This Data Processing Addendum (“DPA”) forms part of the Netblinks Terms of Service, an Order, master services agreement or other written agreement governing Customer's use of the Netblinks Services (the “Agreement”).
This DPA is entered into between Netblinks LLC, Austin, Texas, United States (“Netblinks”), and the Customer identified in the Agreement (“Customer”).
This DPA applies when Netblinks processes Customer Personal Data on Customer's behalf in connection with the Services.
1. Definitions
For purposes of this DPA:
“Applicable Data Protection Law” means privacy and data-protection laws applicable to the processing of Customer Personal Data under the Agreement.
“Customer Data” has the meaning given in the Agreement.
“Customer Personal Data” means Personal Data contained in Customer Data that Netblinks processes on Customer's behalf.
“Data Subject” means an identified or identifiable individual to whom Personal Data relates.
“Personal Data” means information defined as personal data, personal information or an equivalent concept under Applicable Data Protection Law.
“Process,” “Processing,” “Controller,” “Processor,” “Business,” “Service Provider,” “Sell,” and “Share” have the meanings provided by Applicable Data Protection Law where applicable.
“Security Incident” means unauthorized access to, acquisition of, disclosure of, alteration of or destruction of Customer Personal Data in Netblinks' possession or control that constitutes a personal-data breach under Applicable Data Protection Law.
Security Incident does not include unsuccessful attempts or activities that do not compromise Customer Personal Data, such as unsuccessful login attempts, network scans, blocked attacks or denied access attempts.
“Subprocessor” means a third party engaged by Netblinks to process Customer Personal Data on behalf of Customer.
2. Roles of the Parties
Customer is the Controller, Business or equivalent entity responsible for determining the purposes and means of processing Customer Personal Data.
Netblinks is the Processor, Service Provider or equivalent entity processing Customer Personal Data on Customer's behalf.
If Customer itself acts as a Processor for another Controller, Netblinks acts as Customer's Subprocessor.
Each party will comply with the obligations applicable to it under Applicable Data Protection Law.
3. Customer Instructions
Netblinks will process Customer Personal Data only:
- to provide the Services;
- as documented in the Agreement;
- as instructed through Customer's lawful use and configuration of the Services;
- as otherwise documented by Customer and accepted by Netblinks; or
- as required by applicable law.
The Agreement and Customer's use of the Services constitute Customer's documented processing instructions.
If Netblinks is legally required to process Customer Personal Data contrary to Customer's instructions, Netblinks will notify Customer before processing unless the applicable law prohibits notice.
If Netblinks reasonably believes a Customer instruction violates Applicable Data Protection Law, Netblinks may notify Customer and suspend the affected processing while the parties address the issue.
4. Customer Responsibilities
Customer is responsible for:
- determining that its processing is lawful;
- establishing an appropriate legal basis;
- providing required privacy notices;
- obtaining required consents where applicable;
- ensuring that Customer Personal Data may lawfully be provided to Netblinks;
- determining whether particular categories of information should be processed through the Services;
- responding to Data Subjects as Controller;
- configuring access permissions appropriately;
- maintaining appropriate source-system controls; and
- complying with laws applicable to Customer's own processing.
Customer will not instruct Netblinks to process Personal Data in violation of applicable law.
5. Nature and Purpose of Processing
Netblinks processes Customer Personal Data solely as necessary to provide the functionality selected and used by Customer.
Processing may include:
- receiving;
- hosting;
- storing;
- organizing;
- retrieving;
- querying;
- transmitting;
- displaying;
- analyzing;
- transforming;
- embedding;
- indexing;
- generating SQL;
- generating analytics;
- generating AI-assisted responses;
- creating visualizations;
- maintaining application state;
- troubleshooting;
- securing; and
- deleting information.
The business purpose is to provide, maintain, secure and support the Netblinks Services in accordance with the Agreement.
Further details appear in Annex I.
6. Duration of Processing
Netblinks may process Customer Personal Data for the duration of the Agreement and thereafter only:
- during an applicable post-termination retention period;
- within backups awaiting normal rotation;
- as necessary to comply with law;
- to establish, exercise or defend legal claims; or
- as otherwise permitted by this DPA.
Netblinks will not retain Customer Personal Data indefinitely merely because it once processed the information.
7. Confidentiality
Netblinks will ensure that personnel authorized to process Customer Personal Data:
- are subject to confidentiality obligations;
- receive access only where reasonably necessary for their role; and
- process Customer Personal Data only in accordance with this DPA and documented instructions.
