Data Processing Agreement
For organisations that need a written data processing agreement — hospitals usually do. This forms part of the Terms of Service where the GDPR or a similar law applies to you. If your procurement team needs it signed on paper, write to legal@nelkira.com and we will.
1. The unusual part, first
In most software agreements the supplier processes the customer’s data, and the agreement is about how. With Nelkira the honest position is narrower, and you should check it against your own assessment rather than take our word for it:
- Session content never reaches us. Screens, keystrokes, clipboard and files are encrypted between your machines. We are not a processor of any of it, because we do not receive it in a form anyone could read.
- The detailed session record stays on your machine. Where you use anNelkira account, we additionally hold a short history of which of your devices connected to which, when, for how long and how many bytes passed — metadata about your own estate, with no content of any kind.
- Where we process personal data for you at all, it is the connection data handled by a relay we operate: machine numbers, IP addresses, timings and byte counts. That is the subject of this agreement.
- If you run your own relay, we process nothing on your behalf, and this agreement has no work to do.
2. Roles
You are the controller. Nelkira Technology Ltd. is the processor, and processes personal data only on your documented instructions — which, unless we agree otherwise in writing, are these terms and your use of the service.
3. Subject matter and detail of the processing
| Subject matter | Introducing two machines to each other and carrying encrypted bytes between them. |
|---|---|
| Duration | For as long as you use a relay we operate, plus the retention period below. |
| Nature and purpose | Connection brokering, abuse prevention, and capacity planning. |
| Types of personal data | IP addresses, machine identifiers and names, operating system and software versions, connection times, durations and volumes. Account email addresses. |
| Categories of data subject | Your staff and contractors who use the software, and the people at the machines they connect to. |
| Special category data | None. We do not receive health data or any other special category data. |
4. Our obligations
We will:
- process personal data only on your instructions, unless the law requires otherwise, in which case we will tell you first where we are permitted to;
- make sure people authorised to process it are bound by confidentiality;
- keep appropriate technical and organisational measures, described in the Security Statement, which is deliberately honest about what is not yet done;
- help you respond to requests from individuals exercising their rights, so far as we can given how little we hold;
- help you with impact assessments and with consulting your regulator, on request;
- tell you without undue delay, and in any event within 48 hours, if we become aware of a personal data breach affecting your data, with what we know at the time;
- on request at the end of the agreement, delete or return the personal data we hold for you, unless the law makes us keep it;
- make available the information you reasonably need to show compliance, and allow audits as described below.
5. Sub-processors
You give general authorisation for us to use sub-processors. The current list, and what each does, is on the Sub-processors page. We will give at least 30 days’ notice before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve your objection you may stop using the relay service without penalty. We remain responsible for what our sub-processors do.
6. International transfers
Relays may sit in several countries, which is the point of putting one near your machines. Where personal data leaves the EEA or the UK we rely on the European Commission’s standard contractual clauses, or the UK addendum, which are incorporated into this agreement by reference and take precedence over it where they conflict.
7. Retention
Relay connection records are kept for 30 days and then deleted. Account details are kept until you close the account.
8. Audit
We will answer reasonable written questions about our processing, once a year or after a breach affecting you. Because a relay we operate cannot read session content, an audit of it is necessarily an audit of connection records and of the controls in the Security Statement, not of anything belonging to your patients.
9. Liability
The limits in the Terms of Service apply to this agreement, except where the GDPR makes a processor directly liable, in which case the law governs.
10. Priority
Where this agreement conflicts with the Terms of Service on the processing of personal data, this agreement wins.