Nistor Cloud data processing agreement

Roles

The customer (for example, Acme Retail) is the controller of the personal data in its organisation; Nistor processes it on the customer’s instructions to run the service.

Subprocessors

Nistor uses the subprocessors listed on the subprocessors page and gives notice before adding one.

Security

Data is encrypted in transit and at rest on Google Cloud. Staff reach the service only through Google’s Identity-Aware Proxy with their company accounts, with the least access their role needs, and every console action is recorded in the audit log.

Personal data breaches

Nistor tells the customer without undue delay, and at the latest within 48 hours, after becoming aware of a breach of the customer’s personal data, with what is known and what is being done, so the customer can meet its own duties.

Audits

Nistor answers the customer’s reasonable questions about how it protects the data. Once a year, or after a breach, the customer can ask for an audit, on 30 days’ notice and at its own cost, by itself or an auditor bound to confidentiality.

Deletion and return

When the contract ends, Nistor returns the personal data on request within 30 days and then deletes it, except what the law requires it to keep, such as invoices.