The data processing agreement, in plain language.

The client is the controller. You decide what personal data is collected through your site, why it is collected, and how long it is kept, and you answer to your regulator for it.

Nimos Websites is the processor — one person, in Kelowna, British Columbia. We process personal data only on your documented instruction, and for this service the instruction is: build the site, run it, answer what arrives through it, and keep the records the law requires us to keep.

Where you are in the EEA or the UK, the standard contractual clauses are attached to the signed agreement and the same terms apply. Where you are in the United States, the same terms apply and your state addendum can be attached — send it and we will read it.

The subject matter is a website: the forms on it, the portal behind it, and the records that keep both honest. The categories are contact details, whatever a visitor or a client writes into a form or a message, files that are uploaded, the record of what happened to a document, and payment metadata — amount, status, what it was for. Card numbers are not in that list because they never reach us.

The data subjects are your staff who use the portal and the people who contact you through the site. The nature of the processing is storage, retrieval, delivery by email, and the generation of a document to sign.

The duration is the engagement, and then the retention periods published on the security page — two years for enquiries, six years for contracts and payment records, and the life of the account for project data.

They are named on the subprocessor page, with the job each one does and the data category it touches. A vendor is added to that page before it handles client data, not after the fact.

A client who objects in writing gets one of two answers: an alternative that does not involve that vendor, or an exit from the affected part of the service. There is no third answer where the objection is noted and nothing changes.

The annex to the signed agreement is the measures listed on the security page: TLS in transit, private file storage served through the application, credentials sealed with AES-256-GCM, role-based portal access, two-factor available on every account, and a nightly database backup that is verified rather than assumed.

Two things are deliberately not in that annex, because they do not exist: a certification, and an independent audit. A measures annex that pads itself with either is a document that fails the first check.

Without undue delay. The clock starts when we become aware of a personal data breach, not when the investigation finishes.

The first notice says what happened, which data and whose, what has been done to contain it, what we recommend you do, and who to talk to. Later notices fill in what the first one could not — a first notice that waits for a complete picture is a notice that arrives after the deadline it was meant to serve.

You make the notification to your regulator and to the people affected, because the data and the relationship are yours. We give you what you need to make it, and we do not make it in your name without your instruction.

A near miss that turns out to be nothing is reported to you too, marked as a near miss. Silence about something that did not happen to be serious is the failure this clause exists to prevent.

Everyone who can see client data is bound to confidentiality, and the list is short: the person who runs the studio, and the vendors named on the subprocessor page under their own terms. There is no contractor with a database password and no support tier behind the studio.

At the end of the engagement you get the code, the content and the database. That is already yours once the invoice is paid; the handover checklist in the portal is how the accounts move into your name, and it is a documented transfer rather than a negotiation.

On a deletion request the erasure runs on the schedule described on the security page, and the receipt is in writing: what was erased, what was kept, why, and until when. Contracts, payment records and signed documents are kept for six years — that survives the deletion, and it is named in the receipt rather than discovered later.

You can ask for the written answers, the subprocessor list, and a description of the measures. The three pages linked below are the public half; the signed annex is the rest.

A client whose review needs more can ask for a remote walkthrough of the build — the accounts, the access, the records, screen-shared, with no credentials handed over and nothing installed on your side.

What is not available is an on-site audit or a certificate to file, because neither exists. If your review requires one, the honest answer is that this studio is the wrong vendor for that requirement, and it is better to hear it before signature than to find out afterwards.

The agreement runs for as long as we process data for you, and survives the end of the engagement for as long as records are kept. It is governed by the laws of British Columbia, Canada, and the liability terms in the main agreement apply to it.

For EEA and UK clients the standard contractual clauses are attached and prevail where they must. Nothing in this agreement reduces a right you have under the law that protects you.

Ask through the contact form with “DPA” in the first line. One reply, usually within a business day, with the document filled in for your business and the engagement it covers.

If your template is the one your review requires, send it and we will read it. That is the arrangement most business clients end up using, and it is the one that survives their legal team.