NIZU OÜ — Data Processing Agreement

NIZU WorkSpace · In Accordance with Article 28 of the GDPR

Parties

between

Name and address of the contract partner

— Controller within the meaning of the GDPR, hereinafter referred to as the "Client" —

and

NIZU OÜ Harju maakond, Tallinn, Lasnamäe linnaosa, Lõõtsa tn 5, 11415, Estonia VAT: EE102264113 legal@nizu.io

— Processor within the meaning of the GDPR, hereinafter referred to as the "Supplier" —

Introduction

This Data Processing Agreement (DPA) defines the data protection obligations of the contractual parties, and the data processing that takes place as a result of the Client's main contract with NIZU OÜ. The DPA applies to all activities relevant to the main contract in which employees of the Supplier or third parties commissioned by the Supplier process personal data on behalf of the Client.

⚠️ INFRASTRUCTURE DEPENDENCY

NIZU OÜ delivers the NIZU WorkSpace Service using infrastructure provided by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. This DPA is structured in parallel with, and is dependent upon, the Data Processing Agreement between NIZU OÜ and Hetzner Online GmbH (available at: https://www.hetzner.com/AV/DPA_en.pdf).

Where this DPA refers to Technical and Organisational Measures (TOMs) or sub-processor arrangements, these are bound by and do not exceed the measures and guarantees provided by Hetzner Online GmbH under their own DPA and TOMs (available at: https://www.hetzner.com/AV/TOM_en.pdf).

Table of Contents

1. Subject Matter and Duration
2. Object, Nature, and Purpose of Processing
3. Third Country Data Transfer
4. Technical and Organisational Measures
5. Quality Assurance and Other Duties of the Supplier
6. The Client's Responsibilities
7. Sub-contractual Relationships
8. The Client's Inspection Rights
9. Further Responsibilities to Provide Support
10. The Client's Authority to Issue Instructions
11. Deletion and Return of Personal Data
12. Reimbursement
13. Other Agreements
14. External Storage Services — Void of DPA
15. Contact Information

• Appendix 1 — Scope, Type, and Purpose of Data Processing
• Appendix 2 — Technical and Organisational Measures (TOMs)
• Appendix 3 — Approved Sub-Processors

§ 1 Subject Matter and Duration

(1) This Data Processing Agreement (DPA) defines the data protection obligations of the contractual parties, and the data processing that takes place as a result of the Client's main contract with NIZU OÜ. The main contract consists of the NIZU WorkSpace product description and the applicable Terms of Service (NIZU-TOS-001).

(2) The Supplier will process personal data on behalf of the Client in accordance with Art. 4 No. 2 GDPR under this Agreement.

(3) Within the scope of this DPA, the Client is solely responsible for compliance with data protection regulations. In particular, the Client will ensure that both the transfer of data to the Supplier and its data processing are lawful. The Client is considered the "Controller" within the scope of Art. 4 No. 7 GDPR.

(4) This DPA is dependent on the existence of a main contractual relationship in accordance with § 1 (1) of this Agreement (for the duration of data processing). The cancellation or other termination of the main contractual relationship will simultaneously terminate this DPA. The right to extraordinary termination of this DPA and the right to exercise statutory rights of withdrawal remain unaffected.

⚠️ NIZU'S END-USERS — NO RELATIONSHIP WITH CLIENT'S END-USERS

NIZU OÜ has no legal relationship, obligation, or liability of any kind towards the Client's own customers, users, employees, or third parties who access the Client's Workspace.

The Client is solely and exclusively responsible for all GDPR obligations owed to its own end-users, including: establishing a lawful basis, providing required notices, obtaining consent, fulfilling data subject rights requests, and breach notification to data subjects and supervisory authorities in respect of the Client's own operations.

NIZU shall not respond to data subject requests from the Client's end-users directly. All such requests must be handled by the Client as Data Controller.

§ 2 Object, Nature, and Purpose of Processing

The object, nature, and purpose of any possible collection, processing, or use of personal data, the nature of the data, and the Data Subjects are described in Appendix 1 of this DPA, as completed by the Client, insofar as this is not governed by the main contractual relationship described in § 1 of this DPA.

