Data Processing Agreement
Last updated:
Parties and roles
This agreement applies between you as controller and Sascha Buhle, trading as nerl0, Straßburger Straße 9k, 10405 Berlin, Germany, as processor. For personal data that appears in the platforms you connect, you decide the purposes and means and nerl0 processes the data on your instructions.
Subject and duration
nerl0 reads configuration and permission data from your connected platforms in order to show which AI agents and non-human identities can reach which data. Processing lasts as long as your contract with nerl0.
What is processed
Metadata about identities, roles, keys, grants, bots and the relationships between them. This can include names and work email addresses of people who own or approved an identity. nerl0 does not read the contents of your data stores. Affected people are your employees, contractors and other users of the connected platforms.
Instructions
nerl0 processes personal data only on your documented instructions, which are given by your configuration of connectors and scans, unless the law requires otherwise. If an instruction appears to break data protection law, nerl0 tells you.
Hosting
The workspace is hosted in the EU. Each customer works in a separate workspace.
Technical and organisational measures
Connections are read-only. Access to a workspace is limited by roles: Owner, Admin, Security Analyst, Auditor and Read only. Workspaces are separated from each other. Observations are kept for 90 days and decision evidence for one year.
Confidentiality
Everyone who works with customer data at nerl0 is bound to confidentiality.
Sub-processors
nerl0 uses sub-processors only to run the service. The current list is available on request at [email protected]. nerl0 tells you before it adds or replaces a sub-processor, and you may object for good reason.
Your rights and support
nerl0 helps you answer requests from affected people, carry out data protection impact assessments and report data breaches. nerl0 tells you without undue delay if it becomes aware of a personal data breach.
Deletion and return
When the contract ends, nerl0 exports your data on request and deletes it afterwards, unless the law requires it to be kept.
Audits
nerl0 provides the information needed to show compliance with Art. 28 GDPR and allows audits by you or an auditor you name, after reasonable notice.
Signed copy
To receive this agreement for signature, write to [email protected].