Data Processing Agreement
This DPA forms part of the terms between the customer (controller) and Nostello OÜ (processor) and applies where Nostello processes personal data on the customer's behalf under GDPR Article 28.
1. Scope
| Item | Details |
|---|---|
| Subject matter | Licensing and operating SaveMailPDF |
| Data subjects | Customer's users of the add-in |
| Personal data | Microsoft object and tenant IDs, sign-in email (for invited seats), monthly PDF counts, hashed usage and error telemetry |
| Not processed | Email bodies, attachments, subjects, recipients: these are processed only within the customer's Microsoft 365 tenant, by Microsoft, at the user's instruction |
| Duration | The term of the subscription plus retention in the privacy policy |
2. Nostello's obligations
- Process only on documented instructions (these terms and the customer's use of the service).
- Ensure personnel are bound by confidentiality.
- Implement appropriate technical and organisational measures (Art. 32): encryption in transit, least-privilege access, access to admin tools behind Cloudflare Access with email verification, no storage of email content, automatic deletion of telemetry after 13 months.
- Use only the listed sub-processors, give 30 days' notice of changes, and bind them to equivalent obligations.
- Assist with data-subject requests, security, breach notification (without undue delay and within 48 hours of becoming aware), and DPIAs.
- Delete or return personal data at the end of the service, unless law requires storage.
- Make available information needed to demonstrate compliance and allow audits on reasonable notice.
3. Transfers
Transfers outside the EEA rely on the EU Standard Contractual Clauses (Module 3 where Nostello is processor) or the EU-US Data Privacy Framework where the recipient is certified.
4. Contact
Sheldon Halgreen, privacy officer, privacy@noscotek.co.za. Nostello OÜ, Ahtri Street 12, 15551 Tallinn, Estonia.