nova8 Data Processing Addendum

1.1 Categories of Personal Data and Roles. (a) Account Data comprises names, business-contact details, credentials, and account, billing, and security records used to administer accounts, authenticate users, bill, and secure and operate the Services. NOVA8 processes Account Data as an independent controller for those purposes, as described at https://nova8.io/privacy. (b) Customer Content comprises data that Customer or its Devices submit through the Services, including device identifiers, entitlement-validation requests, telemetry, configuration, fleet-operations data, and support submissions. To the extent Customer Content contains personal data, NOVA8 processes it as Customer’s processor (or subprocessor) on Customer’s documented instructions. Sections 2 through 6 govern processing on Customer’s behalf, not NOVA8’s independent-controller processing of Account Data.

1.2 Data Minimization. The Services are designed for device, fleet, and operational management and are not intended as a repository for personal data. Customer shall not submit special categories of personal data, protected health information, payment card data, or other high-risk regulated data as Customer Content, and shall minimize the personal data contained in Customer Content.

1.3 Subject Matter and Details. The subject matter is the processing of Customer Content to provide, secure, and support the Services, including collection, storage, retrieval, transmission, and deletion. Processing continues for the Agreement term and the return or deletion period under Section 2.1. Data subjects are Customer’s personnel, contractors, and other individuals whose identifiers or business-contact information Customer includes in operational or support data. Personal-data types are those in Section 1.1; Customer controls submissions and remains responsible for the lawful instructions and rights of the controller.

2.1 To the extent NOVA8 processes personal data on Customer’s behalf, NOVA8 shall: (a) process it only on Customer’s documented instructions, including regarding transfers, unless required by applicable law, and notify Customer of that requirement before processing unless prohibited by law; (b) ensure authorized persons are bound by confidentiality; (c) implement technical and organizational measures appropriate to the risk and applicable data protection law; (d) assist Customer, taking into account the nature of processing and information available, with data-subject requests, security, breach notification, data protection impact assessments, and prior consultation with regulators; and (e) at Customer’s choice, return or delete personal data at the end of the Services and delete existing copies, unless retention is required by law. Retained data remains protected under this DPA and may be processed only for the legally required retention purpose. Assistance may be charged at reasonable, agreed rates, except to remedy NOVA8’s breach; charges shall not prevent assistance required by law.

2.2 Compliance Information and Audits. NOVA8 shall make available information necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by Customer or its mandated independent auditor. The Parties will coordinate reasonable notice, scope, confidentiality, and safeguards for other customers’ data; these arrangements shall not prevent an audit required by law or a regulator. NOVA8 shall promptly inform Customer if, in its opinion, an instruction infringes applicable data protection law.

3.1 Customer is responsible for the lawfulness of the personal data and instructions it submits, including required notices, consents, or other lawful bases. The prohibitions and data-minimization requirements in Section 1.2 apply to all Customer Content. An exception requires a separately executed agreement expressly modifying those prohibitions in this DPA, Cloud Terms Section 4.2, and the AUP and establishing the safeguards required for the specified data; informal permission does not create an exception.

4.1 Customer grants general written authorization for subprocessors subject to this Section. DigitalOcean, LLC provides Cloud Platform hosting in the United States. NOVA8 shall provide the current list of all subprocessors that process Customer Content, their functions, and processing locations before processing begins and on request. NOVA8 shall impose the same applicable data protection obligations by written contract and remains responsible for subprocessor performance.

4.2 Changes and Objections. NOVA8 shall notify Customer’s designated account contact at least thirty (30) days before adding or replacing a subprocessor that processes Customer Content. Customer may object during that period on reasonable data protection grounds. The Parties shall seek a resolution, and NOVA8 shall not disclose the affected personal data to the proposed subprocessor while the objection is unresolved. If no reasonable alternative is available, Customer may terminate the affected Services before the change and receive a pro rata refund of unused, prepaid fees for those Services, without duplicate recovery under the Agreement.

5.1 NOVA8 shall maintain the security measures described in the Agreement and Section 2.1. NOVA8 shall notify Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on Customer’s behalf, and in any event within seventy-two (72) hours of awareness. Notice shall not be delayed pending completion of an investigation. NOVA8 shall provide reasonably available information about the nature of the breach, affected data and individuals, likely consequences, mitigation measures, and a contact for further information, with updates as information becomes available. Notification is not an acknowledgment of fault or liability.

6.1 The Cloud Platform is hosted in the United States. Each Party is responsible for its obligations under applicable international-transfer laws. Before a transfer requiring additional safeguards begins, the Parties shall document and implement a valid transfer mechanism and any required assessment and supplementary measures. Where standard contractual clauses are used, the Parties must complete the applicable modules, options, annexes, and any required UK or other jurisdictional addendum. This DPA does not itself execute or complete those instruments. Customer shall not initiate, and NOVA8 shall not carry out, such a transfer until the required safeguards are in place; a transfer must be suspended if the safeguards cease to be valid.

7.1 Each Party’s liability to the other under this DPA is subject to the Agreement’s limitations and exclusions to the extent permitted by applicable law. Nothing in this DPA limits data subjects’ statutory rights, regulators’ powers, or liability that cannot lawfully be limited, or overrides a mandatory term of an applicable transfer instrument. This DPA is governed by Wyoming law except where mandatory data protection law or an applicable transfer instrument requires otherwise. In a conflict concerning personal-data processing, applicable mandatory transfer terms control, followed by this DPA, then the Agreement.