Data Processing Agreement

This Data Processing Agreement (“DPA”) is part of the agreement between nappi and each business that uses nappi for business (the “customer”). That agreement is made up of our Terms of Service (the “Terms”) and this DPA. It explains how nappi handles personal data on the customer’s behalf. It is written to meet Article 28 of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, and it also applies where another data protection law requires a similar agreement.

1. Who this agreement is between

The customer is the business, organization or independent professional that holds a nappi for business workspace, for example a sleep consultancy. The person who creates the workspace accepts this DPA for the customer and confirms they are allowed to do so.

“nappi”, “we” and “us” mean the provider of nappi and nappi for business. Contact details for both parties are in Annex I.

2. Who is responsible for what

Workspace data: nappi is the customer’s processor

Workspace data is the personal data the customer puts into its workspace or creates there: its seats (the names and email addresses of the people it adds), its notes, plans and private memos, the custom field definitions it sets up, its program settings, and the messages, photos and voice notes it sends to families. The customer decides why and how this data is used, so it is the controller (or a processor, where it works for another organization). nappi processes workspace data only to provide nappi for business to the customer, as its processor.

Plans and messages the customer sends to a family are shown to that family in the nappi app, and a plan can shape the schedule the app shows them. Delivering them is part of the service the customer asks us to provide.

Family data: shared by the family, received by the customer as an independent controller

Families track in their own nappi account. A family’s data reaches the customer only after an adult in the family accepts the customer’s invite, and the family can stop sharing at any time. For the family’s account and the data in it, nappi is the controller toward the family, under our Privacy Policy. When the customer views and uses shared family data for its own services, it does so as a separate, independent controller, responsible for its own use. The same applies to messages a family sends the customer and to the values a family records in the customer’s custom fields. The processor terms of this DPA do not cover shared family data.

The customer needs its own lawful basis for using shared family data, and its own agreements with its clients, such as its service terms and a privacy notice that tells families how it uses what they share. As the Terms already say, the customer uses what families share only to support those families.

Account information: nappi is a controller

nappi also keeps some information about the customer as its own customer: sign-in details, billing records, support emails and how the workspace is used. We use it to run, secure, bill and improve the service, as a controller, under our Privacy Policy.

3. What nappi processes, and for how long

Annex I describes the processing: its subject matter, nature and purpose, the types of personal data, and the people it relates to.

This DPA lasts as long as nappi processes workspace data for the customer, which is as long as the customer has a workspace, on any plan, including Free. Section 10 covers what happens when a workspace closes.

4. nappi’s commitments

• Instructions. We process workspace data only on the customer’s documented instructions. The Terms, this DPA, and the customer’s use and settings of its workspace are those instructions. If the law requires us to process it in another way, we will tell the customer first, unless the law forbids that. If we think an instruction breaks data protection law, we will say so.
• No selling. We do not sell workspace data or use it for advertising.
• Confidentiality. Everyone at nappi who can access workspace data is bound by confidentiality, and gets access only when their work needs it.
• Security. We protect workspace data with the measures in Annex II. We may update them over time, but not in a way that lowers the overall protection.
• Subprocessors. We use other companies only as described in Section 6.
• Help with requests and assessments. We help the customer answer requests from individuals (Section 8). Where the customer carries out a data protection impact assessment or consults a supervisory authority about its use of nappi, we help with the information we reasonably have.
• Breaches. We notify the customer of a personal data breach as described in Section 9.
• Deletion or return. We delete or return workspace data at the end, as described in Section 10.
• Information and audits. We show that we meet this DPA as described in Section 11.

5. The customer’s commitments

• Have a lawful basis for its workspace data and for its use of shared family data, and give its staff and clients the information the law requires.
• Have its own agreements with its clients, and use shared family data only to provide its services to those families.
• Give lawful instructions, and enter only the data its work needs. Notes, plans and messages may hold health information about a baby or a parent. The customer decides whether to record it, and needs a valid condition under Article 9 of the GDPR, or the equivalent rule in its own law, where that applies.
• Keep its logins private, add only people who work with it, and remove a seat when that person leaves.

6. Subprocessors

The customer authorizes nappi to use the subprocessors listed in Annex III. Each one is bound by a written contract with data protection obligations that protect workspace data at least as well as this DPA, as suited to the service it provides. nappi stays responsible to the customer for its subprocessors’ work.

Before we add or replace a subprocessor that will process workspace data, we will email the workspace owner and update Annex III at least 30 days in advance. Within those 30 days the customer can object, on reasonable data protection grounds, by writing to [email protected]. We will then work in good faith on a solution, for example not using that subprocessor for the customer’s data. If we cannot find one, the customer may cancel its paid plan or close its workspace before the change takes effect.