8. Security Measures
Netblinks will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful:
- destruction;
- loss;
- alteration;
- unauthorized disclosure; or
- unauthorized access.
Measures will be appropriate to the nature of the Services, risks of processing and available technology.
Current categories of controls are described in Annex II.
Customer acknowledges that security practices evolve and Netblinks may update its safeguards, provided that such updates do not materially reduce the overall level of protection during an active subscription.
9. Access Controls and Customer Credentials
Netblinks will use reasonable measures designed to restrict internal access to Customer Personal Data to personnel and systems requiring access for legitimate business purposes.
Customer remains responsible for:
- its account configuration;
- Authorized Users;
- Customer-controlled credentials;
- database permissions;
- BYOK credentials;
- source systems;
- Customer networks; and
- Customer's decision to provide particular information to the Services.
10. Subprocessors
Customer generally authorizes Netblinks to engage Subprocessors to provide the Services.
Netblinks will require each Subprocessor that processes Customer Personal Data to be subject to data-protection obligations appropriate to the processing and no less protective in material respects than Netblinks' relevant obligations under this DPA.
Netblinks remains responsible for its obligations concerning Subprocessor processing to the extent required by Applicable Data Protection Law.
10.1 Subprocessor List
Netblinks will maintain information about material Subprocessors through the provider page below, the applicable Order, or another written notice to Customer:
https://www.netblinks.com/legal/subprocessors
Customer may request additional information about the current list at support@netblinks.com.
10.2 New Subprocessors
Where required by Applicable Data Protection Law, Netblinks will provide reasonable notice before a new Subprocessor begins processing Customer Personal Data.
Customer may object on reasonable data-protection grounds by notifying Netblinks within the period stated in the notice.
The parties will work in good faith to address a valid objection.
If no commercially reasonable alternative is available, either party may terminate only the affected Service, and Netblinks' liability for such termination will be limited to any prepaid fees for the unused portion of that affected Service where a refund is required under the Agreement.
11. Artificial Intelligence Providers
Depending upon Customer's configuration, Customer Personal Data may be processed by an AI or model provider to perform requested AI-assisted functionality.
11.1 BYOK
Where Customer elects BYOK and supplies its own credentials for an AI provider, Customer independently selects that provider and maintains its contractual relationship with it.
To the extent Netblinks merely facilitates Customer's instructed transmission to that provider, Customer is responsible for reviewing the provider's terms and determining whether the provider is appropriate for Customer's processing.
Where Applicable Data Protection Law requires Netblinks to treat the provider as a Subprocessor notwithstanding Customer's direct contractual relationship, the parties will cooperate in good faith to satisfy the applicable requirement.
11.2 Managed AI
Where Netblinks provides Managed AI, any third-party AI provider processing Customer Personal Data on behalf of Netblinks will be treated as a Subprocessor where required by Applicable Data Protection Law.
12. No Sale of Customer Personal Data
Netblinks will not sell Customer Personal Data for monetary consideration.
Where Netblinks acts as a Service Provider or Contractor under applicable U.S. state privacy law, Netblinks will not:
- sell Customer Personal Data;
- share Customer Personal Data for cross-context behavioral advertising;
- retain, use or disclose Customer Personal Data outside the business purposes specified in the Agreement except as permitted by applicable law; or
- combine Customer Personal Data with personal information received from another person where such combination is prohibited by applicable law.
This Section does not prohibit disclosures to approved Subprocessors necessary to provide the Services.
13. Data Subject Requests
Taking into account the nature of the processing, Netblinks will provide reasonable assistance to Customer in responding to legally valid Data Subject requests where Customer cannot reasonably fulfill the request without Netblinks' assistance.
If Netblinks receives a request directly from a Data Subject concerning Customer Personal Data, Netblinks may:
- direct the individual to Customer;
- notify Customer; or
- take another action permitted by applicable law.
Unless legally required, Netblinks will not independently respond substantively to a request concerning Customer Personal Data without Customer authorization.
Customer remains responsible for determining whether and how to fulfill the request.
14. Regulatory Assistance
Taking into account the nature of processing and information available to Netblinks, Netblinks will provide reasonable assistance where required by Applicable Data Protection Law concerning:
- data-protection impact assessments;
- prior consultations with regulators;
- legally required security information; and
- Customer's compliance with processor-related obligations.
