Data Processing Addendum
Terms that apply when Data.co processes personal data on a customer's behalf. Because Data.co Control runs in the customer's own infrastructure, the processing in scope is limited to app.data.co, the Marketplace, the API and MCP server, and any support or managed services the customer engages us for.
How this addendum works.
1.1 This Data Processing Addendum ("DPA") forms part of the Terms of Service or other agreement between Nead, LLC, doing business as Data.co ("Data.co", "Processor") and the customer identified in the Order ("Customer") (the "Agreement"). It applies automatically to Customers whose use of the Services involves Data.co processing Customer Personal Data. A countersigned copy is available on request.
1.2 Definitions. "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law ("UK GDPR") and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA"). "Customer Personal Data" means personal data that Data.co processes on behalf of Customer in providing the Services. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. "Subprocessor" means any third party Data.co engages to process Customer Personal Data. "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner. "Controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR; "business", "service provider" and "consumer" have the meanings given in the CCPA.
1.3 Capitalized terms not defined here have the meanings given in the Agreement. If this DPA conflicts with the Agreement, this DPA controls as to the processing of Customer Personal Data. If the SCCs conflict with this DPA, the SCCs control.
What is and is not in scope.
Customer is the controller (or a processor acting for its own controller) and Data.co is the processor (or subprocessor) of Customer Personal Data. Data.co is an independent controller of the personal data described in its Privacy Policy, such as account billing records and its own security logs, and that data is not governed by this DPA.
| Activity | In scope of this DPA? | Notes |
|---|---|---|
| Customer content in a self-operated Data.co Control deployment | No | Processed by Customer in its own infrastructure; not received by Data.co |
| Opt-in Data.co Control telemetry | No | Limited to deployment version, license status and health; contains no Customer Personal Data by design |
| User and organization data in app.data.co (members, roles, invitations, organization audit events) | Yes | Data.co processes on Customer's behalf |
| API and MCP requests containing Customer Personal Data | Yes | Processed to return responses; request metadata kept for metering and security |
| Support sessions with Customer-granted access | Yes | Limited to the session and purpose |
| Managed services under a separate Order | Yes | Scope defined in the Order; a Business Associate Agreement may also apply |
Instructions, confidentiality and CCPA terms.
3.1 Instructions. Data.co will process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, Customer's configuration and use of the Services, and any other written instructions agreed by the parties. Data.co will inform Customer if it believes an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or modified. If the law requires Data.co to process Customer Personal Data other than on instructions, Data.co will inform Customer before processing unless the law prohibits it.
3.2 Customer responsibilities. Customer is responsible for the lawfulness of its instructions, for having a legal basis for the processing, and for providing any notices and obtaining any consents required for Data.co to process Customer Personal Data under the Agreement.
3.3 Confidentiality. Data.co will ensure that persons authorized to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, receive appropriate training, and access Customer Personal Data only as needed to perform the Services.
3.4 CCPA service provider terms. Data.co will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including any commercial purpose other than providing the Services; retain, use or disclose it outside the direct business relationship between the parties; or combine it with personal data Data.co receives from other sources, except as the CCPA permits. Data.co will comply with the CCPA, provide the same level of privacy protection the CCPA requires, and notify Customer if it can no longer meet its obligations. Customer may take reasonable steps to stop and remediate unauthorized use.
3.5 No model training. Data.co will not use Customer Personal Data or other Customer Content to train AI models.
Security measures Data.co maintains.
Data.co will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, costs, and the nature, scope, context and purposes of processing and the risks to individuals. Data.co may update these measures provided it does not materially reduce overall protection.
