Nimbli Data Processing Agreement

• Roles: the Customer is the controller of Customer Personal Data, and Nimbli is the processor.
• "Customer Personal Data" means personal data in the Customer's team content:
  • the names and email addresses of people in the team, and of people it invites;
  • any personal data in the team's link destinations, short link names and notes;
  • the team's activity history.
• Visitor data: Nimbli keeps no personal data about people who click the Customer's links, only anonymous counts. Its server's access log holds their IP addresses for up to 14 days, for security (see the Privacy Policy).
• Account data: Nimbli is the controller of account sign-in data, safety records and security logs, as described in the Privacy Policy.

• Nimbli processes Customer Personal Data only to provide the Service as described in the Terms, and on the Customer's documented instructions. The Customer's use of the Service's features counts as those instructions.
• Nimbli will tell the Customer if it believes an instruction breaks data protection law.

Only people who run Nimbli can access Customer Personal Data, and only as needed. They are bound by confidentiality.

Nimbli keeps appropriate technical and organisational measures, including:

• encryption in transit (HTTPS);
• encrypted backups kept for 30 days;
• API tokens stored in a form that can't be read back;
• access limited to the people who run Nimbli;
• rate limits and abuse protection;
• hosting with established providers.

• The Customer authorises the sub-processors listed on the Sub-processors page.
• Nimbli will post any new sub-processor there at least 30 days before it starts processing Customer Personal Data, where reasonably possible. The Customer may object by email within that time; if the objection can't be resolved, the Customer may stop using the Service.
• Nimbli uses its sub-processors on their standard data processing terms, which require them to protect the data.

• Rights requests: Nimbli will help the Customer answer requests from people exercising their rights. Much of this is self-service: CSV export, removing team members and deleting links.
• Assessments: Nimbli will help with data protection impact assessments where reasonably needed.

Nimbli will tell the Customer without undue delay after confirming a breach that affects Customer Personal Data. The notice will include what Nimbli knows about the breach and what it is doing about it.

• Location: Customer Personal Data is stored in the United States.
• Transfers from the UK, EEA or Switzerland: the parties rely on the EU-US Data Privacy Framework where the sub-processor is certified under it, and otherwise on the Standard Contractual Clauses (module 2, controller to processor) and the UK International Data Transfer Addendum, with the details of processing below as their annex, or another valid mechanism.

When the Customer deletes its team, or this DPA ends, Nimbli deletes Customer Personal Data within 30 days, except what the Privacy Policy says is kept for a set time. Backups expire within a further 30 days. Two things are kept:

• Short codes and names: the short codes and short link names of deleted links are kept without their destination, so they are never reused.
• Safety records: records of deleted links that were flagged or disabled are kept for one year for safety reviews, as the Privacy Policy describes.

Nimbli will answer the Customer's reasonable written questions about its compliance with this DPA, once a year or after a breach.

• Term: this DPA lasts as long as Nimbli processes Customer Personal Data.
• Precedence: if it conflicts with the Terms, this DPA wins for matters of data protection.