If assistance requires substantial resources beyond ordinary Service functionality, the parties may agree upon reasonable fees unless Applicable Data Protection Law requires Netblinks to provide the assistance without charge.
15. Security Incidents
Netblinks will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data where notification is required by Applicable Data Protection Law.
Notification may be delivered to Customer's administrative, security or other designated contact.
To the extent reasonably available, the notification will include information concerning:
- the nature of the Security Incident;
- categories of affected information;
- known or reasonably estimated scope;
- measures taken or proposed to address the incident; and
- contact information for follow-up.
Information may be provided in phases as the investigation develops.
Netblinks' notification of a Security Incident is not an admission of fault or liability.
Customer is responsible for determining whether Customer must notify:
- Data Subjects;
- regulators;
- customers;
- employees; or
- other persons.
Netblinks will reasonably cooperate with Customer's legally required response.
16. Audit Information
Upon reasonable written request and subject to appropriate confidentiality protections, Netblinks will make available information reasonably necessary to demonstrate compliance with this DPA.
Netblinks may satisfy audit obligations by providing available:
- security documentation;
- policies;
- questionnaires;
- third-party assessments;
- certifications; or
- other relevant evidence.
If Applicable Data Protection Law requires an additional audit that cannot reasonably be satisfied through existing documentation, Customer may request one subject to the following conditions:
- reasonable advance notice;
- no more than once annually unless a Security Incident or regulator requires otherwise;
- during normal business hours;
- without unreasonable disruption;
- without access to other customers' information;
- subject to confidentiality and security controls; and
- at Customer's expense unless the audit identifies a material breach by Netblinks.
An auditor must be independent and not a competitor of Netblinks.
Nothing in this Section requires Netblinks to disclose:
- another customer's information;
- privileged material;
- trade secrets unrelated to compliance;
- information that would create a security risk; or
- information prohibited from disclosure by law or contract.
17. Return and Deletion
At expiration or termination of the Services, Netblinks will delete or return Customer Personal Data in accordance with the Agreement and Customer's available export functionality, unless applicable law requires retention.
Customer should export information it requires before access ends.
Deletion from active systems may not immediately remove information from backup systems.
Residual backup copies may remain until overwritten or deleted according to normal backup rotation, provided they remain protected and are not restored except for legitimate recovery purposes.
If applicable law prevents deletion, Netblinks will isolate and protect the retained information and process it only for the legally required purpose.
18. International Data Transfers
Customer authorizes processing of Customer Personal Data in the United States and other countries where Netblinks or approved Subprocessors operate, subject to the safeguards required by Applicable Data Protection Law.
18.1 EEA Transfers
Where:
- Customer Personal Data is subject to the GDPR;
- Netblinks receives that Personal Data in a country not recognized as providing an adequate level of protection; and
- no other lawful transfer mechanism applies,
the parties incorporate the European Commission Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“EU SCCs”).
For a Controller-to-Processor transfer, Module Two applies.
For a Processor-to-Processor transfer, Module Three applies.
The EU SCCs are incorporated into this DPA to the extent required for the relevant Restricted Transfer.
For purposes of the EU SCCs:
- the optional docking clause in Clause 7 applies;
- Option 2 of Clause 9 applies where relevant;
- the advance notice period for a new Subprocessor is the period provided under Section 10 of this DPA;
- the optional language in Clause 11 does not apply unless required by law;
- the governing law for Clause 17 will be the law of an EU Member State that permits third-party beneficiary rights under the SCCs, selected as legally appropriate for the Customer's transfer;
- the courts for Clause 18 will be those corresponding to the selected Clause 17 law;
- Annex I of this DPA supplies the relevant Annex I information;
- Annex II of this DPA supplies the technical and organizational measures; and
- Netblinks' then-current Subprocessor list supplies Annex III where required.
Nothing in the Agreement modifies the EU SCCs in a manner that reduces Data Subject protections.
18.2 United Kingdom Transfers
Where Customer Personal Data is subject to UK Data Protection Law and a Restricted Transfer requires an Article 46 safeguard, the parties incorporate the then-current International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office (“UK Addendum”), unless another lawful transfer mechanism applies.
The information contained in the Agreement, this DPA, Annex I, Annex II and the applicable Subprocessor list will populate the relevant tables of the UK Addendum to the extent permitted.
If the ICO issues a replacement or mandatory revised version, the parties will apply the legally required version from its required effective date.
