noevika

Data Processing Addendum

Standard terms · version 2026-11 · Security page · Privacy Policy · Terms

How to use this page. This is Noevika's standard DPA. It applies automatically to every Teams and Enterprise customer as part of the Terms, so most customers need nothing more. If your procurement process needs a signed copy, your own template, or the EU Standard Contractual Clauses / UK Addendum executed, email security@noevika.com; we return signed documents within five business days.

1. Parties and roles

This Addendum forms part of the agreement between the customer identified in the team account ("Customer", the controller) and Noevika ("Noevika", the processor) for the Noevika service (the "Service"). Where Customer acts as a processor for its own clients (for example a managed service provider), Noevika acts as a sub-processor and Customer warrants it has the authority to instruct Noevika on its clients' behalf.

2. Subject matter and duration

Noevika processes personal data to provide third-party breach monitoring: maintaining Customer's team account, the organisations and vendors Customer chooses to monitor, delivering alerts and reports to Customer's team members, and keeping the records needed to demonstrate consent and operate the Service securely. Processing lasts for the term of the agreement and the deletion period in section 9.

3. Categories of data and data subjects

4. Instructions

Noevika processes personal data only on Customer's documented instructions, which are: the Terms, this Addendum, and the configuration Customer's administrators make in the Service. Noevika will inform Customer if, in its opinion, an instruction infringes applicable data-protection law.

5. Confidentiality and personnel

Access to production systems is limited to personnel who need it to operate the Service, bound by confidentiality obligations. Administrative actions that reveal personal data require a fresh authentication within the preceding hour and are recorded in an audit log with the stated reason.

6. Security measures (Article 32)

7. Sub-processors

Customer authorises the sub-processors listed on the Security page (currently Amazon Web Services, Cloudflare, GitHub, and — only where a user chooses that sign-in method — Google or Microsoft). Noevika will update that page at least 30 days before adding a sub-processor that processes personal data; Customer may object on reasonable data-protection grounds within that period, in which case the parties will discuss in good faith and Customer may terminate the affected part of the Service if no resolution is found. Noevika remains responsible for its sub-processors' performance.

8. Assistance

Taking into account the nature of the processing, Noevika will assist Customer with data-subject requests (access, rectification, erasure, portability, objection) — most of which Customer's administrators can fulfil directly in the Service — and with data-protection impact assessments and consultations with supervisory authorities, to the extent the information is available to Noevika.

9. Deletion and return

Customer can export the vendor list, reports and audit log as CSV at any time. On deletion of the team by its owner, or on termination, Noevika deletes the team's data; individual members' accounts are deleted at their own request from Preferences. Deletion completes within 24 hours, excluding backups which expire within 35 days and are not restored except for disaster recovery, and excluding records Noevika must keep to demonstrate consent or comply with law.

10. Personal data breach

Noevika will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer's data, with the information reasonably available at the time and updates as the investigation proceeds. Notification goes to the team owner's and administrators' email addresses and to any security contact Customer has provided.

11. Audit

Noevika will make available the information reasonably necessary to demonstrate compliance with this Addendum — this page, the Security page, completed questionnaires, and (when available) third-party audit reports — and will allow audits by Customer or an independent auditor mandated by Customer, no more than once per year unless required by a supervisory authority or following a breach, on 30 days' notice, during business hours, at Customer's cost, and subject to confidentiality.

12. International transfers

The Service is hosted in the United States. Where Customer transfers personal data from the EEA, Switzerland or the United Kingdom, the parties enter into the EU Standard Contractual Clauses (Decision 2021/914, Module 2 or Module 3 as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference and will be executed on request. Noevika will apply the supplementary measures described in section 6.

13. US state privacy laws

Where the CCPA/CPRA or similar US state laws apply, Noevika acts as a service provider / processor: it does not sell or share personal data, does not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, does not combine it with data from other sources except as permitted, and will notify Customer if it can no longer meet these obligations.

14. Liability and precedence

Each party's liability under this Addendum is subject to the limitations in the Terms. In case of conflict, this Addendum prevails over the Terms with respect to the processing of personal data, and the Standard Contractual Clauses prevail over this Addendum.

15. Contact

Data protection and security: security@noevika.com · Privacy requests: privacy@noevika.com · Commercial: hello@noevika.com.

This standard Addendum is provided to make procurement faster; it is not legal advice to either party. Customers with their own paper should send it to the address above.