# Data Processing Agreement > NIZU OÜ — Data Processing AgreementNIZU WorkSpace · In Accordance with Article 28 of the GDPR Field Detail Document Reference NIZU-DPA-001 Version 1.0 Effective Date 01-01-2026 Governing Law Republic… - Page: https://dashboard.nizu.io/about/dpa - Part of: Pages on NIZU — https://dashboard.nizu.io/llms.txt - Updated: 2026-10-25T11:50:03Z ## NIZU OÜ — Data Processing Agreement ### NIZU WorkSpace · In Accordance with Article 28 of the GDPR --- | Field | Detail | | --- | --- | | **Document Reference** | NIZU-DPA-001 | | **Version** | 1.0 | | **Effective Date** | 01-01-2026 | | **Governing Law** | Republic of Estonia · European Union | | **Data Processor** | NIZU OÜ — VAT: EE102264113 | | **Registered Address** | Harju maakond, Tallinn, Lasnamäe linnaosa, Lõõtsa tn 5, 11415, Estonia | | **Legal Contact** | legal@nizu.io | | **Classification** | CONFIDENTIAL | --- ### Parties **between** Name and address of the contract partner — Controller within the meaning of the GDPR, hereinafter referred to as the **"Client"** — **and** **NIZU OÜ** Harju maakond, Tallinn, Lasnamäe linnaosa, Lõõtsa tn 5, 11415, Estonia VAT: EE102264113 legal@nizu.io — Processor within the meaning of the GDPR, hereinafter referred to as the **"Supplier"** — --- ### Introduction This Data Processing Agreement (DPA) defines the data protection obligations of the contractual parties, and the data processing that takes place as a result of the Client's main contract with NIZU OÜ. The DPA applies to all activities relevant to the main contract in which employees of the Supplier or third parties commissioned by the Supplier process personal data on behalf of the Client. > ⚠️ **INFRASTRUCTURE DEPENDENCY** > > > > NIZU OÜ delivers the NIZU WorkSpace Service using infrastructure provided by **Hetzner Online GmbH**, Industriestraße 25, 91710 Gunzenhausen, Germany. This DPA is structured in parallel with, and is dependent upon, the Data Processing Agreement between NIZU OÜ and Hetzner Online GmbH (available at: [https://www.hetzner.com/AV/DPA_en.pdf](https://www.hetzner.com/AV/DPA_en.pdf)). > > > > Where this DPA refers to Technical and Organisational Measures (TOMs) or sub-processor arrangements, these are bound by and **do not exceed** the measures and guarantees provided by Hetzner Online GmbH under their own DPA and TOMs (available at: [https://www.hetzner.com/AV/TOM_en.pdf](https://www.hetzner.com/AV/TOM_en.pdf)). --- ### Table of Contents 1. Subject Matter and Duration 2. Object, Nature, and Purpose of Processing 3. Third Country Data Transfer 4. Technical and Organisational Measures 5. Quality Assurance and Other Duties of the Supplier 6. The Client's Responsibilities 7. Sub-contractual Relationships 8. The Client's Inspection Rights 9. Further Responsibilities to Provide Support 10. The Client's Authority to Issue Instructions 11. Deletion and Return of Personal Data 12. Reimbursement 13. Other Agreements 14. External Storage Services — Void of DPA 15. Contact Information - Appendix 1 — Scope, Type, and Purpose of Data Processing - Appendix 2 — Technical and Organisational Measures (TOMs) - Appendix 3 — Approved Sub-Processors --- ### § 1 Subject Matter and Duration **(1)** This Data Processing Agreement (DPA) defines the data protection obligations of the contractual parties, and the data processing that takes place as a result of the Client's main contract with NIZU OÜ. The main contract consists of the NIZU WorkSpace product description and the applicable Terms of Service (NIZU-TOS-001). **(2)** The Supplier will process personal data on behalf of the Client in accordance with Art. 4 No. 2 GDPR under this Agreement. **(3)** Within the scope of this DPA, the Client is solely responsible for compliance with data protection regulations. In particular, the Client will ensure that both the transfer of data to the Supplier and its data processing are lawful. The Client is considered the **"Controller"** within the scope of Art. 4 No. 7 GDPR. **(4)** This DPA is dependent on the existence of a main contractual relationship in accordance with § 1 (1) of this Agreement (for the duration of data processing). The cancellation or other termination of the main contractual relationship will simultaneously terminate this DPA. The right to extraordinary termination of this DPA and the right to exercise statutory rights of withdrawal remain unaffected. > ⚠️ **NIZU'S END-USERS — NO RELATIONSHIP WITH CLIENT'S END-USERS** > > > > NIZU OÜ has **no legal relationship, obligation, or liability** of any kind towards the Client's own customers, users, employees, or third parties who access the Client's Workspace. > > > > The Client is **solely and exclusively responsible** for all GDPR obligations owed to its own end-users, including: establishing a lawful basis, providing required notices, obtaining consent, fulfilling data subject rights requests, and breach notification to data subjects and supervisory authorities in respect of the Client's own operations. > > > > NIZU shall not respond to data subject requests