Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (or any other agreement for NamiDB Cloud) between NamiDB, Inc. (“NamiDB”) and the Customer (together, the “Agreement”). It applies automatically, without signature, whenever NamiDB processes Customer Personal Data in providing the Service. A countersigned copy is available on request at info@namidb.com.

If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses conflict with this DPA or the Agreement, the Standard Contractual Clauses prevail.

Capitalised terms not defined here have the meaning given in the Agreement or in Applicable Data Protection Law.

“Applicable Data Protection Law”

all laws on the processing of personal data that apply to a party’s processing under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and its regulations, other U.S. state privacy laws, and Ecuador’s Ley Orgánica de Protección de Datos Personales (“LOPDP”) and its regulation.

“Customer Personal Data”

personal data within Customer Content that NamiDB processes on behalf of the Customer.

“Security Incident”

a breach of security of systems operated by or for NamiDB leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. It does not include unsuccessful attempts that do not compromise security, such as failed sign-ins, pings, port scans or blocked denial-of-service attacks.

“Subprocessor”

a third party that NamiDB engages to process Customer Personal Data.

“Standard Contractual Clauses” or “SCCs”

the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (official text).

“UK Addendum”

the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under s119A Data Protection Act 2018, version B1.0, in force 21 March 2022 (official text).

“Controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings in the GDPR; under the CCPA “controller” includes “business” and “processor” includes “service provider”; under the LOPDP they correspond to responsable and encargado del tratamiento.

For Customer Personal Data, the Customer is the controller and NamiDB is a processor. Where the Customer is itself a processor acting for its own customers, NamiDB is a subprocessor, the Customer warrants that its controller’s instructions, including the appointment of NamiDB, are authorised, and the Customer is the single point of contact for NamiDB.

NamiDB is an independent controller of Account Data (information about the Customer’s users, billing and support), which the Privacy Policy covers, and of Usage Data it uses for its own legitimate purposes as described in the Agreement. This DPA does not apply to that data.

The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, including having a legal basis, giving notices and obtaining consents required by Applicable Data Protection Law.

NamiDB will process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers, unless required to do otherwise by law to which NamiDB is subject; in that case NamiDB will inform the Customer before processing unless the law prohibits it on important grounds of public interest. The Customer instructs NamiDB to process Customer Personal Data to provide the Service under the Agreement, as initiated by the Customer and its users through the console, the API, Bolt and MCP endpoints and the Service’s configuration (including backups, restores and deletions), and as described in Annex I. The Agreement and this DPA are the Customer’s complete instructions at the time of agreement; further instructions require written agreement.

NamiDB will immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. NamiDB does not determine the content of Customer Personal Data, does not inspect it in the ordinary course and does not use it for any purpose of its own, including advertising or training machine-learning models.

NamiDB ensures that everyone it authorises to process Customer Personal Data is bound by written confidentiality obligations or a statutory duty of confidentiality, and limits access to the personnel who need it to operate, secure and support the Service.

NamiDB implements and maintains the technical and organisational measures in Annex II, designed to ensure a level of security appropriate to the risk (GDPR Art. 32; LOPDP Art. 37). NamiDB may update them, provided the update does not materially decrease the overall security of the Service.

The Customer is responsible for its use of the Service: protecting its credentials and API keys, choosing key roles, database scopes and expiry, managing its members, securing its own applications, and keeping its own copies of data it cannot afford to lose. Customer Content is not encrypted by NamiDB at the application level; if the Customer needs that, it encrypts data before storing it.

The Customer gives NamiDB general written authorisation to engage Subprocessors. The Subprocessors at the date of this DPA are listed in Annex III and on the Subprocessors page, and are authorised.

1. NamiDB imposes on each Subprocessor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, and remains fully liable to the Customer for each Subprocessor’s performance.
2. NamiDB will notify the Customer of any intended addition or replacement of a Subprocessor at least 30 days before the new Subprocessor processes Customer Personal Data, by updating the Subprocessors page and emailing everyone subscribed to subprocessor updates (subscribe by writing to info@namidb.com). In an emergency, such as replacing a Subprocessor that failed, NamiDB may give notice as soon as practicable instead.
3. The Customer may object on reasonable data protection grounds by email to info@namidb.com within the notice period. The parties will discuss the objection in good faith. If NamiDB cannot offer a reasonable alternative, the Customer may terminate the affected part of the Service by written notice before the change takes effect and receive a refund of prepaid fees for the unused period.

