Nifty Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between Nifty Technologies, Inc. ("Nifty", "We") and the customer that has accepted the Terms ("Customer", "You"). It applies automatically, without a signature, wherever Nifty Processes Personal Data on Your behalf and that Processing is subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection. If You need a countersigned copy for Your records, see Signed copy below.

1. DEFINITIONS

Capitalised terms that are not defined here have the meaning given in the DATA PROTECTION section of the Terms. In this DPA:

Customer Personal Data: any personal data, as defined in Data Protection Legislation, that Nifty Processes on Your behalf in providing the Services, whether You are its Data Controller or a Data Processor acting for Your own controller.
Personal Data Breach: in this DPA, a personal data breach as defined in Data Protection Legislation that affects Customer Personal Data, whatever its cause.
EU SCCs: the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as revised from time to time under its Section 18.
Swiss FADP: the Swiss Federal Act on Data Protection of 25 September 2020.

2. ROLES AND INSTRUCTIONS

2.1 You are the Data Controller of Customer Personal Data, or a Data Processor acting for Your own controller, and Nifty is Your Data Processor. The subject matter, nature, purpose and duration of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex I.

2.2 Nifty Processes Customer Personal Data only on Your documented instructions, which are the Terms, this DPA and Your use of the Services' features, unless the law that applies to Nifty requires otherwise. In that case Nifty will tell You before Processing, unless that law prohibits it. Nifty will tell You if, in its opinion, an instruction infringes Data Protection Legislation.

2.3 You are responsible for having a lawful basis for the Personal Data You and Your Users put into the Services, and for giving Data Subjects the notices that Data Protection Legislation requires.

3. NIFTY'S OBLIGATIONS

3.1 Confidentiality. Nifty ensures that everyone it authorises to Process Customer Personal Data is bound by a duty of confidentiality.

3.2 Security. Nifty maintains the technical and organisational measures described in Annex II. Nifty may update those measures, provided the update does not reduce the overall level of protection.

3.3 Personal Data Breach. Nifty will notify You without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will give You the information reasonably available to it that You need to meet Your own reporting obligations.

3.4 Assistance. Taking into account the nature of the Processing, Nifty will reasonably assist You in responding to requests from Data Subjects, and with data protection impact assessments and consultations with a Supervisory Authority that relate to the Services. If a Data Subject contacts Nifty directly about Customer Personal Data, Nifty will refer the request to You.

3.5 Audits. Nifty will make available the information necessary to demonstrate its compliance with this DPA, and will allow for audits, as set out in the Audits clause of the DATA PROTECTION section of the Terms.

3.6 Deletion and return. You can export and delete Customer Personal Data using the Services, and when the Agreement ends the Consequences of termination clause of the Terms applies: at Your choice, Nifty deletes or returns Customer Personal Data and deletes existing copies. After a workspace or account is deleted, Nifty purges the associated Customer Personal Data from its servers within thirty (30) days, except where Nifty is required or permitted by law to retain certain records.

4. SUB-PROCESSORS

4.1 You give Nifty a general authorisation to engage Sub-processors. The current list is published at niftypm.com/subprocessors and forms Annex III of this DPA.

4.2 Nifty will update that page at least fourteen (14) days before a new or replacement Sub-processor begins Processing Customer Personal Data, and will email the change to every customer who has asked to be on the notification list described on that page.

4.3 You may object to a new or replacement Sub-processor on reasonable data protection grounds by emailing team@niftypm.com within that fourteen (14) day period. The parties will discuss the objection in good faith. If it cannot be resolved, You may stop using the Services and terminate Your subscription as provided in the Terms.

4.4 Nifty binds each Sub-processor by a written agreement that imposes data protection obligations no less protective than those in this DPA, and remains liable to You for each Sub-processor's performance.

5. INTERNATIONAL TRANSFERS

5.1 Where data is Processed. Nifty is established in the United States and hosts the Services there. You acknowledge that Customer Personal Data is transferred to, and Processed in, the United States by Nifty and its Sub-processors.

5.2 Transfers from the EEA. Where the transfer of Customer Personal Data from You to Nifty is subject to the GDPR, the EU SCCs are incorporated into this DPA by reference and apply between You as "data exporter" and Nifty as "data importer", completed as follows:

• Module Two (controller to processor) applies where You are a Data Controller. Module Three (processor to processor) applies where You are a Data Processor acting for Your own controller.
• Clause 7 (docking clause) does not apply.
• Clause 9(a): Option 2 (general written authorisation) applies, and the notice period is the one in section 4.2 of this DPA.
• Clause 11(a): the optional language does not apply.
• Clause 17: Option 1 applies, and the EU SCCs are governed by the law of Ireland.
• Clause 18(b): disputes are resolved before the courts of Ireland.
• Annex I, Annex II and Annex III of the EU SCCs are Annex I, Annex II and Annex III of this DPA.

