Data processing agreement for NFC.cool Business Card for Teams

1. Parties

2. Scope, acceptance and order of precedence

2.1 This agreement applies whenever NFC.cool processes Customer Personal Data while providing NFC.cool Business Card for Teams (the web console at business.nfc.cool, its API and MCP server, the Business Card apps and App Clip, and the card pages) under the Business Card terms (the “Terms”).

2.2 This agreement is part of the Terms. The Customer accepts it when it accepts the Terms at team setup, and nothing else needs to be signed. An owner can ask business (at) nfc (dot) cool for a signed copy.

2.3 Where this agreement and the Terms differ on the processing of personal data, this agreement prevails.

2.4 This agreement implements Article 28(3) of Regulation (EU) 2016/679 (the “GDPR”). Terms defined in the GDPR have the same meaning here.

2.5 This agreement does not cover data NFC.cool processes as a controller for its own purposes, as described in the Business Card privacy policy: each person’s own account and sign-in data, team billing data (through Stripe), the apps’ analytics and crash reports, server logs and security measures such as rate limiting, emails NFC.cool sends about accounts and teams, and the answer to the sign-up question.

3. Customer Personal Data

“Customer Personal Data” means the personal data that the Customer, its users or the people its cards are shared with put into the service for the Customer’s team, as described in Annex 1. In particular:

• the contacts people leave on the team's cards (leads), and everything the team adds to them;
• what the team puts on its members' cards;
• the team's invitations.

4. The Customer’s responsibilities

4.1 The Customer is responsible for the lawfulness of the processing it decides on. This includes having a legal basis for collecting contacts and for sending them follow-up emails, informing the people concerned (Articles 13 and 14 GDPR), telling its members how the team uses the service, answering people’s requests, and the content it puts on the team’s cards.

4.2 The Customer decides which services it connects (webhooks, HubSpot, Salesforce, AI assistants through access tokens). Those services receive data because the Customer sends it there. They are the Customer’s own recipients, not NFC.cool’s subprocessors, and the Customer needs its own agreements with them.

4.3 The Customer does not use the service to collect special categories of personal data (Article 9 GDPR) or data about children.

5. Instructions

5.1 NFC.cool processes Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers outside the European Economic Area, unless Union or Member State law requires otherwise. In that case NFC.cool tells the Customer before processing, unless that law forbids it.

5.2 The Customer’s instructions are: the Terms and this agreement; the settings the Customer’s owners, admins and managers choose in the service (for example lead capture, the fields a card asks for, follow-up emails, webhooks, HubSpot, Salesforce, access tokens, custom domains, and the choice made when deleting the team); and any further written instructions agreed between the parties.

5.3 NFC.cool tells the Customer at once if, in its opinion, an instruction infringes the GDPR or other data protection law.

6. Confidentiality

NFC.cool ensures that the people it authorises to process Customer Personal Data are bound to confidentiality, by contract or by law, and access it only as far as they need to run and support the service.

7. Security

7.1 NFC.cool implements the technical and organisational measures in Annex 2, taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing (Article 32 GDPR).

7.2 NFC.cool may change these measures, provided the overall level of protection does not decrease.

8. Subprocessors

8.1 The Customer gives NFC.cool general authorisation to engage the subprocessors listed in Annex 3.

8.2 NFC.cool informs the Customer of any intended addition or replacement of a subprocessor at least 30 days before it starts, by updating Annex 3 and by email to the team’s owners. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the Terms for its team and receives, through Stripe, a refund of the part of the period already paid that is left.

8.3 NFC.cool imposes on each subprocessor, by contract, data protection obligations that offer at least the same level of protection as this agreement, and remains liable to the Customer for its subprocessors as provided in Article 28(4) GDPR.

9. Transfers outside the European Economic Area

9.1 NFC.cool transfers Customer Personal Data outside the European Economic Area only under Chapter V GDPR, with the safeguard set out for each subprocessor in Annex 3: the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR), or the Commission’s standard contractual clauses (Article 46(2)(c) GDPR).

