from time to time. The current version of the SCCs (i.e., applicable at the time of the conclusion of this DPA) is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
      UK SCCs	means an International Data Transfer Addendum to the SCCs approved by the UK as updated or replaced from time to time. The current version of the Addendum to the SCCs (i.e., applicable at the time of the conclusion of this DPA) is available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/.
   2. The following lower-case terms used but not defined in this DPA, such as "controller", "processor", "sub-processor", "processing", "special categories of personal data", "personal data breach" and "supervisory authority" shall have the same meaning as set forth in the GDPR, irrespective of whether the GDPR applies.
   3. Terms and expressions used in this DPA and not defined herein have the meaning assigned to them in the Terms.
2. APPLICATION OF THIS DPA
   1. This DPA applies when Nord processes the Customer’s Personal Data in order to provide Services under the Terms. Nord, as defined in this DPA, acts as the data processor, whereas the Customer acts as the data controller.
   2. The nature, purpose, subject matter, and other details of processing activities performed as part of the Services are set out in Annex I of this DPA.
3. GENERAL OBLIGATIONS
   1. Nord warrants and undertakes to process the Customer’s Personal Data only for the limited and specified purposes set out in the Terms and/or as otherwise lawfully instructed by the Customer in writing (as specified in the Terms) and mutually agreed by the Parties, except where otherwise required by the Data Protection Laws. Nord will not process the Customer’s Personal Data for any other purpose or in a way that does not comply with this DPA or the Data Protection Laws.
   2. The Customer’s initial instructions to Nord are set forth in this DPA and its Annex I. All the instructions provided are comprehensive and reflect the Customer’s will.
   3. Nord shall not evaluate any instructions of the Customer, which shall be held responsible and liable for any given instructions, to be fully lawful and compliant with the applicable Data Protection Laws. If in Nord`s reasonable opinion, an instruction undoubtedly infringes the applicable Data Protection Laws, Nord shall notify the Customer. Nord is not responsible for compliance with any Data Protection Laws applicable to the Customer or its industry that are not generally applicable to Nord.
   4. Nord shall not take any action that would cause the Customer to violate the Data Protection Laws.
   5. In particular but without prejudice to the generality of the foregoing, the Customer acknowledges and agrees that it will be solely responsible for: (i) the accuracy, quality, and legality of the Customer’s Personal Data and the means by which it acquired Personal Data; (ii) complying with all necessary transparency and lawfulness requirements under applicable Data Protection Laws for the collection and use of the Personal Data, including any necessary notifications, consents, and authorizations that are needed for the Customer’s use of Nord’s Services; (iii) ensuring it has the right to transfer, or provide access to, the Personal Data to Nord for processing in accordance with the provisions of the Terms (including this DPA); and (iv) ensuring that its instructions to Nord regarding the processing of Personal Data comply with applicable laws, including Data Protection Laws. The Customer shall also inform Nord without undue delay if the Customer is not able to comply with its responsibilities under this Section.
4. Data Disclosure
   1. Nord undertakes not to disclose the Customer’s Personal Data to any third party other than through the use of other data processors as specified in this DPA, except if the Personal Data is disclosed under third parties’ request of information in accordance with applicable legal acts or under legitimate requests from law enforcement or other competent authorities.
   2. To the fullest extent permissible under the Data Protection Laws, the Customer authorizes Nord to use sub-processors to fulfill its obligations as set forth in this DPA (provides general authorization) provided that Nord maintains a list of sub-processors and, upon receiving a written request from the Customer, provides the Customer with such list.
   3. Nord shall: (i) ensure that any sub-processor is contractually bound in writing to provide at least the same level of protection as is required by this DPA and complies with the Data Protection Laws; (ii) be fully responsible and liable to the Customer for acts and omissions of any sub-processor as if they were Nord's own act or omission.
   4. If required to do so by applicable Data Protection Laws, in case of a new sub-processor: (i) Nord will inform the Customer thereof; and (ii) Nord shall enable the Customer to object, by way of providing Nord with a reasoned, specific and written objection, to changes concerning the addition or replacement of sub-processors to the afore-mentioned list.
5. Data Transfers
   1. The Customer shall transfer the Customer’s Personal Data in accordance with the requirements of Data Protection Laws applicable to the Customer.
   2. The Customer acknowledges and agrees that Nord may access and process the Customer’s Personal Data on a global basis as necessary to provide the Services in accordance with the Terms.
   3. The Customer’s Personal Data from EEA, or UK may only be exported to or accessed by Nord or its sub-processors outside the EEA or the UK ("European Transfer"), as applicable:
      1. if the recipient or the country/territory in which it processes or accesses the Customer’s Personal Data ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of Personal Data as determined by the European Commission or another regulatory body of competent jurisdiction ("Adequacy Decision"); or
      2. in the absence of an Adequacy Decision, the European Transfer only can take place in accordance with Annex II of this DPA.
6. Data Security
   1. Nord shall make sure to take appropriate technical and organizational measures (hereinafter, the "TOMs") to protect the processed Customer’s Personal Data. The TOMs must ensure an adequate level of security, taking into account:
      1. context, objectives, and particular risks associated with the processing of Personal Data;
      2. the risks to the rights and freedoms of data subjects arising from the processing of Personal Data;
      3. existing Nord’s technical capabilities; and
      4. costs of the measures or their implementation.
   2. Nord must ensure that the TOMs used to protect the Customer’s Personal Data include the following measures/requirements where appropriate:
      1. the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of systems and services of the Customer’s Personal Data processing;
