Data Processing Agreement
Last updated 21 October 2026
This Data Processing Agreement ("DPA") is part of the agreement between UnboundIQ Solutions - FZCO, trading as NodeVista ("NodeVista", the "processor"), and the organisation that uses NodeVista (the "customer", the "controller") under our Terms of Service. It applies whenever NodeVista processes personal data on the customer's behalf, and is written to meet Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws. Accepting the Terms of Service accepts this DPA; no signature is needed. If the customer needs a signed copy, write to support@nodevista.com.
- Definitions
- Roles and scope
- Instructions
- Confidentiality
- Security
- Sub-processors
- Data subjects' requests
- Personal data breaches
- Assessments and authorities
- International transfers
- Return and deletion
- Audits
- General
- Annex 1: the processing
- Annex 2: security measures
- Annex 3: sub-processors
1. Definitions
"Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Data protection law" means the GDPR, the UK GDPR and the UK Data Protection Act 2018, and any other data protection law that applies to the processing. "Customer personal data" means personal data in the customer's data that NodeVista processes for the customer under the agreement.
2. Roles and scope
- The customer is the controller of customer personal data and NodeVista is its processor. Where the customer is itself a processor for someone else, NodeVista is its sub-processor and the customer confirms its own controller has authorised this.
- NodeVista is a controller, not a processor, for the account details of members who sign in, and for what it needs to run, secure and bill the service. That is covered by our privacy policy.
- The subject matter, duration, nature and purpose of the processing, and the kinds of personal data and data subjects, are set out in Annex 1.
- The customer is responsible for having a lawful basis for the customer personal data it puts into NodeVista and for the notices and consents data protection law requires.
3. Instructions
NodeVista processes customer personal data only on the customer's documented instructions, which are this DPA, the Terms of Service, and what the customer's admins and members do in the service (for example importing contacts, connecting a mailbox, turning on an AI feature or sending a campaign). NodeVista will tell the customer if it believes an instruction breaks data protection law, and need not follow it. If the law requires NodeVista to process customer personal data otherwise, it will tell the customer first unless the law forbids it.
4. Confidentiality
NodeVista makes sure everyone it authorises to process customer personal data is bound to keep it confidential, and gives them access only as far as their work needs.
5. Security
NodeVista keeps in place the technical and organisational measures in Annex 2, appropriate to the risk of the processing. It may update them, but never in a way that lowers the overall level of protection.
6. Sub-processors
- The customer authorises NodeVista to use the sub-processors listed in Annex 3, and to engage others under this section.
- NodeVista binds each sub-processor by a written contract to data protection obligations no less protective than this DPA, and remains responsible to the customer for its sub-processors' performance.
- NodeVista will tell the customer's admins of a new or replacement sub-processor at least 30 days before it starts processing customer personal data, by email and by updating this page. The customer may object on reasonable data protection grounds within that time; if we cannot address the objection, the customer may end the agreement for the affected service without penalty.
- Services the customer connects itself (such as its own Google or Microsoft account, Stripe account or Twilio account) are not NodeVista's sub-processors; the customer's own agreement with them governs them.
7. Data subjects' requests
NodeVista lets the customer find, correct, export and delete customer personal data in the service itself. If a data subject contacts NodeVista about customer personal data, NodeVista will point them to the customer and will not answer the request itself unless the customer asks it to. Where the customer cannot handle a request through the service, NodeVista will help as far as it reasonably can.
8. Personal data breaches
NodeVista will tell the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. It will give what it knows of the nature of the breach, the data and data subjects concerned, its likely consequences and the measures taken or proposed, adding to this as more becomes known, and will take reasonable steps to contain and remedy it. Telling the customer is not an admission of fault.
9. Assessments and authorities
Taking into account the nature of the processing and the information it has, NodeVista will give the customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities about the service.
10. International transfers
- NodeVista is established in the United Arab Emirates, and some sub-processors are in the United States or elsewhere outside the European Economic Area and the United Kingdom.
- Where customer personal data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree to the European Commission's standard contractual clauses (Decision 2021/914): module two (controller to processor), or module three (processor to processor) where the customer is a processor, which are incorporated into this DPA by reference. Clause 7 (docking) applies; in clause 9 option 2 applies, with the notice period in section 6; the option in clause 11 does not apply; clauses 17 and 18 are governed by the law and courts of Ireland; and the annexes are completed by Annexes 1 to 3 of this DPA.
- For data subject to the UK GDPR, the UK International Data Transfer Addendum to those clauses applies as well, with either party able to end it as allowed by its section 19.
- NodeVista makes onward transfers to its sub-processors under the standard contractual clauses, or another safeguard recognised by data protection law (such as the EU-US Data Privacy Framework where a sub-processor is certified).
11. Return and deletion
The customer can export its data at any time while the agreement lasts and for 30 days after it ends. After that NodeVista deletes customer personal data within 90 days, including from backups as they expire, unless the law requires it to keep some of it, in which case it keeps it confidential and processes it only for that purpose.