from the Client's end-users directly. All such requests must be handled by the Client as Data Controller. --- ### § 2 Object, Nature, and Purpose of Processing The object, nature, and purpose of any possible collection, processing, or use of personal data, the nature of the data, and the Data Subjects are described in **Appendix 1** of this DPA, as completed by the Client, insofar as this is not governed by the main contractual relationship described in § 1 of this DPA. --- ### § 3 Third Country Data Transfer **(1)** The provision of the contractually agreed upon data processing will occur exclusively in a member state of the **European Union** or in another member state party to the Agreement on the **European Economic Area**, to the extent technically possible given the infrastructure provided by Hetzner Online GmbH. **(2)** Any transfer to a third country will require the **prior consent of the Client** and may only occur if the special conditions defined in **Articles 44 et seq. of the GDPR** are fulfilled. **(3)** The Supplier will inform the Client in advance which third country or countries are involved and how the appropriate level of protection is ensured. The Supplier agrees to provide the Client with evidence of the implemented guarantees upon request. **(4)** The appropriate level of protection for data processing in any third country is ensured by one of the following measures: - Adequacy decision of the European Commission (Art. 45 No. 3 GDPR); - Binding internal data protection rules, including additional safeguards where appropriate (Art. 46 No. 2 lit. b GDPR in conjunction with Art. 47 GDPR); - Appropriately modified standard data protection clauses (SCCs), including additional safeguards where applicable (Art. 46 (2) (c) and (d) GDPR); - Approved codes of conduct (Art. 46 No. 2 lit. e in conjunction with Art. 40 GDPR); - Approved certification mechanism (Art. 46 No. 2 lit. f in conjunction with Art. 42 GDPR); - Another manner provided for in Art. 44 et seq. GDPR, of which the Supplier will inform the Client in advance. > ⚠️ **NOTE ON THIRD COUNTRY TRANSFERS** > > > > NIZU OÜ's infrastructure sub-processor, Hetzner Online GmbH, operates sub-processors in the USA and Singapore (see Appendix 3). If the Client selects a **server location within the EU**, data will be processed exclusively within the EU. Technical and customer support services for all server locations are provided within the EU. Clients requiring EU-only data residency must select an EU server location when configuring their Workspace. --- ### § 4 Technical and Organisational Measures **(1)** The Supplier will implement Technical and Organisational Measures (TOMs) that ensure adequate protection of the Client's data and comply with the requirements of the GDPR (Art. 32 GDPR). In doing so, the Supplier will assess the risk to the rights and freedoms of the Data Subjects and take appropriate measures to ensure the confidentiality, integrity, availability, and resilience of systems and services in connection with the data processing. **(2)** The Technical and Organisational Measures are subject to technical progress and further development. The Supplier is permitted to implement alternative adequate measures provided the safety level is not compromised. Substantial changes must be documented. **(3)** Before the commencement of data processing, the Supplier shall document the execution of the necessary Technical and Organisational Measures as defined in advance of the awarding of the Order or Contract. **(4)** NIZU OÜ's TOMs are based upon and aligned with the TOMs implemented by Hetzner Online GmbH. The current version of Hetzner's TOMs — which form the technical foundation of NIZU's security posture — can be found at: **[https://www.hetzner.com/AV/TOM_en.pdf](https://www.hetzner.com/AV/TOM_en.pdf)** **(5)** NIZU OÜ's own Technical and Organisational Measures are documented in **Appendix 2** of this DPA. --- ### § 5 Quality Assurance and Other Duties of the Supplier The Supplier confirms that they are aware of the relevant general data protection regulations and agrees to follow the principles of proper data processing. In particular, the Supplier guarantees compliance with the following requirements: #### 1. Appointed Data Protection Officer The Supplier has designated a Data Protection Officer (DPO) in accordance with Art. 37 GDPR. The DPO can be contacted at **legal@nizu.io**. #### 2. Maintaining Confidentiality The Supplier entrusts only such employees with data processing as have been bound to confidentiality and have previously been familiarised with the relevant data protection provisions. This confidentiality obligation continues even after the main contract has ended. #### 3. Implementation of Technical and Organisational Measures The Supplier agrees to implement and follow all necessary Technical and Organisational Measures relevant to this DPA. See also § 4 of this DPA. #### 4. Cooperation with Supervisory Authority The Supplier and the Client will, upon request, cooperate with the supervisory