18.3 Switzerland and Other Jurisdictions
Where Swiss or another applicable law requires specific contractual safeguards, the EU SCCs will apply with modifications necessary to reflect the mandatory terminology and supervisory authority required by the applicable law, to the extent legally permitted.
Where another valid transfer mechanism applies, the parties may rely on that mechanism instead.
19. Government and Law-Enforcement Requests
Where legally permitted, Netblinks will:
- evaluate legally binding governmental demands for Customer Personal Data;
- disclose only information required by a valid legal process;
- attempt to notify Customer before disclosure unless prohibited; and
- where reasonably appropriate, challenge demands that Netblinks reasonably believes are unlawful or overbroad.
Nothing in this Section requires Netblinks to violate applicable law.
20. Processing Records and Compliance
Netblinks will maintain processor records required by Applicable Data Protection Law to the extent applicable to Netblinks.
Netblinks will cooperate with legally authorized regulators as required by law.
21. Liability
The limitations and exclusions of liability in the Agreement apply to this DPA except to the extent Applicable Data Protection Law or the EU SCCs prohibit applying those limitations to a particular liability.
The parties intend that claims arising from this DPA and the Agreement will not create duplicative liability caps.
Nothing in this DPA restricts rights granted directly to Data Subjects under mandatory Standard Contractual Clauses.
22. Conflict
If this DPA conflicts with the Agreement concerning processing of Customer Personal Data, this DPA controls.
If this DPA conflicts with the EU SCCs or UK Addendum for a Restricted Transfer governed by those instruments, the mandatory terms of the applicable transfer instrument control.
23. Changes Required by Law
Netblinks may update this DPA where reasonably necessary to:
- comply with changes in Applicable Data Protection Law;
- implement new legally recognized transfer mechanisms;
- update regulatory terminology;
- reflect changes in Subprocessors or security practices; or
- correct administrative or technical matters.
Netblinks will not materially reduce Customer's legally required data-protection rights during an active subscription through such an update.
24. Governing Law
Except where the EU SCCs, UK Addendum or other mandatory Data Protection Law requires otherwise, this DPA is governed by the governing-law provision in the Agreement.
25. Contact
Privacy and data-protection inquiries:
Legal inquiries:
Netblinks LLC Austin, Texas, United States
Appendix A. Details of Processing
A. Parties
Data Exporter / Customer
The Customer identified in the applicable Agreement or Order.
Role:
Controller or Processor, as applicable.
Data Importer / Processor
Netblinks LLC Austin, Texas, United States
Role:
Processor or Subprocessor, as applicable.
B. Categories of Data Subjects
Depending upon Customer's use of the Services, Customer Personal Data may concern:
- Customer employees;
- Customer contractors;
- Customer administrators;
- Customer users;
- Customer's own customers;
- prospective customers;
- suppliers;
- business contacts;
- database users;
- employees of third parties;
- other individuals whose information Customer lawfully stores or processes in a connected database or other Customer Data.
Netblinks does not independently determine which individuals Customer places in connected data sources.
C. Categories of Personal Data
Depending upon Customer's data, processing may include:
- names;
- business contact information;
- email addresses;
- telephone numbers;
- employment or organizational information;
- customer identifiers;
- transaction or business information;
- database records;
- prompts and questions;
- query results;
- database metadata;
- IP addresses;
- application and technical identifiers;
- other Personal Data contained in a Customer-selected database, document, prompt or query result.
D. Sensitive or Special-Category Data
Netblinks does not require Customer to provide sensitive or special-category Personal Data to use ordinary platform functionality.
Customer must determine whether such data is appropriate to process through the Services.
If Customer chooses to process:
- health information;
- biometric information;
- precise financial information;
- government identifiers;
- racial or ethnic information;
- religious or philosophical information;
- sexual-orientation information;
- political opinions;
- trade-union information;
- genetic information; or
- other legally sensitive information,
Customer is responsible for ensuring an appropriate legal basis, permissions, safeguards and configuration.
An Order may prohibit or impose additional conditions on particular regulated data.
E. Frequency of Processing
Continuous or intermittent according to Customer's use of the Services.
F. Nature of Processing
Processing may include:
- receiving database metadata;
- retrieving information requested by Authorized Users;
- generating SQL;
- executing or facilitating authorized queries;
- processing query results;
- generating embeddings;
- indexing;
- storing configuration or Customer-requested artifacts;
- generating AI-assisted outputs;
- presenting analytics;
- storing saved queries or dashboards;
- troubleshooting;
- security logging;
- account administration; and
- deletion.