      2. the ability to restore the availability and access to the Customer’s Personal Data in a timely manner in the event of a physical or technical incident;
      3. regular assessment of the efficiency of TOMs to ensure the security of the processing of Personal Data.
   3. Nord shall also ensure that sub-processors authorized to process the Customer’s Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
   4. The list of the current Nord’s TOMs used to protect the Customer’s Personal Data is set out in full in Annex I of this DPA. Notwithstanding any provision to the contrary, Nord may modify or update the TOMs at its discretion provided that such modification or update does not result in a material degradation in the protection offered by the current TOMs.
   5. Nord, having become aware of any personal data breach affecting the Customer’s Personal Data shall: (i) report the breach to the Customer without undue delay, after becoming surely aware of the personal data breach; (ii) make reasonable efforts to assist the Customer in fulfilling its obligation under applicable Data Protection Laws to notify a relevant supervisory authority and/or data subjects about such personal data breach. For the avoidance of doubt, Nord will not notify and/or disclose any information relating to the personal data breach to any third party, including but not limited to data subjects and supervisory authority, unless required to do so by Data Protection Laws.
7. COOPERATION AND DATA SUBJECTS RIGHTS
   1. The Customer shall process and respond to every enquiry, request, notice, question, complaint or other communication related to the processing of the Customer’s Personal Data under this DPA ("Request") received from: (i) any natural person whose Personal Data is processed by Nord on behalf of the Customer or (ii) any supervisory authority.
   2. When the Customer is not able to solely process and respond to the Request, the Customer may ask Nord for reasonably required assistance (subject to the nature of the processing and the information available to Nord) to enable the Customer to:
      1. comply with (and demonstrate compliance with) its obligations under the Data Protection Laws (including, but not limited to data protection impact assessments, reporting to and consulting with supervisory authorities); and
      2. respond to, comply with, or otherwise resolve the Request. In the event that any such Request under this Section is made directly to Nord, Nord shall promptly inform the Customer by providing full details of such Request. For the avoidance of doubt, Nord will not respond to any Requests, unless Nord is legally compelled to do so.
8. RIGHT TO CARRY OUT AN AUDIT
   1. When reasonably necessary, the Customer shall have the right to take the measures necessary to verify Nord’s compliance with this DPA.
   2. The Customer shall also have a right to request an audit performed by the independent, accredited, and reputable third-party audit firm agreed by both Parties. For the avoidance of doubt, neither the Customer nor the appointed auditor shall be a competitor of Nord’s business and, under no circumstances may the Customer, or the selected auditor, have access to Nord’s confidential information, information of Nord’s other clients, nor to any information of third parties to whom Nord owes a duty of confidentiality. Before conducting the audit, the Customer and auditor must execute a written confidentiality agreement acceptable to Nord or otherwise be bound by a statutory confidentiality obligation.
   3. This audit will only take place where there is a specific and well-founded suspicion of misuse of the Customer’s Personal Data, and only after the Customer has requested and assessed similar existing reports from Nord and has made reasonable arguments to justify an audit being initiated by the Customer. For the avoidance of doubt, such an audit can be justified only if similar reports (that Nord has available) provide insufficient or inconclusive answers regarding compliance with this DPA by Nord.
   4. An audit shall take place during regular business hours in a manner that is not disruptive to Nord’s business, upon reasonable no less than two (2) month advance notice to Nord (unless mandatory applicable Data Protection Laws or the supervisory authority requires a shorter notice) and subject to a maximum capacity of confidentiality undertaking as provided below. Before the commencement of any such audit, the Parties shall mutually agree upon the timing, duration, and scope of an audit, which shall not involve physical access to the servers from which the Customer’s Personal Data processing is provided.
   5. The Customer shall notify Nord regarding any non-compliance discovered during the course of an audit. The Customer may not audit Nord more than once during any consecutive twelve (12) month period. The Customer is responsible for all costs and fees related to such audit, including all costs and fees for any and all time Nord expends for any such audit.
   6. All information discovered in the course of an audit shall be treated as "Confidential Information" and shall be subject to the "Confidentiality" Section of the Terms.
9. TERM
   1. This DPA shall apply as long as the Services are provided to the Customer as set out in the Terms unless the Parties terminate the Terms and/or this DPA earlier on the grounds provided therein.
   2. Following termination of the DPA, Nord shall delete or return the Customer’s Personal Data to the Customer at its choice. The Customer’s Personal Data shall be deleted as determined in the Terms.
10. LIABILITY
    1. Nord’s liability, taken together in the aggregate, arising out of or related to this DPA, whether contractual, tort or under any other theory of liability, shall be subject to the limitations and exclusions set out in the Terms. Liability of Nord shall mean the aggregate liability of Nord under the Terms and this DPA together.
11. OTHER PROVISIONS
    1. All notices between the Parties shall be given following the provisions of the Terms.
    2. Nord shall have the right to any reimbursement of reasonable expenses, costs, and fees which were incurred as a result of Customer’s (i) inaccurate, incomplete, or unlawful instructions; and/or (ii) requests for cooperation which are unfounded, excessive, and/or impose unreasonably disproportionate costs to Nord.
    3. This DPA shall be governed and any disputes or claims arising from this DPA shall be settled according to the provisions of the Terms.
    4. Notwithstanding anything to the contrary in the Terms, in the event of any conflict or inconsistency between the Terms of this DPA and the Terms, the provisions of this DPA shall prevail.

ANNEX I

Description and Instructions for Processing

ANNEX II

The SCCs and European Transfers Agreement

ANNEX III

CCPA Data Protection Addendum