§ 3 Third Country Data Transfer

(1) The provision of the contractually agreed upon data processing will occur exclusively in a member state of the European Union or in another member state party to the Agreement on the European Economic Area, to the extent technically possible given the infrastructure provided by Hetzner Online GmbH.

(2) Any transfer to a third country will require the prior consent of the Client and may only occur if the special conditions defined in Articles 44 et seq. of the GDPR are fulfilled.

(3) The Supplier will inform the Client in advance which third country or countries are involved and how the appropriate level of protection is ensured. The Supplier agrees to provide the Client with evidence of the implemented guarantees upon request.

(4) The appropriate level of protection for data processing in any third country is ensured by one of the following measures:

• Adequacy decision of the European Commission (Art. 45 No. 3 GDPR);
• Binding internal data protection rules, including additional safeguards where appropriate (Art. 46 No. 2 lit. b GDPR in conjunction with Art. 47 GDPR);
• Appropriately modified standard data protection clauses (SCCs), including additional safeguards where applicable (Art. 46 (2) (c) and (d) GDPR);
• Approved codes of conduct (Art. 46 No. 2 lit. e in conjunction with Art. 40 GDPR);
• Approved certification mechanism (Art. 46 No. 2 lit. f in conjunction with Art. 42 GDPR);
• Another manner provided for in Art. 44 et seq. GDPR, of which the Supplier will inform the Client in advance.

⚠️ NOTE ON THIRD COUNTRY TRANSFERS

NIZU OÜ's infrastructure sub-processor, Hetzner Online GmbH, operates sub-processors in the USA and Singapore (see Appendix 3). If the Client selects a server location within the EU, data will be processed exclusively within the EU. Technical and customer support services for all server locations are provided within the EU. Clients requiring EU-only data residency must select an EU server location when configuring their Workspace.

§ 4 Technical and Organisational Measures

(1) The Supplier will implement Technical and Organisational Measures (TOMs) that ensure adequate protection of the Client's data and comply with the requirements of the GDPR (Art. 32 GDPR). In doing so, the Supplier will assess the risk to the rights and freedoms of the Data Subjects and take appropriate measures to ensure the confidentiality, integrity, availability, and resilience of systems and services in connection with the data processing.

(2) The Technical and Organisational Measures are subject to technical progress and further development. The Supplier is permitted to implement alternative adequate measures provided the safety level is not compromised. Substantial changes must be documented.

(3) Before the commencement of data processing, the Supplier shall document the execution of the necessary Technical and Organisational Measures as defined in advance of the awarding of the Order or Contract.

(4) NIZU OÜ's TOMs are based upon and aligned with the TOMs implemented by Hetzner Online GmbH. The current version of Hetzner's TOMs — which form the technical foundation of NIZU's security posture — can be found at:

https://www.hetzner.com/AV/TOM_en.pdf

(5) NIZU OÜ's own Technical and Organisational Measures are documented in Appendix 2 of this DPA.

§ 5 Quality Assurance and Other Duties of the Supplier

The Supplier confirms that they are aware of the relevant general data protection regulations and agrees to follow the principles of proper data processing. In particular, the Supplier guarantees compliance with the following requirements:

1. Appointed Data Protection Officer

The Supplier has designated a Data Protection Officer (DPO) in accordance with Art. 37 GDPR. The DPO can be contacted at legal@nizu.io.

2. Maintaining Confidentiality

The Supplier entrusts only such employees with data processing as have been bound to confidentiality and have previously been familiarised with the relevant data protection provisions. This confidentiality obligation continues even after the main contract has ended.

3. Implementation of Technical and Organisational Measures

The Supplier agrees to implement and follow all necessary Technical and Organisational Measures relevant to this DPA. See also § 4 of this DPA.

4. Cooperation with Supervisory Authority

The Supplier and the Client will, upon request, cooperate with the supervisory authority in the performance of their duties. The Supplier will inform the Client immediately of any inspections and measures conducted by a supervisory authority insofar as they relate to this DPA, unless prohibited by statutory regulations or an official court order.