12. Audits
NodeVista will make available the information reasonably needed to show it meets this DPA, including answers to security questionnaires and its sub-processors' certifications. Where that is not enough, or a supervisory authority requires it, the customer may audit NodeVista once a year, at its own cost, with at least 30 days' notice, during business hours, through an independent auditor bound to confidentiality, and without access to other customers' data.
13. General
- This DPA lasts as long as NodeVista processes customer personal data.
- If this DPA and the Terms of Service conflict, this DPA prevails on data protection; if the standard contractual clauses conflict with either, the clauses prevail.
- Each party's liability under this DPA is subject to the limits in the Terms of Service, except where data protection law or the standard contractual clauses do not allow it to be limited.
- NodeVista may update this DPA as data protection law or the service changes, telling the customer's admins of material changes at least 30 days ahead; a change will not lower the protection it gives customer personal data.
Annex 1: the processing
- Parties
- Data exporter (controller): the customer, as identified in its NodeVista account. Data importer (processor): UnboundIQ Solutions - FZCO, trading as NodeVista, Dubai, United Arab Emirates, support@nodevista.com.
- Subject matter and duration
- Providing the NodeVista service to the customer, for as long as the agreement lasts and until the data is deleted under section 11.
- Nature and purpose
- Hosting, storing, organising, showing, searching, analysing, transmitting and deleting customer personal data, to provide the service's features: CRM and proposals, marketing and social posts, product analytics, customer support and the in-app widget, AI agents and assistants, calling and transcription, scheduling and calendars, team chat, files, and finance (invoicing, subscriptions and payments).
- Data subjects
- The customer's members and staff; its customers, prospects and their contacts; the end users of the customer's own app who use its widget or are tracked by its SDK; partners, suppliers and other people the customer records or contacts.
- Categories of personal data
- Names, job titles and company; contact details (email, phone, address); messages, emails, tickets, notes and comments; call recordings and transcripts; meeting recordings, notes and summaries; files, images and videos; product usage and analytics events, device and browser information and IP addresses of the customer's end users; survey and form answers; billing and invoice details (card details are handled by the payment provider, not stored by NodeVista); and any other personal data the customer chooses to put in.
- Special categories
- None are needed for the service. The customer should not put special category data into NodeVista unless it has a lawful basis and appropriate safeguards; if it does, the measures in Annex 2 apply.
- Frequency
- Continuous, while the customer uses the service.
- Retention
- As the customer decides while using the service, then deletion under section 11.
- Supervisory authority
- The authority of the EU member state where the customer is established, or, if it is not, where its EU representative is; for UK data, the Information Commissioner's Office.
Annex 2: security measures
Separation and access
- Each organisation's data is kept in its own database schema, separate from every other organisation's.
- Inside an organisation, access is checked twice: by the application's permission checks for each module, and by the database's own row-level security. Changes go through the checked API only.
- Members sign in through a managed authentication service; passwords are never stored in plain text. Admins control each member's access and can remove it at once.
- NodeVista staff access production systems only when needed to run or support the service, through individual accounts with multi-factor authentication.
Encryption
- All traffic is encrypted in transit with TLS.
- Databases, backups and stored files are encrypted at rest.
- Credentials for services the customer connects (tokens and keys) are encrypted before they are stored.
- Files are kept in private storage and shared through short-lived signed links.
Resilience and recovery
- The service runs on managed cloud infrastructure with automatic failover.
- Databases are backed up daily, with point-in-time recovery.
Secure development and operation
- Code is reviewed, and automated tests, type checks and linting run before every release.
- Secrets are kept out of source code. Errors are monitored, with personal data kept out of error reports as far as possible.
- Requests that fetch outside addresses are limited to public addresses, so the service cannot be turned against its own network.
- Public endpoints are rate-limited.
Incidents and suppliers
- Security incidents are handled under a response process, with notice as in section 8.
- Sub-processors are chosen for their security and bound by data protection terms; AI providers do not train their models on data sent through their APIs.
Annex 3: sub-processors
NodeVista uses these sub-processors to provide the service. Some are used only when the customer turns on the feature that needs them.
| Sub-processor | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | Data region chosen for the service; company in the USA |
| Vercel | Hosting of the web app and API | USA, with a global edge network |
| OpenAI | AI features: Dia, beans and agents, writing, summaries, transcription | USA |
| Google (Gemini) | AI features: images, video and understanding media | USA and global |
| BytePlus | AI video generation | Singapore |
| Twilio | Phone calls and recordings, when calling is used | USA |
| Resend | Sending email | USA |
| Expo and Google Firebase | Push notifications to the phone app | USA |
| Stripe | Payments for NodeVista's own billing | USA and Ireland |
| Sentry | Error monitoring | USA |
| Apify | Reading competitors' public social pages, when turned on | Czech Republic and USA |
Changes to this list are announced as described in section 6. To be told by email, make sure your organisation's admins' addresses are up to date.