Data processing addendum reference

Controller instructions stay with the tenant owner.

Where data-protection law treats a tenant owner as controller and the Nici operator as processor, the service agreement incorporates the data processing terms summarized here.

• Processing is limited to operating Nici on the tenant owner's documented instructions.
• Personnel with access are bound to confidentiality and access is minimized and logged.
• Subprocessors are limited to infrastructure and model providers required by enabled features.
• Technical measures include tenant isolation, encrypted secrets, audit records, and export.
• The operator assists with deletion, export, incident information, and requests where applicable.

The tenant owner can request the current executed DPA and subprocessors through the support channel supplied with the tenant. This reference does not replace a signed DPA where one is required for the relationship.