5. Support in Regulatory Proceedings

Insofar as the Client is subject to an inspection by a supervisory authority, an administrative or criminal procedure, a liability claim of a Data Subject, or any other claim in connection with the processing under this Agreement, the Supplier will make every effort to support the Client to the best of their ability.

6. Regular Review of TOMs

The Supplier will regularly monitor its internal processes and the effectiveness of the TOMs to ensure that processing within its area of responsibility is executed in accordance with applicable data protection law and that the rights of Data Subjects are protected.

7. Support for Requests from Data Subjects

The Supplier shall reasonably assist the Client in fulfilling requests and claims of Data Subjects pursuant to Chapter III of the GDPR. If a Data Subject contacts the Supplier directly, the Supplier shall promptly refer the Data Subject to the Client and immediately forward the request to the Client.

⚠️ SCOPE OF DATA SUBJECT SUPPORT

The obligation in § 5(7) above applies only to data subjects whose data NIZU processes at the platform level (i.e., End-Users of the NIZU WorkSpace platform itself).

Data subjects who are the Client's own customers or users must be directed in full to the Client. NIZU bears no obligation and accepts no liability in respect of data subjects with whom NIZU has no direct relationship.

8. Reporting Data Protection Violations

The Supplier will inform the Client immediately upon becoming aware of any violations of the Client's personal data protection. At a minimum, the report will include:

• A description of the nature of the personal data breach, including, where possible, the categories and approximate number of Data Subjects and personal data records affected;
• The name and contact details of the DPO or other contact person for further information;
• A description of the likely consequences of the breach;
• A description of the measures taken or planned to address the breach, including measures to mitigate its possible negative effects.

§ 6 The Client's Responsibilities

(1) The Client must inform the Supplier immediately and in full if they discover any errors or irregularities in the results of their processed data.

(2) The Client is solely and exclusively responsible for:

• The lawfulness of all data processing carried out within the Client's Workspace;
• Establishing appropriate legal bases under Art. 6 GDPR (and Art. 9 GDPR where applicable) for all processing operations;
• Providing required privacy notices and obtaining necessary consents from the Client's own end-users;
• Fulfilling data subject rights requests directed at the Client;
• Notifying the competent supervisory authority and/or data subjects of any personal data breach affecting the Client's Workspace, within the timeframes required by the GDPR;
• Maintaining independent backups of any data stored within the NIZU WorkSpace platform.

§ 7 Sub-contractual Relationships

(1) For the purposes of this DPA, sub-contractual relationships are those services which relate directly to the provision of the principal commission. Ancillary services (telecommunications, postal/transport, maintenance) are excluded.

(2) If the Supplier commissions other sub-processors to process personal data covered by this DPA, it is the Supplier's responsibility to transfer its data protection obligations to the sub-processor and to ensure the sub-processor provides an adequate level of data protection.

(3) The Client agrees to the Supplier commissioning further sub-processors. The Supplier will inform the Client in good time before engaging or replacing a sub-processor. The Client has the right to exercise data protection objection rights within a period of 14 days of being informed. If the Client does not object within this period, the change is considered accepted. If there is a legitimate data protection reason for objection and the parties cannot reach agreement, the Client will be granted special rights to terminate the main contract.

(4) The 14-day period may be shortened in exceptional circumstances where a two-week waiting period would be unreasonable for the Supplier.

(5) The Client agrees to the sub-processors listed in Appendix 3 of this DPA.

§ 8 The Client's Inspection Rights

(1) The Supplier will ensure that the Client has suitable means to verify compliance with the responsibilities defined in this DPA. The Supplier agrees to provide the Client with all relevant information upon request, and in particular to provide evidence of the implementation of the TOMs.

(2) The Supplier may provide proof of compliance in the following forms:

• Compliance with codes of conduct in accordance with Art. 40 GDPR;
• Certification using approved certification processes in accordance with Art. 42 GDPR;
• Up-to-date assessments, reports, or excerpts of reports from an independent party (financial auditor, internal auditor, DPO, IT security department, data protection auditor);
• Relevant certification via an IT security or data protection audit (e.g. ISO 27001).

