Counsel-reviewable engineering draft
Data Processing Addendum Draft
Draft processor terms and security commitments; no DPA is effective until executed by approved entities.
Candidate processing instructions
Where Nook acts as processor, it is intended to process personal data only on documented customer instructions needed to provide, secure, support, and maintain the contracted service, subject to law and the final agreement.
- Subject matter, duration, nature, purposes, data categories, and data-subject categories must be completed in an executed order or schedule.
- Personnel access must be least-privilege, authenticated, logged, and confidentiality-bound.
- Subprocessor engagement, transfer mechanisms, assistance, deletion/return, audits, and government-request handling require approved clauses.
Security and incidents
The product uses tenant scoping, role-based authorization, passkeys for high-risk Portal operations, action-bound step-up, immutable commercial evidence, signed entitlements, encrypted transport, sanitized audit, and bounded recovery capabilities.
A contractual incident-notification period, risk assessment procedure, customer cooperation process, and audit evidence package remain legal and operational launch gates.