Data Processing Agreement
This DPA forms part of the terms between the customer (controller) and Nostello OÜ (processor) and applies where Nostello processes personal data on the customer's behalf under GDPR Article 28.
1. Scope
| Item | Details |
|---|---|
| Subject matter | Licensing and operating PrintCal |
| Data subjects | Customer's users of the add-in |
| Personal data | Microsoft object and tenant IDs, sign-in email (for invited seats), monthly PDF counts, hashed usage and error telemetry |
| Not processed | Calendar content: events, titles, times, places, attendees, notes, calendar names and the PDFs. These stay on the user's device. |
2. Nostello's obligations
- Process only on documented instructions (these terms and the customer's use of the service).
- Ensure personnel are bound by confidentiality.
- Implement appropriate technical and organisational measures (Art. 32): encryption in transit, least-privilege access, access to admin tools behind Cloudflare Access with email verification, no storage of calendar content, no request logging on the add-in's servers.
- Assist with data-subject requests and breach notification, and delete or return personal data at the end of the service.
- Allow reasonable audits on request.
3. Transfers
Transfers outside the EEA rely on the EU Standard Contractual Clauses (Module 3 where Nostello is processor) or the EU-US Data Privacy Framework where the recipient is certified.
4. Contact
Sheldon Halgreen, privacy officer, privacy@noscotek.co.za. Nostello OÜ, Ahtri Street 12, 15551 Tallinn, Estonia.