5.3 Transfers from the United Kingdom. Where the transfer is subject to the UK GDPR, the EU SCCs as completed in section 5.2 apply as amended by the UK Addendum, which is incorporated into this DPA by reference. The tables in Part 1 of the UK Addendum are completed as follows:

• Table 1: the parties, their details and their key contacts are those in Annex I. The start date is the date this DPA takes effect between the parties.
• Table 2: the Addendum EU SCCs are the EU SCCs as completed in section 5.2, including the modules and options selected there.
• Table 3: the Appendix Information is set out in Annex I, Annex II and Annex III of this DPA.
• Table 4: neither party may end the UK Addendum under its Section 19.

5.4 Transfers from Switzerland. Where the transfer is subject to the Swiss FADP, the EU SCCs as completed in section 5.2 apply with these changes: references to the GDPR are read as including the Swiss FADP; the Federal Data Protection and Information Commissioner is the competent supervisory authority; "Member State" is not read so as to stop Data Subjects in Switzerland from suing for their rights in their place of habitual residence; and the EU SCCs are governed by Swiss law to the extent the transfer is subject only to the Swiss FADP.

5.5 Deemed signature. By accepting the Terms, each party is deemed to have signed the EU SCCs and the UK Addendum, including their annexes and tables, on the date this DPA takes effect between the parties.

5.6 Onward transfers. Nifty transfers Customer Personal Data to a Sub-processor only in accordance with the EU SCCs and, where it applies, the UK Addendum.

6. GENERAL

6.1 Order of precedence. If there is a conflict on a data protection matter, the EU SCCs (as amended by the UK Addendum, where it applies) prevail over this DPA, and this DPA prevails over the rest of the Terms.

6.2 Liability. Each party's liability under this DPA is subject to the limitations of liability in the Terms. Nothing in this DPA or the Terms limits either party's liability to Data Subjects under the EU SCCs or the UK Addendum, or any other liability that the EU SCCs or the UK Addendum do not allow the parties to limit.

6.3 Term. This DPA applies for as long as Nifty Processes Customer Personal Data.

6.4 Changes. Nifty may update this DPA where a change in Data Protection Legislation, or a change to the EU SCCs or the UK Addendum by the authority that issues them, requires it. Nifty will post the updated DPA on this page with a new effective date.

ANNEX I: DESCRIPTION OF THE PROCESSING

A. List of parties

	Data exporter	Data importer
Name	The Customer that has accepted the Terms	Nifty Technologies, Inc.
Address	The address associated with the Customer's Nifty account	315 W 36th St, New York, NY 10018, United States
Contact	The owner of the Customer's Nifty workspace, at the email address on the account	Joyti Balaggan, Data Privacy Officer, joy@niftypm.com
Role	Controller, or processor acting for its own controller	Processor
Activities relevant to the transfer	Use of the Services	Provision of the Services

B. Description of the transfer

Categories of Data Subjects	The Customer's Users (workspace members and guests), and any other individuals whose Personal Data the Customer or its Users put into the Services.
Categories of Personal Data	Name, email address, optional phone number and profile photo; workspace content that the Customer and its Users create or upload (tasks, messages, documents, files and comments) to the extent it contains Personal Data; and usage and log data such as IP address and user identifiers.
Sensitive data	The Services are not designed for special categories of Personal Data, and Nifty does not ask for any. Whether any is put into the Services is decided by the Customer.
Frequency of the transfer	Continuous, for as long as the Customer uses the Services.
Nature and purpose of the Processing	Hosting, storing, transmitting and displaying Customer Personal Data in order to provide, secure and support the Services under the Terms.
Retention	For as long as the Customer's account is active, then purged within thirty (30) days of workspace or account deletion, except where Nifty is required or permitted by law to retain certain records.
Transfers to Sub-processors	As listed in Annex III, for the purposes stated there, and for no longer than the retention period above.

C. Competent supervisory authority

The supervisory authority determined in accordance with Clause 13 of the EU SCCs. For transfers subject to the UK GDPR it is the UK Information Commissioner, and for transfers subject to the Swiss FADP it is the Federal Data Protection and Information Commissioner.

ANNEX II: TECHNICAL AND ORGANISATIONAL MEASURES

• Hosting. The Services are hosted on Amazon Web Services in the United States.
• Encryption. Data is encrypted in transit between Your device and Nifty using TLS, and at rest on Nifty's servers and in backups.
• Access control. Access to workspace content is governed by workspace roles and per-project permissions. Single sign-on and two-factor authentication are available.
• Independent assurance. Nifty's controls are independently audited for SOC 2, and Nifty is certified to ISO 27001:2022.
• Testing. Nifty runs automated security testing and engages independent third parties for vulnerability assessment and penetration testing.
• Monitoring. Nifty monitors the security, performance and availability of the Services.
• Backups. Backups are taken daily and stored separately from the primary systems.

More detail is on our Security page.

ANNEX III: SUB-PROCESSORS

The Sub-processors Nifty engages, with the purpose, the data Processed and the location of each, are listed at niftypm.com/subprocessors.

SIGNED COPY

This DPA is binding without a signature. If You need a countersigned copy, or have a question about it, contact our Data Privacy Officer at joy@niftypm.com or email team@niftypm.com. Nifty is located at 315 W 36th St, New York, NY 10018.