(3) Given that NIZU OÜ's infrastructure is operated by Hetzner Online GmbH, NIZU shall additionally make available to the Client, without charge and without being requested, the audit results published by Hetzner Online GmbH at:

https://accounts.hetzner.com/account/dpa

(4) The Client has the right, in cooperation with the Supplier, to perform additional checks in accordance with Art. 28 para. 3 clause 2 lit. h GDPR, subject to the following conditions:

• Upon reasonable written notice of at least 30 calendar days;
• No more than once per calendar year (special-purpose checks excluded);
• During normal business hours and without interrupting the Supplier's operations;
• At the Client's own cost;
• The Supplier has the right to object to the Client commissioning a direct competitor to perform the checks. The Client must conclude a non-disclosure agreement with any commissioned third party; the Supplier may additionally require a separate NDA from such a party.

§ 9 Further Responsibilities to Provide Support

(1) The Supplier will support the Client in complying with its obligations under Articles 32–36 GDPR, including:

(a) Obligation to implement appropriate Technical and Organisational Measures — ensuring an appropriate level of protection through TOMs that account for the circumstances and purposes of processing, the probability and severity of a possible data breach, and that allow for the immediate detection of a relevant data breach.

(b) Notifying the Client of data breaches — the Supplier will report personal data breaches to the Client without delay.

(c) Supporting the Client with the duty to inform Data Subjects — the Supplier will support the Client with its duty to inform Data Subjects and provide all relevant information without delay.

(d) Supporting the Client with data protection impact assessments — the Supplier will support the Client in making data protection impact assessments where required.

(e) Supporting the Client in prior consultations with the supervisory authority — the Supplier will support the Client in the context of prior consultations.

(2) The Supplier may charge a fee for support services that go beyond the Supplier's statutory responsibilities, that are not included in the above, or that are necessary for actions not considered misconduct on the part of the Supplier. The cost for such services is defined in § 12 of this DPA.

§ 10 The Client's Authority to Issue Instructions

(1) The Supplier and any of its personnel who have access to personal data may process the data subject to this DPA exclusively within the scope of the Client's main contract, and in accordance with the Client's instructions, unless the Supplier is legally required to process said data, or unless an exceptional situation as defined in Art. 28 para. 3 lit. a GDPR exists.

(2) The Client's instructions are initially defined in this DPA. The Client may amend, supplement, or replace instructions in writing or in text form (including by email) by making specific separate instructions. Oral instructions must be confirmed in writing without delay. Instructions not covered by the contract will be treated as a request for a change in performance.

(3) The Supplier will inform the Client immediately if it believes that a Client instruction infringes the GDPR or other applicable data protection regulations (duty to remonstrate). The Supplier is within its rights to suspend implementation of said instruction until the Client affirms or amends it.

§ 11 Deletion and Return of Personal Data

(1) Copies or duplicates of the data will not be created without the knowledge of the Client, except for:

• Backup copies necessary to ensure proper data processing;
• Data required for compliance with statutory storage obligations.

(2) Data, data storage devices, and all documents must be returned or deleted at the Client's written request following the conclusion of the main contract, provided these are the property of the Client.

(3) If deletion in compliance with data protection regulations is not possible, the Supplier will ensure that data storage devices and documents containing contractually relevant data are destroyed in compliance with data protection regulations. Where costs are incurred for return, deletion, or destruction due to specific Client instructions, the Client will bear those costs as defined in § 12.

(4) The Supplier will retain documentation serving as proof of proper data processing in accordance with the main contract and statutory regulations after the end of the contract, in accordance with the respective retention periods. The Supplier may return this documentation to the Client at the end of the contract.

⚠️ RETENTION LIMITATION

The Client acknowledges that NIZU OÜ's ability to retrieve or return data following termination is limited by the capabilities of the underlying Hetzner GmbH infrastructure.

NIZU accepts no liability for data that cannot be recovered following the expiry of the applicable retention period or following termination of the Service.

The Client is solely responsible for exporting all required data prior to termination.

§ 12 Reimbursement

(1) Fees for services provided under §§ 8, 9, and 11 of this DPA that go beyond the Supplier's statutory obligations will be agreed in advance and based on an hourly rate for the Supplier's employee performing the relevant support services.

(2) The Supplier is not entitled to remuneration for services that are necessary due to data protection violations by the Supplier itself.