9.2 The Customer can ask business (at) nfc (dot) cool for a copy of the standard contractual clauses that apply.

10. Assistance with data subjects’ requests

10.1 The service gives the Customer the tools to answer most requests itself. Owners, admins and managers can view, edit, assign and delete contacts, and export them as a CSV file from the Leads page. Admins can edit and delete the team’s cards. Members can edit their own cards within the team’s limits.

10.2 If NFC.cool receives a request from a data subject about Customer Personal Data, it does not answer it on the substance. It forwards it to the Customer without undue delay, tells the data subject that it has done so, and helps the Customer answer it as far as it reasonably can.

11. Personal data breaches

11.1 NFC.cool notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, by email to the team’s owners.

11.2 The notice describes, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. NFC.cool provides further information as it becomes available.

11.3 Notifying the supervisory authority and the data subjects remains the Customer’s decision, with NFC.cool’s assistance.

12. Assistance with impact assessments and the authorities

NFC.cool helps the Customer, taking into account the nature of the processing and the information available to it, to meet its duties on security, data breaches, data protection impact assessments and prior consultations (Articles 32 to 36 GDPR), mainly by providing this agreement, its annexes and answers to reasonable questions.

13. Return and deletion

13.1 The Customer can get its data back at any time: owners, admins and managers can export the team’s contacts as a CSV file, and each person can export their own data from the console.

13.2 When an owner deletes the team in the console, NFC.cool cancels the team’s subscription and then, at once:

• returns each card held by a member to that member as a personal card;
• deletes the cards held by nobody;
• for contacts assigned to a member, does what the owner chose when deleting the team: deletes them, or moves each to that member's own account, where that member becomes its controller. Unless the owner chooses to move them, they are deleted;
• deletes the contacts assigned to nobody;
• deletes the team's brand, settings, memberships, invitations, connections, custom domains, access tokens and their logs.

13.3 A team whose subscription ended, or whose 7-day preview ended without a trial, is kept for 12 months. NFC.cool emails its owners 30 days and 3 days before. If nobody subscribes again by then, NFC.cool deletes the team as in 13.2, with its contacts deleted.

13.4 Delivery logs of webhooks, HubSpot and Salesforce are deleted 30 days after the delivery, or 90 days if it failed. Copies in database backups are deleted when those backups are overwritten, within 7 days.

13.5 Billing records are not Customer Personal Data. NFC.cool keeps them as its own records for 10 years, as Portuguese tax and accounting law requires.

14. Information and audits

14.1 NFC.cool makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, in the first place this agreement, its annexes and written answers to reasonable questionnaires.

14.2 Where that information is not enough, NFC.cool allows for and contributes to audits, including inspections, by the Customer or an auditor it appoints who is bound to confidentiality. The Customer gives at least 30 days’ written notice, audits no more than once a year unless a supervisory authority requires it or after a breach, during business hours, and at its own cost.

15. Liability

Each party’s liability under this agreement follows the Terms, including the limit there for business customers (the higher of what the Customer paid in the last 12 months and EUR 100). This does not limit either party’s liability towards data subjects under Article 82 GDPR.

16. Term

This agreement applies for as long as NFC.cool processes Customer Personal Data for the Customer, and ends with the deletion described in section 13.

17. Governing law

This agreement is governed by Portuguese law. The courts of Coimbra, Portugal, decide disputes about it.

Annex 1: Details of the processing

Subject matter and duration. NFC.cool provides NFC.cool Business Card for Teams to the Customer under the Terms, for the duration of the Terms and until the deletion in section 13.

Nature of the processing. Collection through the card pages and the App Clip; storage and hosting; display to the team; image processing (a contact’s selfie is resized and stamped with the names of the card’s holder and the visitor, and the team’s logo if it has one); transmission (push notifications, Conference Mode Live Activities, follow-up emails, webhooks, HubSpot, Salesforce, the API and MCP server, the team’s App Clip card at Apple); export; and deletion.

Purpose. To provide the service to the Customer as the Terms describe. No purpose of NFC.cool’s own.

Categories of data subjects.

• People who leave their details on the team's cards (leads), and the recipients of the team's follow-up emails.
• The team's members, the people it invites, and the people its cards present.

People who only open a card are counted, not identified: views, saves and link taps are stored as events with no IP address, device identifier or cookie.

Types of personal data.

