Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the agreement between MIAMI WEB AI (Nuko Nova Dynamics LLC) and the Client for the provision of services.
LAST UPDATED: DECEMBER 2024
DEFINITIONS
Key terms.
Personal Data
Any information relating to an identified or identifiable natural person as defined in GDPR Article 4(1).
Processing
Any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
Data Controller
The Client who determines the purposes and means of Processing Personal Data.
Data Processor
MIAMI WEB AI (Nuko Nova Dynamics LLC) who processes Personal Data on behalf of the Data Controller.
SCOPE
Processing boundaries.
The Processor shall process Personal Data only:
- On documented instructions from the Controller
- For the purpose of providing the agreed services
- In accordance with applicable data protection laws
- As required by applicable law (with prior notice where permitted)
SECURITY
Technical measures.
The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
Personal Data in transit and at rest
Controls limiting data access to authorized personnel
Regular testing and evaluation of security measures
Procedures for ongoing confidentiality, integrity, and availability
SUB-PROCESSORS
Authorized partners.
Vercel Inc.
Hosting and deployment
US
Supabase Inc.
Database services
US/EU
OpenAI LLC
AI processing
US
The Processor shall notify the Controller of any changes to sub-processors with at least 14 days' notice. The Controller may object to new sub-processors on reasonable grounds.
DATA SUBJECTS
Rights we support.
The Processor shall assist the Controller in responding to requests from data subjects exercising their rights under GDPR:
BREACH NOTIFICATION
24h
The Processor shall notify the Controller without undue delay (and in any event within 24 hours) after becoming aware of a Personal Data breach, including nature, scope, consequences, and remediation measures.
DATA DELETION
30d
Upon termination of services or upon request, the Processor shall delete all Personal Data within 30 days and provide written certification. Data may be retained longer only if required by applicable law.
INTERNATIONAL TRANSFERS
Cross-border data.
Personal Data may be transferred to and processed in the United States. For EU data subjects, such transfers are governed by Standard Contractual Clauses (SCCs) as adopted by the European Commission.
CONTACT
Request a signed copy.
For questions about this DPA or to request a signed copy, contact legal@miamiweb.ai