7. Transfers outside the EEA and the UK

nappi operates from the United States. Workspace data is stored and processed in the United States and in the other places listed in Annex III. Where the customer is in the European Economic Area (“EEA”) or the United Kingdom, these safeguards apply to transfers to nappi:

• EEA. The Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 (the “SCCs”) are incorporated into this DPA by reference: Module 2 (controller to processor), and Module 3 (processor to processor) where the customer is itself a processor. The customer is the data exporter and nappi is the data importer. For the choices the SCCs leave open: Clause 7 does not apply; under Clause 9(a), Option 2 (general written authorization) applies, with the notice period in Section 6; the optional wording in Clause 11(a) does not apply; under Clause 13, the supervisory authority is the one that is competent for the customer; under Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; under Clause 18, disputes go to the courts of Ireland. Annexes I, II and III of this DPA complete Annexes I, II and III of the SCCs.
• United Kingdom. The International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) is incorporated by reference. Its Tables 1 to 3 are completed with the details in this DPA and the SCC choices above. For Table 4, either party may end the Addendum as its Section 19 allows.
• Data Privacy Framework. Where a subprocessor in the United States is certified under the EU-US Data Privacy Framework and its UK Extension, transfers to that subprocessor may also rely on that certification. Otherwise, transfers from nappi to its subprocessors rely on the SCCs or another safeguard the law accepts.

8. Requests from individuals

The customer can handle most requests about workspace data itself, in its workspace: for example by correcting or deleting its notes, or removing a seat. If someone asks nappi directly about workspace data, we pass the request to the customer without undue delay and do not answer it ourselves unless the customer asks us to or the law requires it. Where the customer cannot handle a request on its own, for example an export or a deletion it cannot reach, we help.

Families manage their own data in their nappi account and can stop sharing with the customer at any time. Requests about a family’s own account come to nappi as its controller.

9. Personal data breaches

If we become aware of a personal data breach affecting workspace data, we will notify the customer without undue delay, and in any case within 72 hours of becoming aware of it, by email to the workspace owner. We will tell the customer what we know: what happened, the types and approximate number of people and records involved, the likely consequences, what we have done and will do about it, and who to contact. If we do not have all of this at first, we will send it as we learn it. We will help the customer meet its own duties to notify supervisory authorities and the people affected. Notifying the customer of a breach is not an admission of fault.

10. When a workspace closes

The customer can close its workspace at any time by emailing [email protected] from the owner’s address, and we may close it as the Terms allow. Cancelling or downgrading a paid plan does not close the workspace: it moves to the Free plan, and this DPA continues.

Before closing, the customer can ask for a copy of its workspace data in a common machine-readable format. Within 30 days after a workspace closes, we delete its workspace data, unless the law requires us to keep some of it. Anything we must keep stays confidential and is used only for that legal purpose. Copies in backups are never restored for any other purpose and expire on their own schedule: our database provider’s daily backups after 7 days, and our encrypted off-site backups after about a month.

Closing a workspace never deletes a family’s own nappi account or its tracking data.

11. Information and audits

We make available the information reasonably needed to show that we meet this DPA and Article 28 of the GDPR, such as answers to a reasonable security questionnaire and summaries of the security reports our subprocessors publish or let us share. nappi does not currently hold a third-party security certification of its own.

If that information is not enough, or a supervisory authority requires it, the customer, or an independent auditor bound by confidentiality, may audit nappi’s processing of workspace data. Unless a breach or a supervisory authority makes it necessary sooner, this happens at most once a year, with at least 30 days’ notice, at the customer’s cost, during business hours, and in a way that does not disrupt the service or expose other customers’ data.

12. Liability

Each party’s liability under this DPA is subject to the limits in the Terms, as far as the law allows. Nothing in this DPA limits a party’s liability to individuals under the SCCs, or under data protection law where that liability cannot be limited.

13. Which document wins, and changes

This DPA forms part of the Terms. If the Terms and this DPA conflict about the processing of personal data, this DPA wins. If this DPA conflicts with the SCCs or the UK Addendum, they win.

We may update this DPA, for example when the law or the service changes. If a change reduces the protection it gives workspace data, we will email the workspace owner at least 30 days before it applies. The date at the top shows the current version.

14. Governing law

This DPA is governed by the same law as the Terms, and disputes about it are resolved where the Terms say. The SCCs and the UK Addendum are governed by the law and courts set out in Section 7.

15. How to accept this DPA

There is nothing to sign. This DPA forms part of the agreement between nappi and the customer as soon as the customer uses nappi for business, and it covers all of the customer’s seats. If the customer needs a signed copy for its records, it can email [email protected] and we will send a countersigned PDF.

16. Contact

Questions about this DPA, or about privacy at nappi for business: John Peebles, founder, [email protected].

Annex I: Details of the processing

Annex II: Security measures

Annex III: Subprocessors

These companies may process workspace data for nappi. Some also process account information for nappi’s own purposes, which our Privacy Policy covers.