Taking into account the nature of the processing, NamiDB will assist the Customer by appropriate technical and organisational measures in responding to requests to exercise data subject rights. The Service lets the Customer query, export, correct and delete Customer Personal Data itself through its API and drivers. If NamiDB receives a request directly from a data subject concerning Customer Personal Data, it will not answer it (other than to refer the data subject to the Customer) and will forward it to the Customer promptly where the Customer can be identified.

NamiDB will notify the Customer of a Security Incident without undue delay and in any case within 48 hours after becoming aware of it, by email to the owners and admins of the affected organizations. The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point. Information not available at first will be provided in phases without further undue delay.

NamiDB will take reasonable steps to contain, investigate and mitigate the incident, and give the Customer the information it reasonably needs to meet its own obligations to notify supervisory authorities (within 72 hours under GDPR Art. 33; within five days to Ecuador’s Superintendencia under LOPDP Art. 43) and data subjects. Notifying a Security Incident is not an acknowledgement of fault or liability.

Taking into account the nature of the processing and the information available to it, NamiDB will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities (GDPR Arts. 35 and 36; LOPDP Art. 42) concerning the Service, primarily by making available this DPA, the Security page and the documentation.

NamiDB will make available to the Customer the information necessary to demonstrate compliance with this DPA and Article 28 GDPR, and will allow for and contribute to audits, including inspections, by the Customer or an independent auditor it mandates, as follows:

1. NamiDB will answer a reasonable written security and privacy questionnaire once in any twelve-month period, and provide relevant documentation of its controls, under confidentiality.
2. If that information is insufficient to demonstrate compliance, if a supervisory authority requires it, or after a Security Incident affecting the Customer, the Customer may conduct an audit on at least 30 days’ written notice, during business hours, once in any twelve-month period (except for an audit required by a supervisory authority), in a way that does not disrupt the Service or compromise other customers’ data. The auditor must not be a competitor of NamiDB and must sign a confidentiality agreement.
3. Each party bears its own costs, except that the Customer reimburses NamiDB’s reasonable costs for an audit beyond the information in (a) unless the audit reveals a material breach of this DPA by NamiDB.

Nothing in this section modifies the audit rights in the Standard Contractual Clauses.

NamiDB is established in the United States and operates the Service from Ecuador; its Subprocessors are listed in Annex III. Customer Content is stored in the storage location assigned to the organization when it is created. Operating the Service may involve access to Customer Personal Data from outside the EEA, the United Kingdom and Switzerland (for example when engines process queries, or during support you request), which this section covers.

EEA transfers: the Standard Contractual Clauses

To the extent the Customer (as data exporter) transfers Customer Personal Data subject to the GDPR to NamiDB (as data importer) in a country without an adequacy decision, the parties enter into the SCCs, which are incorporated into this DPA by reference, as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorisation) applies, with the notice period in the “Subprocessors” section of this DPA (30 days).
• Clause 11(a): the optional language on an independent dispute resolution body does not apply.
• Clause 13(a): the supervisory authority is the one determined by Clause 13 based on the Customer’s establishment, or its representative, in the EU; if the Customer has neither, the Irish Data Protection Commission.
• Clause 17: Option 1 applies; the SCCs are governed by the law of Ireland.
• Clause 18(b): disputes are resolved by the courts of Ireland.
• Annex I.A and I.B are completed by Annex I of this DPA, Annex I.C by the supervisory authority above, Annex II by Annex II of this DPA, and Annex III by Annex III of this DPA.
• The certification of deletion in Clause 8.5 and 16(d) is provided on the Customer’s written request. Audits under Clause 8.9 are carried out as described in “Information and audits”, to the extent consistent with the SCCs.

UK transfers: the UK Addendum

For Customer Personal Data subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated by reference. Table 1 is completed with the parties’ details in Annex I; Table 2 with the modules and options selected above; Table 3 with Annexes I to III of this DPA; and in Table 4 either party may end the UK Addendum as set out in its Section 19. The mandatory clauses of the UK Addendum apply.

