Data Processing Addendum
Last updated October 25, 2026
This Data Processing Addendum (the "DPA") forms part of the Terms of Service and governs Nodium's processing of personal data on behalf of the customer whose websites use the Service.
1. Definitions
"Controller" means the customer using the Service. "Processor" means Nodium. "Personal Data", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in the EU General Data Protection Regulation ("GDPR") and the UK GDPR (together with other applicable privacy laws, "Data Protection Laws"). "Subprocessor" means a third party engaged by the Processor to process Personal Data. Capitalized terms not defined here have the meanings given in the Terms of Service.
2. Roles of the Parties
With respect to the Personal Data of visitors to the Controller's websites, the Controller is the controller and Nodium is the processor. Each party will comply with its obligations under Data Protection Laws.
3. Details of the Processing
| Subject matter | Counting visits to the Controller's websites and how visitors use the forms already on them, and reporting both to the Controller. |
|---|---|
| Duration | For as long as the Controller's account exists, followed by deletion as set out in Section 4, and within the retention periods in the Privacy Policy. |
| Nature and purpose | Collection by the analytics script, storage, counting, and sending the weekly report the Controller's settings call for. |
| Categories of personal data | For visitors: the pages they open (without query strings, apart from utm tags), the referring website, their country, region and city, whether their device is a phone, a tablet or a computer and the names of their browser and operating system (never the rest of what the browser says), taps on telephone, email and map links, clicks on links to other websites and to files, addresses the website answered as not found, the names of events the Controller set up, and a daily key that cannot be traced back to them; never their network address. For the forms on the Controller's websites: that a visitor saw, started and sent a form or left it unsent, which fields they reached, whether a field was empty when they pressed Send or marked wrong by the form, whether the platform reported a failed send, and how the website showed the form was sent; never what was typed into a field. Password, hidden, payment and file fields are skipped. |
| Categories of data subjects | Visitors to the Controller's websites. |
4. Obligations of the Processor
The Processor will:
- process Personal Data only on the Controller's documented instructions, which consist of the Controller's installation of the analytics script and its settings, including with regard to international transfers, and inform the Controller if, in the Processor's opinion, an instruction infringes Data Protection Laws;
- ensure that every person authorized to process Personal Data is bound by confidentiality;
- implement appropriate technical and organizational security measures, including HTTPS everywhere, encryption at rest by its host, sign-in links, sessions and emailed links stored only as hashes, rate limits, an operations console behind single sign-on in which every access to a workspace is logged, and nightly backups kept for 30 days;
- assist the Controller in responding to requests from Data Subjects to access, correct or delete their Personal Data;
- notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting the Controller's data, and in any event within 72 hours, describing, as far as then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences and the measures taken or proposed, and supplementing that notice as more becomes known;
- assist the Controller, taking into account the nature of the processing and the information available to the Processor, with its obligations regarding security, Personal Data Breaches, data protection impact assessments and prior consultation with a supervisory authority;
- at the end of the processing, return the Controller's Personal Data, which the Controller may export at any time before deleting its account, and delete it when a website or the account is deleted, with backups expiring within 30 days, unless the law requires its storage; and
- make available to the Controller, on request, the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, by the Controller or an independent auditor it mandates who is bound by confidentiality. An audit is requested in writing at least 30 days ahead, takes place no more than once in any 12 months unless a supervisory authority requires it or it follows a Personal Data Breach, and is conducted during business hours without unreasonably disrupting the Service; the Controller bears its own costs.
5. Subprocessors
The Controller authorizes the Processor to engage the Subprocessors listed below. The Processor will announce any new Subprocessor on the changelog at least 30 days before it begins processing, and the Controller may object on reasonable data protection grounds by writing to the Processor. If the parties cannot resolve the objection, the Controller may stop using the Service and delete its account before the new Subprocessor begins processing. The Processor imposes on each Subprocessor, by written contract, data protection obligations no less protective than those in this DPA, and remains liable to the Controller for each Subprocessor's performance of them.
| Company | What it does for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, the database, sending email, the browser the site checks use, the spam check (Turnstile) and backups | Global network; data kept in North America |
| Paddle.com Market Ltd | Selling Nodium's plans as the merchant of record: payment, invoices, receipts and tax. It sees the customer's billing details, never their visitors' or requesters' data | United Kingdom |
| Purelymail | Our mailboxes: what you write to support@, abuse@, legal@ and privacy@usenodium.com, and our replies. It never sees the Service's data | United States (eastern North America) |
6. International Transfers
The Processor keeps the Controller's Personal Data in North America, as set out in the Privacy Policy. A request is handled at the Cloudflare location nearest whoever makes it; scheduled jobs, queues and the site checks' browser run wherever Cloudflare places them and keep nothing outside that storage; and emails go wherever the Controller's settings direct.
Where Personal Data is transferred outside the EU, the EEA or the UK, the transfer is governed by the European Commission's Standard Contractual Clauses (Module Two, controller to processor, and Module Three for onward transfers to Subprocessors), together with the UK International Data Transfer Addendum, which are incorporated into this DPA by reference. Section 3 of this DPA serves as their Annex I, and Section 4(c) as their Annex II.
7. Term and Precedence
This DPA remains in effect for as long as the Processor processes Personal Data on the Controller's behalf. In the event of a conflict between this DPA and the Terms of Service regarding the processing of Personal Data, this DPA prevails.
8. Contact
Nodium is operated by Zachary Johnson, an individual doing business as Nodium, Kentucky, USA. Questions about this DPA may be sent to legal@usenodium.com. Requests concerning a Data Subject's Personal Data may be sent to privacy@usenodium.com.