Data Processing Addendum

Who needs one

Customers that act as controller (or as a processor for their own clients, such as an MSP) for personal data in the logs, email and exports they upload. That evidence routinely names user accounts, email addresses, IP addresses and host names. If your organization is subject to the GDPR, the UK GDPR or a US state privacy law that requires a written processor contract, ask for the addendum before you upload personal data.

What it covers

• Roles: your organization as controller, or as a processor that may appoint PastePile Labs LLC as its subprocessor; PastePile Labs LLC as processor.
• Processing only on documented instructions, and confidentiality for everyone with access.
• Security measures, described in a schedule completed and re-verified for your signature date.
• Notice of a personal data breach without undue delay. The addendum sets no fixed number of hours.
• Assistance with individual rights requests, security duties and impact assessments.
• Subprocessors: the current list, and notice before a new one is added.
• International transfers, using the clauses and transfer record completed for your organization.
• Return and deletion at the end of the service, and how backups are handled.
• Information and audit cooperation, without any certification.

What it does not include

No certification such as SOC 2 or ISO 27001, no uptime or service level commitment, and no data-residency commitment beyond what its schedules state. See Security for what NEMUQU does and does not claim.

How to request it

Write to privacy@nemuqu.com with your organization's legal name, the person who will sign, the countries where the people in your evidence are located, and whether you act for your own organization or for clients. The schedules are completed and checked against current providers before anything is sent for signature.

Last updated 2026-10-15.