Swiss transfers

For Customer Personal Data subject to the FADP, the SCCs apply with these adaptations: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; references to the GDPR are read as references to the FADP where it applies; “Member State” in Clause 18(c) includes Switzerland, so that data subjects habitually resident there can bring claims in their place of habitual residence; and the law and forum chosen above apply.

Transfers out of Ecuador

For Customer Personal Data subject to the LOPDP, this DPA, including the commitments in the SCCs (which NamiDB applies to that data as if it were subject to the GDPR), is the binding legal instrument providing adequate safeguards under LOPDP Article 57: a standard of protection equal to or higher than Ecuadorian law, the availability of administrative and judicial remedies, and the right to full redress.

Onward transfers and government access

NamiDB makes onward transfers to Subprocessors under the SCCs (Module Three), the UK Addendum, or the EU–U.S. Data Privacy Framework where the Subprocessor is certified under it. If NamiDB receives a legally binding request from a public authority for Customer Personal Data, it will notify the Customer promptly unless legally prohibited, review the request for legality, challenge it where there are reasonable grounds, and disclose the minimum required.

To the extent Customer Personal Data is “personal information” under the CCPA or similar U.S. state laws, NamiDB is a service provider (or processor) and processes it for the business purpose of providing, securing and supporting the Service as described in the Agreement. NamiDB will:

1. not sell or share it (as “sell” and “share” are defined in the CCPA);
2. not retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes specified in the Agreement, or outside the direct business relationship with the Customer, except as permitted by the CCPA;
3. not combine it with personal information received from or on behalf of others or collected itself, except as the CCPA permits;
4. comply with the CCPA and provide the same level of privacy protection the CCPA requires of businesses;
5. notify the Customer if it determines it can no longer meet its obligations under the CCPA;
6. allow the Customer to take reasonable and appropriate steps to ensure NamiDB uses it consistently with the Customer’s CCPA obligations (the audits section above), and, on notice, to stop and remediate unauthorised use;
7. assist the Customer in responding to consumer requests, as described in “Data subject requests”.

NamiDB certifies that it understands and will comply with these restrictions.

During the term the Customer can export Customer Personal Data at any time through the Service, including as a complete, portable copy of a database (JSON Lines files and a Cypher script) that the Service writes to the organization’s own storage and keeps available for download for 7 days. That export stays available while an organization is suspended and, for an organization the Customer deleted, until the end of its recovery period. When the Service ends for an organization other than by the Customer deleting it, NamiDB keeps the Customer Content available for export for 30 days and then deletes it, including its database backups and any encrypted off-site copies of them, within a further 30 days. An organization the Customer deletes is purged after a 30-day recovery period. This is the Customer’s choice of deletion for the purposes of GDPR Art. 28(3)(g), Clause 8.5 of the SCCs and LOPDP Art. 34, unless the Customer asks in writing for a return in a standard format before the period ends.

NamiDB may retain Customer Personal Data where the law requires, protected by this DPA and only for that purpose. NamiDB’s encrypted control-plane backups contain no Customer Content.

Each party’s liability arising out of this DPA is subject to the limitations of liability in the Agreement, except where such limitation is prohibited by Applicable Data Protection Law or the SCCs, including with respect to data subjects’ third-party-beneficiary rights under the SCCs.

This DPA stays in effect for as long as NamiDB processes Customer Personal Data. NamiDB may update it to reflect changes in law, the Service or its Subprocessors, with at least 30 days’ notice for changes that materially and adversely affect the Customer; no update will reduce the protection of Customer Personal Data or override the SCCs. This DPA is governed by the law that governs the Agreement, except for the SCCs, which are governed as stated above.

A. List of parties

B. Description of processing

C. Competent supervisory authority

As set out under “EEA transfers” (Clause 13); the UK Information Commissioner for the UK Addendum; the Swiss FDPIC for the FADP; the Superintendencia de Protección de Datos Personales for the LOPDP.

These are the measures NamiDB has implemented. The Security page describes them in more detail.

The Customer authorises the following Subprocessors of Customer Personal Data as of November 2, 2026. The current list is always at /legal/subprocessors.

Stripe and Resend process only Account Data, for which NamiDB is the controller; they never receive Customer Content and are listed on the Subprocessors page for completeness.