G. Purpose
To provide, maintain, secure and support the Netblinks Services requested by Customer.
H. Duration
For the duration of the Agreement plus any limited post-termination retention, backup or legally required period described in the Agreement and this DPA.
I. Subprocessor Processing
A Subprocessor may process Customer Personal Data for the duration necessary to provide its applicable infrastructure or service to Netblinks.
Appendix B. Technical and Organizational Measures
Netblinks maintains security measures appropriate to its Services and stage of operation.
The measures below describe categories of safeguards and are not a representation that every control applies identically to every deployment model.
1. Access Management
Netblinks uses access controls designed to limit administrative and production access according to job responsibilities and legitimate operational need.
Measures may include:
- unique user identities;
- authentication controls;
- least-privilege access;
- restricted cloud IAM permissions;
- controlled service accounts; and
- periodic review of access where appropriate.
2. Credential and Secret Protection
Netblinks uses mechanisms designed to protect database credentials, service credentials, tokens and other secrets.
Depending upon deployment, this may include cloud-native secret-management services, encrypted secret storage and access controls.
Secrets should not intentionally be exposed in application logs.
3. Encryption in Transit
Network communications containing Customer Personal Data are protected using encryption in transit where reasonably appropriate, including HTTPS/TLS for external application communications.
4. Encryption at Rest
Netblinks uses encryption-at-rest capabilities provided by applicable cloud and storage infrastructure where supported and appropriate.
5. Network Security
Infrastructure may use:
- cloud firewall rules;
- security groups;
- private networking;
- restricted administrative ports;
- source-IP restrictions;
- reverse proxies;
- authentication tokens; and
- separation between publicly accessible and internal services.
6. Application Security
Netblinks uses application controls designed to reduce unauthorized access and cross-tenant access.
Measures may include:
- authentication;
- tenant context;
- authorization checks;
- restricted service-to-service communication;
- input validation; and
- access checks before protected operations.
7. Environment Separation
Netblinks maintains distinctions between development/testing and production environments as reasonably appropriate.
Production credentials should not intentionally be committed to source-control repositories.
8. Logging and Monitoring
Netblinks may maintain logs concerning:
- application errors;
- authentication;
- infrastructure events;
- service operation;
- security-related activity; and
- troubleshooting.
Access to operational logs is restricted according to legitimate business need.
9. Vulnerability and Patch Management
Netblinks applies software, operating-system, dependency and container updates as reasonably appropriate based on risk, availability and operational requirements.
10. Backup and Recovery
Netblinks uses backup or recovery measures appropriate to relevant persistent systems.
Customer remains responsible for backups of Customer-controlled source databases and systems.
11. Availability
Netblinks uses commercially reasonable operational measures designed to maintain Service availability.
Unless separately agreed in writing, these measures do not constitute a guaranteed service level.
12. Tenant and Customer Separation
Where multiple customers use shared infrastructure, Netblinks uses logical controls intended to prevent unauthorized access between customers.
13. Personnel Confidentiality
Personnel authorized to access Customer Personal Data are subject to confidentiality obligations appropriate to their roles.
14. Subprocessor Management
Netblinks evaluates and contracts with material Subprocessors using commercially reasonable measures appropriate to the nature of the processing.
15. Incident Response
Netblinks maintains processes designed to:
- identify potential security events;
- assess incidents;
- contain or remediate material incidents;
- investigate causes; and
- provide legally required notifications.
16. Secure Deletion
Customer Personal Data is deleted from active systems according to applicable retention and termination procedures.
Residual backup information is removed according to normal backup rotation.
17. Database Access Controls
Netblinks recommends least-privilege database credentials and, where appropriate, read-only access.
Customer determines and controls the permissions assigned to Customer-provided database credentials.
18. AI Processing Controls
Where AI functionality requires sending Customer Data to an AI provider, Netblinks limits transmission to information reasonably necessary for the requested functionality, subject to Customer's configuration and the applicable provider arrangement.
BYOK and Managed AI processing are handled according to the applicable provisions of the Agreement and this DPA.
Appendix C. Subprocessors
Netblinks' current material Subprocessors will be maintained at:
https://www.netblinks.com/legal/subprocessors
The public list should identify, for each material Subprocessor:
- legal entity or service provider;
- service purpose;
- type of processing;
- primary processing location where appropriate; and
- relevant transfer mechanism where required.
This Annex should be populated only with providers actually used to process Customer Personal Data.