1. Roles of the parties
1.1. The Customer is the controller of its customers' personal data. The Provider is the processor and processes such data only to provide the Service.
1.2. Nitka processes the data of the Customer itself and its users (accounts, payments, support) as a controller under the Privacy Policy; this Addendum does not apply to such data.
2. Subject matter of processing
Data subjects
People who message the Customer on Instagram or Messenger (its customers and prospects)
Categories of data
Page-scoped identifiers (PSID / IGSID), name, username, profile photo, message text and attachments, order card data (phone, email, city, amount, product), statuses, notes, ID of the ad where the conversation started
Special categories of data
Not collected deliberately. If a customer has written such data themselves (e.g., about health), the Customer is responsible for the lawfulness of its processing
Purposes
Displaying conversations, assigning statuses, sending events to the Customer's Meta Pixel via the Conversions API, reports for the Customer, anonymized niche statistics
Duration
For as long as the Offer is in force, then as per Section 8
3. Customer's instructions
3.1. The Customer's documented instructions are the Offer, this Addendum and the Customer's actions in the Service: connecting Pages and pixels, changing statuses, configuring events, deleting data.
3.2. If, in the Provider's opinion, an instruction violates the law or Meta's rules, the Provider notifies the Customer and may refuse to follow it.
3.3. The Provider does not use the data for its own purposes, does not sell it and does not combine it with data of other Customers, except for aggregated anonymized niche statistics (Offer, clause 9.2).
4. Customer's obligations
4.1. The Customer warrants that it has a legal basis to process its customers' data and to send events to Meta, and informs its customers about this in its own privacy policy.
4.2. The Customer itself responds to its customers' requests regarding their data and manages its employees' access to the Service.
5. Confidentiality and security
5.1. Only persons who need access to operate the Service or provide support and who are bound by confidentiality obligations have access to the data. The Nitka team accesses the Customer's conversations only at the Customer's support request or to fix failures.
5.2. The Provider applies the measures described at nitka.tools/security/: encryption of traffic and tokens, isolation of account data, two-factor authentication for the team, and backups.
6. Sub-processors
6.1. The Customer grants general authorization to engage sub-processors without whom the Service cannot operate (a full list with names and countries of processing is provided to the Customer on request to info@nitka.tools):
- Sub-processor
Function
Cloud infrastructure provider
Hosting of servers and databases
SendPulse
Service emails to the Customer's users (data of the Customer's customers is not transferred)
Meta Platforms is not Nitka's sub-processor: data comes from Meta and is sent to the Customer's Meta Pixel under the terms the Customer has accepted with Meta.
6.2. The Provider notifies the Customer by email at least 14 days in advance of adding or replacing a sub-processor. The Customer may object on reasonable grounds; if no agreement is reached, the Customer may cancel the subscription with a refund of the remainder under the rules of the Offer.
6.3. The Provider imposes on sub-processors data protection obligations no less protective than this Addendum and is liable for their actions.
7. Assistance to the Customer
7.1. Data subject requests. If a customer of the Customer contacts Nitka directly, we will forward the request to the Customer within 7 business days. On the Customer's instructions, we will help find, correct, export or delete the data of a specific person.
7.2. Incidents. The Provider notifies the Customer by email of any breach of or unauthorized access to the Customer's data within 72 hours of discovery: what happened, which data is affected, what has been done and a contact person. This helps the Customer meet its own notification obligations.
7.3. Audits. At the Customer's reasonable request (no more than once a year), the Provider provides written answers to data protection questions and the list of sub-processors. On-site audits are subject to a separate agreement and are carried out at the Customer's expense.
8. Deletion and return of data
8.1. The Customer may export its data at any time while the subscription is active and within 90 days after suspension of the Project.
8.2. After this period or at the Customer's request, the Provider deletes the data within 30 business days, and from backups as they are overwritten. Anonymized niche statistics are not deleted as they contain no personal data.
9. International data transfers
9.1. Data may be stored in data centers outside Ukraine. The Provider engages only providers that ensure an adequate level of data protection and, for data from the EU/EEA, appropriate safeguards such as Standard Contractual Clauses (SCC).
10. Liability and term
10.1. The parties' liability under this Addendum is governed by Section 11 of the Offer, including the limitation of total liability.
10.2. This Addendum remains in force for as long as the Provider processes the Customer's data. In case of conflict regarding personal data protection, this Addendum prevails over the Offer.
10.3. If the Customer needs a signed copy of this Addendum, it can be obtained on request to info@nitka.tools and signed with a qualified electronic signature via the Vchasno service.
Contacts
Individual Entrepreneur Oleh Dmytrovych Batozhnyi, RNOKPP 3364011937 · info@nitka.tools · phone: [phone number]