This Data Processing Addendum ("DPA") forms part of the Terms of Service between you and Ngris and governs the processing of personal data in connection with your use of our services.

1. Definitions

Terms such as "Personal Data," "Data Subject," "Data Controller," and "Data Processor" shall have the meanings defined in applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Scope and Roles of the Parties

You are the Data Controller and Ngris is the Data Processor. This DPA outlines the terms and conditions under which Ngris processes personal data on your behalf when you use our services.

3. Security Measures

Ngris implements appropriate technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, or destruction. These measures include encryption in transit (TLS 1.3), encryption at rest (AES-256), access controls, and regular security audits.

4. Data Subject Rights

Ngris will assist you in responding to requests from data subjects to exercise their rights under applicable data protection laws, including rights of access, rectification, erasure, and portability.

5. Data Transfers

Any transfers of personal data outside the original jurisdiction will be conducted in compliance with applicable data protection laws, including the use of Standard Contractual Clauses (SCCs) where required.

6. Sub-Processors

Ngris uses a limited number of sub-processors to provide the Service. A current list of sub-processors is available upon request. We will notify you of any changes to sub-processors with reasonable advance notice.

7. Data Retention

Ngris retains personal data only for as long as necessary to fulfill the purposes outlined in this DPA and the Terms of Service. Upon account termination, data is deleted within 30 days unless otherwise required by law.

8. Contact Us

If you have any questions about this DPA, please contact us at dpa@ngris.com.