DueSlotData Processing Agreement
This DPA forms part of the terms between the customer (controller) and Nostello OÜ (processor) and applies where Nostello processes personal data on the customer's behalf under GDPR Article 28.
1. Scope
| Item | Details |
|---|---|
| Subject matter | Operating DueSlot: signing the user in, storing an encrypted refresh token, and syncing Planner task identifiers into a calendar in the user's mailbox |
| Data subjects | Customer's users of DueSlot |
| Personal data | Microsoft object and tenant IDs, encrypted refresh tokens, task/event/calendar IDs, due dates, keyed hashes, settings flags, hashed telemetry, billing identifiers when a paid plan is used |
| Not stored | Task titles, descriptions, checklists, comments, assignee names, plan/bucket/label names, and access tokens. Titles may be processed in memory in transit to Microsoft Graph. |
2. Nostello's obligations
- Process only on documented instructions (these terms and the customer's use of the service).
- Ensure personnel are bound by confidentiality.
- Implement appropriate technical and organisational measures (Art. 32): encryption in transit and of refresh tokens at rest, least-privilege access, access to admin tools behind Cloudflare Access, no storage of task titles, no request logging on the Worker's servers.
- Assist with data-subject requests and breach notification, and delete or return personal data at the end of the service.
- Allow reasonable audits on request.
3. Transfers
Transfers outside the EEA rely on the EU Standard Contractual Clauses (Module 3 where Nostello is processor) or the EU-US Data Privacy Framework where the recipient is certified.
4. Contact
Sheldon Halgreen, privacy officer, privacy@noscotek.co.za. Nostello OÜ, Ahtri Street 12, 15551 Tallinn, Estonia.