§ 13 Other Agreements

13.1 Choice of Law

These Terms are governed exclusively by the laws of the Republic of Estonia and applicable European Union law. The exclusive place of jurisdiction for all disputes arising from this DPA is the competent courts of the Republic of Estonia, seated in Tallinn.

⚠️ JURISDICTIONAL LIMITATION

No foreign court, arbitral body, regulatory authority, or legal framework outside the Republic of Estonia and the European Union has jurisdiction over any matter arising from or related to this DPA. Any attempt to assert foreign jurisdiction is expressly rejected by NIZU OÜ.

13.2 Liability

The liability clause agreed between the parties in the main contract (NIZU-TOS-001, § 4) also applies to data processing defined in this DPA.

13.3 Safekeeping of Data

If the Client's data stored with the Supplier is jeopardised due to seizure, confiscation, insolvency, or bankruptcy proceedings, or other events or measures by third parties, the Supplier will immediately inform the Client and will immediately inform all responsible parties that the sovereignty and ownership of the data lies exclusively with the Client as Controller. This obligation does not apply where the Supplier is legally prohibited from disclosure by statute or official court order.

13.4 Amendments and Modifications

Any amendments or modifications to this DPA, including any commitments made by the Supplier, require a written agreement (which may be made in electronic form). It must be clearly stated in the agreement that it is an amendment to this DPA. The same applies to any waiver of this formal requirement.

13.5 Data Protection Regulations Take Precedence

If there are any contradictions between this DPA and the main contract, the provisions of this DPA on data protection will take precedence.

13.6 Severability

If any part of this DPA becomes invalid, it will not affect the validity of the remaining provisions.

§ 14 External Storage Services — Void of DPA

14.1 Scope of This DPA

This DPA governs exclusively the processing of personal data that occurs within the NIZU WorkSpace platform infrastructure, hosted on servers operated by NIZU OÜ via its infrastructure provider Hetzner Online GmbH. The protections, obligations, and guarantees set out in this DPA apply solely to data that remains within this defined infrastructure boundary.

14.2 Effect of External Storage Configuration

⚠️ THIS DPA BECOMES VOID IN RESPECT OF ANY DATA ROUTED TO EXTERNAL STORAGE

If the Client Administrator configures the Client Workspace to connect to, store data in, or transmit personal data to any external file storage, object storage, or cloud storage service not operated by NIZU OÜ or Hetzner Online GmbH, this DPA is automatically void and of no effect in relation to any personal data processed through or stored within such external service.

This includes, without limitation, the following categories of external services and any products offered by them:

• Amazon Web Services — including but not limited to Amazon S3, Amazon EFS, Amazon Glacier, and any other AWS storage product;
• Google — including but not limited to Google Drive, Google Cloud Storage, and any other Google storage product;
• Backblaze — including but not limited to Backblaze B2 Cloud Storage;
• Cloudflare — including but not limited to Cloudflare R2 Storage and any Cloudflare data services;
• Microsoft — including but not limited to Microsoft Azure Blob Storage, Microsoft OneDrive, and SharePoint;
• Dropbox, Box, Wasabi, DigitalOcean Spaces, Vultr Object Storage, or any other third-party storage provider;
• Any other external storage, backup, or file hosting service not expressly listed in Appendix 3 of this DPA.

14.3 Client's Sole Responsibility for External Storage

Where the Client Administrator routes personal data to any external storage service as described in § 14.2:

(1) NIZU OÜ has no visibility, control, or oversight over the personal data once it leaves the NIZU WorkSpace infrastructure boundary.

(2) NIZU OÜ cannot and does not make any representation, warranty, or guarantee regarding the security, availability, integrity, or GDPR compliance of any external storage provider.

(3) The Client becomes the sole Data Controller responsible for ensuring that:

• A lawful basis under Art. 6 GDPR exists for the transfer and processing of personal data by the external storage provider;
• A valid Data Processing Agreement has been concluded directly between the Client and the external storage provider;
• Any applicable cross-border transfer safeguards under Chapter V GDPR are in place, particularly where the external provider processes data outside the EEA (e.g. AWS US regions, Google Cloud US, Cloudflare US infrastructure);
• The privacy rights of all Data Subjects whose data is transferred to external storage are protected.

