Data Processing Agreement

This DPA forms part of the terms between the customer (controller) and Nostello OÜ (processor) and applies where Nostello processes personal data on the customer's behalf under GDPR Article 28.

Item	Details
Subject matter	Licensing and operating Accessmith
Data subjects	The customer's users of the add-in
Personal data	Microsoft object and tenant IDs, sign-in email (invited seats), monthly fix counts, Team rules and audit records, hashed usage and error telemetry
Not processed	Document content (text, pictures, alt text, links, titles, file names) and exported reports, which are processed in the add-in and not sent to Nostello (Microsoft hosts the files under the customer's own agreement)

Nostello's obligations

Process only on documented instructions (these terms and the customer's use of the service).
Bind personnel to confidentiality.
Apply appropriate measures (Art. 32): encryption in transit, least-privilege access, admin tools behind Cloudflare Access, no storage of document content, no request logging.
Use only the sub-processors listed on the sub-processors page, with 30 days' notice of changes.
Assist with data-subject requests and notify personal-data breaches without undue delay; delete or return data at the end of the service.
Allow reasonable audits on request.

Transfers

Transfers outside the EEA rely on the EU Standard Contractual Clauses (Module 3 where Nostello is processor) or the EU-US Data Privacy Framework where the recipient is certified.

Privacy contact for Nostello OÜ: Sheldon Halgreen, privacy@noscotek.co.za. Nostello OÜ, Ahtri Street 12, 15551 Tallinn, Estonia.

Accessmith by Nostello. Nostello OÜ, Ahtri Street 12, 15551 Tallinn, Estonia.