| Area | Measures |
|---|---|
| Access control | Role-based, least-privilege access for staff, granted per role and reviewed periodically; multi-factor authentication required for administrative access; prompt removal of access when personnel change roles or leave; unique accounts, no shared credentials. |
| Customer authentication | Hashed passwords; support for two-factor authentication and passkeys; session management with expiry and revocation; API keys stored hashed and shown in full only once at creation; organization roles and permissions. |
| Encryption | TLS for data in transit over public networks; encryption at rest where supported by the underlying platform, including for backups; secrets held in restricted configuration stores, not in source code. |
| Tenant isolation | Every customer record is scoped to its organization; authorization checks on every request; API keys scoped to a single organization. |
| Logging and monitoring | Logging of authentication events and administrative actions; monitoring of infrastructure health and security events; logs protected from tampering and retained per the Privacy Policy schedule. |
| Vulnerability management | Dependency and security updates applied on a risk-based schedule; prompt remediation of critical vulnerabilities; a responsible disclosure program. |
| Network security | DNS, CDN and DDoS protection via Cloudflare; host firewalls restricting inbound traffic to required services; administrative access over restricted, authenticated channels. |
| Backups and business continuity | Regular backups that expire within 35 days; documented restore procedures; ability to redeploy services from version-controlled configuration. |
| Secure development | Version control with code review; separation of development and production environments; no production personal data in development; input validation and output encoding; secrets kept out of source code. |
| Personnel | Confidentiality obligations; security and privacy training on hire and periodically; access granted only after onboarding. |
| Physical security | Provided by our hosting provider, Hetzner Online GmbH, whose data centers maintain physical access controls, surveillance, and environmental protections. Data.co staff have no physical access to servers. |
| Incident response | A documented incident response process covering detection, containment, assessment, notification and post-incident review. |
| Data minimization and deletion | Collection limited to what the Services need; retention schedules enforced; secure deletion at the end of retention and on termination. |
General authorization, notice and objection.
5.1 General authorization. Customer gives Data.co general authorization to engage Subprocessors. The current list is published on our subprocessors page and forms Annex III of this DPA.
5.2 Subprocessor obligations. Data.co will engage each Subprocessor under a written contract imposing data protection obligations no less protective than this DPA, to the extent applicable to the services it provides, and remains responsible to Customer for each Subprocessor's performance of those obligations.
5.3 Notice of changes. Data.co will give Customer at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the subprocessors page and notifying Customers who have subscribed to updates through data.co/contact or, for Customers with a signed DPA, by email. In an emergency where a replacement is needed to maintain the Services, Data.co will give notice as soon as practicable.
5.4 Objection. Customer may object on reasonable data protection grounds within the 30-day notice period. The parties will discuss the objection in good faith. If Data.co cannot offer a reasonable alternative, such as avoiding use of the Subprocessor for Customer's data, Customer may terminate the affected Services by written notice and receive a refund of prepaid fees for the remainder of the term.
SCCs, UK Addendum and Swiss transfers.
6.1 Data.co may process Customer Personal Data in the EEA (Germany, Finland), the United States, and other locations where its Subprocessors operate, as listed in Annex III.
6.2 EEA transfers. Where Customer Personal Data is transferred from the EEA to a country without an adequacy decision, and no other valid transfer mechanism applies, the SCCs are incorporated into this DPA: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. For the SCCs: the optional docking clause in Clause 7 applies; under Clause 9, option 2 (general authorization) applies with the notice period in section 5.3; the optional language in Clause 11 does not apply; under Clause 17, the SCCs are governed by the law of Ireland; under Clause 18, disputes are resolved by the courts of Ireland; Annex I is section 9 of this DPA, Annex II is section 4, and Annex III is the subprocessors page.
6.3 UK transfers. For transfers from the United Kingdom, the UK Addendum is incorporated and amends the SCCs as it provides. Table 1 is completed with the parties' details in the Agreement; Table 2 with the modules and options in section 6.2; Table 3 with the annexes in this DPA; and in Table 4 either party may end the UK Addendum as set out in its Section 19.
6.4 Swiss transfers. For transfers from Switzerland, the SCCs apply with these amendments: references to the GDPR are read as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; references to "member state" include Switzerland so that data subjects in Switzerland can bring claims there.
6.5 Where a Subprocessor is certified under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework, the parties may rely on that certification instead. Data.co will cooperate with Customer on any transfer impact assessment Customer reasonably requires.
Data subject requests, breach notification, DPIAs and audits.
7.1 Data subject requests. Data.co provides tools in app.data.co for Customer to access, correct, export and delete Customer Personal Data. Taking into account the nature of the processing, Data.co will assist Customer by appropriate technical and organizational measures in responding to requests from data subjects to exercise their rights. If Data.co receives a request directly from a data subject that relates to Customer Personal Data, it will promptly forward it to Customer and will not respond other than to direct the data subject to Customer, unless the law requires otherwise.
