Name: Nozle
Brand: Nozle

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Agreement between Pullse, Inc. ("Processor") and Customer ("Controller"). It applies whenever nozle processes Personal Data on behalf of Customer in the course of providing the Service.

2. Definitions

"Personal Data", "Processing", "Data Subject", "Controller", and "Processor" have the meanings given in the GDPR. "Sub-processor" means any third party engaged by nozle to process Personal Data.

3. Processing instructions

nozle processes Personal Data only on documented instructions from Customer, including with regard to international transfers. The Agreement, this DPA, and Customer's use of the Service together constitute Customer's complete instructions.

4. Confidentiality

All nozle personnel with access to Personal Data are bound by written confidentiality obligations that survive termination of employment.

5. Security measures

nozle implements the technical and organisational measures described in Annex II, including encryption in transit and at rest, role-based access control, audit logging, and vulnerability management.

6. Sub-processors

Customer authorises nozle to engage Sub-processors. nozle will give Customer 30 days' notice before engaging a new Sub-processor. Customer may object on reasonable grounds; nozle will work in good faith to resolve, failing which Customer may terminate the affected service.

7. Data subject rights

nozle will assist Customer in responding to Data Subject requests within reasonable timeframes, taking into account the nature of the Processing.

8. Personal data breach

nozle will notify Customer without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data breach affecting Customer Data, providing the information reasonably necessary for Customer to meet its own breach notification obligations.

9. International transfers

Where Personal Data is transferred outside the EEA, UK, or Switzerland, the parties agree to incorporate the EU Standard Contractual Clauses (2021) and, where applicable, the UK IDTA. Transfer mechanisms are detailed in Annex III.

10. Audits

nozle will make available all information necessary to demonstrate compliance with this DPA. On reasonable notice and no more than once per year, Customer may audit nozle's compliance, subject to confidentiality obligations.

11. Return or deletion

On termination of the Agreement, nozle will, at Customer's choice, return or delete all Personal Data within 30 days, unless retention is required by law.

12. Liability

Each party's liability under this DPA is subject to the limitations of liability set out in the Agreement.

Annex I — Description of processing

Subject matter: provision of the Service. Duration: term of the Agreement plus deletion period. Nature and purpose: as described in our Privacy Policy. Categories of data subjects: Customer's employees, end users, and customers. Categories of personal data: account, usage, billing, and metered event data.

Annex II — Security measures

TLS 1.3 in transit; AES-256 at rest; least-privilege IAM; SSO + MFA mandatory; quarterly penetration tests; 24/7 security monitoring; documented incident response plan.

Annex III — Transfer mechanisms

EU-to-US: EU SCCs (Module 2). UK-to-US: UK IDTA. Switzerland-to-US: Swiss FDPIC-approved SCCs.

A countersigned copy of this DPA is available on request — email legal@nozle.dev. This online version is a placeholder pending counsel review.

← Back to nozle.dev