authority in the performance of their duties. The Supplier will inform the Client immediately of any inspections and measures conducted by a supervisory authority insofar as they relate to this DPA, unless prohibited by statutory regulations or an official court order. #### 5. Support in Regulatory Proceedings Insofar as the Client is subject to an inspection by a supervisory authority, an administrative or criminal procedure, a liability claim of a Data Subject, or any other claim in connection with the processing under this Agreement, the Supplier will make every effort to support the Client to the best of their ability. #### 6. Regular Review of TOMs The Supplier will regularly monitor its internal processes and the effectiveness of the TOMs to ensure that processing within its area of responsibility is executed in accordance with applicable data protection law and that the rights of Data Subjects are protected. #### 7. Support for Requests from Data Subjects The Supplier shall reasonably assist the Client in fulfilling requests and claims of Data Subjects pursuant to Chapter III of the GDPR. If a Data Subject contacts the Supplier directly, the Supplier shall promptly refer the Data Subject to the Client and immediately forward the request to the Client. > ⚠️ **SCOPE OF DATA SUBJECT SUPPORT** > > > > The obligation in § 5(7) above applies only to data subjects whose data NIZU processes **at the platform level** (i.e., End-Users of the NIZU WorkSpace platform itself). > > > > Data subjects who are the **Client's own customers or users** must be directed in full to the Client. NIZU bears no obligation and accepts no liability in respect of data subjects with whom NIZU has no direct relationship. #### 8. Reporting Data Protection Violations The Supplier will inform the Client immediately upon becoming aware of any violations of the Client's personal data protection. At a minimum, the report will include: - A description of the nature of the personal data breach, including, where possible, the categories and approximate number of Data Subjects and personal data records affected; - The name and contact details of the DPO or other contact person for further information; - A description of the likely consequences of the breach; - A description of the measures taken or planned to address the breach, including measures to mitigate its possible negative effects. --- ### § 6 The Client's Responsibilities **(1)** The Client must inform the Supplier immediately and in full if they discover any errors or irregularities in the results of their processed data. **(2)** The Client is solely and exclusively responsible for: - The lawfulness of all data processing carried out within the Client's Workspace; - Establishing appropriate legal bases under Art. 6 GDPR (and Art. 9 GDPR where applicable) for all processing operations; - Providing required privacy notices and obtaining necessary consents from the Client's own end-users; - Fulfilling data subject rights requests directed at the Client; - Notifying the competent supervisory authority and/or data subjects of any personal data breach affecting the Client's Workspace, within the timeframes required by the GDPR; - Maintaining independent backups of any data stored within the NIZU WorkSpace platform. --- ### § 7 Sub-contractual Relationships **(1)** For the purposes of this DPA, sub-contractual relationships are those services which relate directly to the provision of the principal commission. Ancillary services (telecommunications, postal/transport, maintenance) are excluded. **(2)** If the Supplier commissions other sub-processors to process personal data covered by this DPA, it is the Supplier's responsibility to transfer its data protection obligations to the sub-processor and to ensure the sub-processor provides an adequate level of data protection. **(3)** The Client agrees to the Supplier commissioning further sub-processors. The Supplier will inform the Client in good time before engaging or replacing a sub-processor. The Client has the right to exercise data protection objection rights within a period of **14 days** of being informed. If the Client does not object within this period, the change is considered accepted. If there is a legitimate data protection reason for objection and the parties cannot reach agreement, the Client will be granted special rights to terminate the main contract. **(4)** The 14-day period may be shortened in exceptional circumstances where a two-week waiting period would be unreasonable for the Supplier. **(5)** The Client agrees to the sub-processors listed in **Appendix 3** of this DPA. --- ### § 8 The Client's Inspection Rights **(1)** The Supplier will ensure that the Client has suitable means to verify compliance with the responsibilities defined in this DPA. The Supplier agrees to provide the Client with all relevant information upon request, and in particular to provide evidence of the implementation of the TOMs. **(2)** The Supplier may provide proof of compliance in the following forms: - Compliance