Nubo SuiteScope and roles
This addendum applies where Chandorkar Technologies OPC Private Limited, whose registered office is at Floor 2nd, Shreyas Eterna, NDA Pashan Rd, Shri Krishna Nagar, Sagar Co-Operative Housing Society, Bavdhan, Pune, Maharashtra 411 021, India processes personal data on behalf of a customer organisation. The customer is the controller (data fiduciary); we are the processor.
Instructions
We process personal data only to provide the service and as the customer instructs through its use of Nubo and its admin settings, unless the law requires otherwise.
Security measures
- Data is encrypted in transit with TLS (HTTPS).
- Passwords are stored as salted scrypt hashes, and sessions are signed tokens.
- Two-step verification with authenticator apps and passkeys, sign-in lockouts and account recovery.
- Organisation security policies, such as requiring two-step verification, and activity records.
We do not claim end-to-end or zero-knowledge encryption.
Sub-processors
The customer authorises the sub-processors listed on the Sub-processors page. We will give at least 30 days’ notice of changes by email or on that page, and the customer may object in writing within that period; if we cannot accommodate a reasonable objection, the customer may end the agreement and delete its data.
Incidents
We will tell a business customer without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting its data, with the information we have.
Requests and assistance
We will help the customer respond to requests from people about their data and to meet its legal duties, taking account of the nature of the processing.
Return and deletion
Before or when the agreement ends, the customer can export its data using the export features in the apps (files, contacts, calendar, mail as .eml, CSV or JSON in the business apps), and we will help on request. When an account is closed, its data is deleted when the 30-day cancellation period ends (our daily job can take up to a day longer), as the Privacy Policy describes, except where the law requires us to keep it. Team content belongs to the team and stays until the team’s owner deletes it.
Audits and transfers
We will give information reasonably needed to show compliance, and allow an audit by the customer or its auditor on 30 days’ written notice, at most once a year (more often after a breach), during working hours, under confidentiality and at the customer’s cost. Data is hosted by Hetzner in Helsinki, Finland, so customers in India, the United States and elsewhere transfer data to Finland. The mechanism is this addendum and our written terms with Hetzner. We have not signed the EU Standard Contractual Clauses with every provider and we do not claim an adequacy decision for any transfer; a customer that needs a specific mechanism should write to us before it starts using Nubo.
Contact
Send DPA requests to support@nubo.email.