7.2 Personal Data Breach notification. Data.co will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and mitigate its effects, and will name a contact point. Where information is not available at once, Data.co will provide it in phases without undue delay. Data.co will take reasonable steps to contain and remediate the breach and will cooperate with Customer's notifications to authorities and data subjects. Notice is not an acknowledgment of fault or liability.
7.3 Impact assessments and prior consultation. Taking into account the nature of the processing and the information available to it, Data.co will provide reasonable assistance to Customer with data protection impact assessments and any prior consultation with supervisory authorities that Data Protection Laws require, in relation to Customer's use of the Services.
7.4 Audits. Data.co will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA. Data.co will first respond to Customer's audit requests by providing written responses to reasonable security and privacy questionnaires, its security documentation, and any third-party audit reports it holds, subject to confidentiality. If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, Customer may conduct an on-site audit of Data.co's processing of Customer Personal Data, by itself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, during business hours, no more than once in any 12-month period (except following a Personal Data Breach or at a supervisory authority's direction), and in a manner that does not disrupt Data.co's operations or compromise other customers' data. Customer bears the cost of any on-site audit. Audits of Subprocessors' facilities are satisfied by the Subprocessors' own audit reports and certifications.
End of the Services, liability and healthcare data.
8.1 Return and deletion. During the 30-day export window described in the Terms of Service, Customer may export Customer Personal Data from app.data.co or ask Data.co to export it. Within 30 days after the end of the Services, Data.co will delete Customer Personal Data from its production systems, and it will expire from backups within a further 35 days, unless the law requires Data.co to keep it, in which case Data.co will protect it under this DPA and process it only for the purpose the law requires. On request, Data.co will certify the deletion in writing.
8.2 Liability. Each party's liability arising out of or relating to this DPA, including the SCCs to the extent the law permits, is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits a party's liability to data subjects under the SCCs where those limits cannot lawfully apply.
8.3 HIPAA. Data.co Control deployments keep protected health information ("PHI") in Customer's own infrastructure, and Data.co does not receive it. Customer will not submit PHI to app.data.co, the API or the MCP server. Where Customer engages Data.co for managed services that involve PHI, a Business Associate Agreement is available for those services where applicable, and it governs PHI to the extent it conflicts with this DPA.
8.4 Term. This DPA remains in effect for as long as Data.co processes Customer Personal Data, and ends automatically when Data.co has deleted all Customer Personal Data as described above.
Description of the processing.
| Item | Details |
|---|---|
| Parties | Data exporter: Customer, as identified in the Order (controller or processor). Data importer: Data.co (processor or subprocessor). Contact for both: as set out in the Agreement; Data.co via data.co/contact. |
| Subject matter | Providing app.data.co, the Data.co Marketplace, the REST API and MCP server, and any contracted support or managed services. |
| Duration | The term of the Agreement, plus the export and deletion periods in section 8. |
| Nature and purpose | Hosting, storage, retrieval, transmission, metering, security monitoring, support and deletion of Customer Personal Data as needed to provide the Services under the Agreement. |
| Frequency | Continuous, for the duration of the Services. |
| Categories of data subjects | Customer's Users (employees, contractors and agents with accounts); Customer's contacts named in support requests; individuals whose personal data Customer submits through the API, MCP server or managed services. |
| Categories of personal data | Names, business contact details, job titles; account and authentication data (hashed credentials, 2FA and passkey data, sessions, IP addresses, user agents); organization membership, roles and audit events; API key metadata and request logs; content of support requests; data Customer submits in API or MCP requests or under managed services. |
| Special categories | None, unless a managed-services Order specifies otherwise, together with any additional safeguards it describes. |
| Retention | As set out in section 8 and Data.co's Privacy Policy retention schedule; organization audit logs per Customer's retention setting. |
| Subprocessor transfers | As listed in Annex III, for the functions described there. |
| Competent supervisory authority | The authority determined under Clause 13 of the SCCs. |
Subprocessors and countersigned copies.
Annex III, list of Subprocessors, is incorporated by reference to the subprocessors page at data.co/subprocessors, as updated under section 5.
Parties: Data.co and the Customer identified in the Order. This DPA is effective on the date the Customer accepts the Agreement. To request a countersigned copy, contact us through data.co/contact.
Last updated: November 6, 2026.
Questions about these terms?
Contact us and we will route your question to the right person.