with codes of conduct in accordance with Art. 40 GDPR; - Certification using approved certification processes in accordance with Art. 42 GDPR; - Up-to-date assessments, reports, or excerpts of reports from an independent party (financial auditor, internal auditor, DPO, IT security department, data protection auditor); - Relevant certification via an IT security or data protection audit (e.g. ISO 27001). **(3)** Given that NIZU OÜ's infrastructure is operated by Hetzner Online GmbH, NIZU shall additionally make available to the Client, without charge and without being requested, the audit results published by Hetzner Online GmbH at: **[https://accounts.hetzner.com/account/dpa](https://accounts.hetzner.com/account/dpa)** **(4)** The Client has the right, in cooperation with the Supplier, to perform additional checks in accordance with Art. 28 para. 3 clause 2 lit. h GDPR, subject to the following conditions: - Upon **reasonable written notice of at least 30 calendar days**; - **No more than once per calendar year** (special-purpose checks excluded); - During normal business hours and without interrupting the Supplier's operations; - At the **Client's own cost**; - The Supplier has the right to object to the Client commissioning a direct competitor to perform the checks. The Client must conclude a non-disclosure agreement with any commissioned third party; the Supplier may additionally require a separate NDA from such a party. --- ### § 9 Further Responsibilities to Provide Support **(1)** The Supplier will support the Client in complying with its obligations under **Articles 32–36 GDPR**, including: **(a) Obligation to implement appropriate Technical and Organisational Measures** — ensuring an appropriate level of protection through TOMs that account for the circumstances and purposes of processing, the probability and severity of a possible data breach, and that allow for the immediate detection of a relevant data breach. **(b) Notifying the Client of data breaches** — the Supplier will report personal data breaches to the Client without delay. **(c) Supporting the Client with the duty to inform Data Subjects** — the Supplier will support the Client with its duty to inform Data Subjects and provide all relevant information without delay. **(d) Supporting the Client with data protection impact assessments** — the Supplier will support the Client in making data protection impact assessments where required. **(e) Supporting the Client in prior consultations with the supervisory authority** — the Supplier will support the Client in the context of prior consultations. **(2)** The Supplier may charge a fee for support services that go beyond the Supplier's statutory responsibilities, that are not included in the above, or that are necessary for actions not considered misconduct on the part of the Supplier. The cost for such services is defined in § 12 of this DPA. --- ### § 10 The Client's Authority to Issue Instructions **(1)** The Supplier and any of its personnel who have access to personal data may process the data subject to this DPA exclusively within the scope of the Client's main contract, and in accordance with the Client's instructions, unless the Supplier is legally required to process said data, or unless an exceptional situation as defined in Art. 28 para. 3 lit. a GDPR exists. **(2)** The Client's instructions are initially defined in this DPA. The Client may amend, supplement, or replace instructions in writing or in text form (including by email) by making specific separate instructions. Oral instructions must be confirmed in writing without delay. Instructions not covered by the contract will be treated as a request for a change in performance. **(3)** The Supplier will inform the Client immediately if it believes that a Client instruction infringes the GDPR or other applicable data protection regulations (**duty to remonstrate**). The Supplier is within its rights to suspend implementation of said instruction until the Client affirms or amends it. --- ### § 11 Deletion and Return of Personal Data **(1)** Copies or duplicates of the data will not be created without the knowledge of the Client, except for: - Backup copies necessary to ensure proper data processing; - Data required for compliance with statutory storage obligations. **(2)** Data, data storage devices, and all documents must be returned or deleted at the Client's written request following the conclusion of the main contract, provided these are the property of the Client. **(3)** If deletion in compliance with data protection regulations is not possible, the Supplier will ensure that data storage devices and documents containing contractually relevant data are destroyed in compliance with data protection regulations. Where costs are incurred for return, deletion, or destruction due to specific Client instructions, the Client will bear those costs as defined in § 12. **(4)** The Supplier will retain documentation serving as proof of proper data processing in accordanc (…cut; the full text is on the page.)