(4) NIZU OÜ accepts zero liability of any kind — whether contractual, tortious, regulatory, or otherwise — for any data protection failure, security incident, data breach, regulatory sanction, or harm to Data Subjects arising from or connected with the Client's use of any external storage service.

14.4 Notification Obligation

The Client Administrator is responsible for notifying NIZU OÜ at legal@nizu.io if external storage services are integrated into the Client Workspace. NIZU may, at its sole discretion, update or amend this DPA or the main contract to reflect such integration. Failure to notify NIZU does not affect the application of § 14.2 and § 14.3.

14.5 Resumption of DPA Coverage

This DPA resumes full effect in respect of personal data that is returned to and stored exclusively within the NIZU WorkSpace infrastructure, provided the Client can demonstrate to NIZU's reasonable satisfaction that the data in question has not been further processed or exposed through any external storage service during the period of external storage.

§ 15 Contact Information

Appendix 1 — Scope, Type, and Purpose of Data Processing

Scope, Type, and Purpose

The processing of personal data under this DPA is carried out in connection with the provision of the NIZU WorkSpace cloud platform service, as described in the main contract (NIZU-TOS-001). Processing occurs exclusively to enable the delivery, operation, security, and maintenance of the Service.

Types of Data

The following categories of personal data may be processed under this DPA within the Client's Workspace, as determined by the Client:

• Personal master data (name, email address, username)
• Communication data
• Contract and master data
• Log data (access logs, authentication events, session metadata)
• Contract invoicing and payment reference data
• Any other data categories as specified by the Client in its use of the Service

Data Subjects

• Customers and prospective customers of the Client
• Associates, employees, and contractors of the Client
• Any other natural persons whose data the Client introduces into the Workspace

Note: The categories above are defined by the Client as Data Controller. NIZU OÜ processes only such categories as the Client instructs. The Client is solely responsible for ensuring that its processing of any of the above categories has a lawful basis under the GDPR.

Appendix 2 — Technical and Organisational Measures (TOMs)

The Technical and Organisational Measures (TOMs) set out below apply to the processing of personal data by NIZU OÜ in the delivery of NIZU WorkSpace. They are based upon and aligned with the TOMs implemented by NIZU's infrastructure provider, Hetzner Online GmbH (available at: https://www.hetzner.com/AV/TOM_en.pdf).

⚠️ NIZU's TOMs are constrained by and do not exceed the measures available through the underlying Hetzner infrastructure. Where a TOM category is listed as the "Client's responsibility" in Hetzner's framework, it remains the Client's responsibility within the NIZU WorkSpace environment.

1. Physical Access Control

Physical access to NIZU's server infrastructure is managed exclusively by Hetzner Online GmbH at its data centre facilities. Controls include:

2. Electronic Access Control

3. Internal Access Control

4. Transfer Control

5. Isolation Control

6. Pseudonymisation

7. Confidentiality

8. Integrity

9. Availability, Resilience, and Network Security

10. Procedures for Regular Testing, Assessment, and Evaluation

Appendix 3 — Approved Sub-Processors

NIZU OÜ uses services of the following sub-processors in the delivery of NIZU WorkSpace. By entering into this DPA, the Client approves these sub-processors. NIZU will notify the Client of any changes in accordance with § 7 of this DPA.

NIZU OÜ Direct Sub-Processor

Hetzner Online GmbH Sub-Processors (Approved by NIZU as Part of the Infrastructure Chain)

The following are sub-processors engaged by Hetzner Online GmbH, which form part of the infrastructure chain for NIZU WorkSpace. These are disclosed in Hetzner's DPA (Appendix 3) and are approved by NIZU OÜ:

Please note: If the Client has chosen a server location within the EU, data will only be processed within the EU. The technical and customer support services for all server locations are provided within the EU. NIZU strongly recommends that Clients requiring EU-only data residency select an EU server location within their Workspace configuration.

— END OF DATA PROCESSING AGREEMENT —

NIZU OÜ DPA v1.0 · Tallinn, Estonia · 01-01-2026