Data Processing Addendum
Our Data Processing Addendum is available on request.
It is signed under DocuSign / HelloSign, and supplements the Master Subscription Agreement on Professional, Enterprise, and Strategic tiers.
or write to security@thenervos.com
Coverage
What the Nervos DPA covers
- 01
Roles
Nervos as data processor, customer as data controller, sub-processor relationships listed in the sub-processor register.
- 02
EU/UK GDPR
SCCs (Module Two) and UK Addendum incorporated by reference for any cross-border transfer.
- 03
CCPA / CPRA
Service-provider terms with prohibition on selling or sharing customer data.
- 04
Security
Binding reference to the SOC 2 criteria mapping (no report issued), AES-256-GCM, and the audit-log integrity obligations described on the trust and security page.
- 05
Breach notification
Written notice within 72 hours of confirmed material incident affecting customer data.
- 06
Data subject rights
Assistance with access, rectification, erasure, and portability requests at no additional charge.
- 07
Return / deletion
Export available within 30 days of termination; complete deletion within 60 days unless extended by retention obligation.
Next
Read the controls the addendum refers to.
The security page documents what is implemented, what enforces each control, and where a control is still partial.