• Leads: first and last name, email address, phone number, job title, company, a note, and a selfie if the card asks for one; what the team adds (notes, tags, status, assignee, follow-ups); the follow-up emails sent (recipient, subject, text, delivery status); and whether the address unsubscribed, bounced or reported spam.
• Members and cards: name, photo, job title, company, department, bio and note, phone numbers, email addresses, postal addresses, websites, social media profiles, birthday, logos, header image, the card's PIN, role in the team, and the cards' view, save and link-tap counts.
• Invitations: email address, name, and the card prepared for the person.
• Integrations: webhook delivery logs (which carry a lead's details, the email address of the card's holder and the name and email address of its assignee), HubSpot and Salesforce owner lookups by a member's email address, and access-token activity records (the token's name, what it did, when, and for some actions a short description).

Special categories. None intended (section 4.3). A selfie is a photograph and is not processed to identify anyone.

Annex 2: Technical and organisational measures

• In transit. HTTPS on every connection, with HSTS. Outbound webhooks are signed (HMAC with a timestamp against replay).
• Credentials. Passwords stored as salted hashes. API and MCP access tokens stored only as SHA-256 hashes, scoped to one membership, read-only unless allowed to change things, with an expiry (90 days unless chosen otherwise), revocable by the team's admins, and ended when the membership ends. HubSpot and Salesforce tokens stored encrypted.
• PINs. Stored encrypted.
• Files. A contact's selfie and data exports are stored privately and opened only through short-lived signed links (selfies one hour, data exports 60 seconds).
• Access within a team. Roles: owner, admin, manager, billing and member. Members see only their own cards and contacts. Owners, admins and managers see the team's. The billing role sees no contacts. Each access token's use is recorded and visible to the team's admins.
• Access by NFC.cool. Admin access to the server requires two-factor authentication.
• Abuse limits. Rate limits on sign-in, PIN entry and the contact form. The counters are kept in the server's cache for at most a day.
• Logs. Request logs have PINs and sign-in tokens removed, stay on the server and are deleted after 14 days.
• Error reports. Sentry receives no request contents, contact details, email addresses, PINs, tokens or IP addresses.
• Follow-up email safety. An unsubscribe link in every email. Unsubscribed, bounced and spam-reported addresses are blocked for the team. Per-member and per-team sending limits. Open tracking off.
• Retention. Webhook, HubSpot and Salesforce delivery logs 30 days (90 days when failed). Data exports 7 days. Rate-limit counters at most a day. Database backups 7 days.
• Hosting. DigitalOcean, in its data centres in the New York area, USA.

Annex 3: Subprocessors

“Safeguard” is the transfer mechanism for data leaving the European Economic Area (section 9).

• DigitalOcean, LLC. Hosts the server, the database and the files (photos, logos, selfies, header images, data exports), and delivers files through its content delivery network. Location: New York area, USA. Safeguard: EU-U.S. Data Privacy Framework, with standard contractual clauses in its data processing agreement as a fallback.
• Functional Software, Inc. (Sentry). Error reports from the server. Location: USA. Safeguard: EU-U.S. Data Privacy Framework, with standard contractual clauses as a fallback.
• Mailjet SAS (Sinch Mailjet). Sends the team's follow-up emails. Location: EU (Germany and Belgium). No transfer.
• Google LLC (Firebase Cloud Messaging). Push notifications about new contacts, with the contact's name and the member's name. Location: USA. Safeguard: EU-U.S. Data Privacy Framework.
• Apple Inc. (Apple Push Notification service, App Store Connect). Push delivery and Conference Mode Live Activities on iPhones, with a contact's name and company; the team's App Clip card (card link, title, subtitle, header image, and the team's place name, address and phone number). Location: USA. Safeguard: standard contractual clauses.
• PostHog. If a member allows usage data in the iPhone app, recordings of how the app is used, with text, text fields and images masked. Location: EU. No transfer.

Not listed, and why: Stripe (team billing, NFC.cool’s own controller data); RevenueCat, Firebase Analytics and Crashlytics (the apps’ subscriptions, analytics and crash reports, NFC.cool’s own; crash reports contain no contact details); Cloudflare (the app’s newsletter sign-up); the public certificate authority for custom domains (receives the domain name only); and the services the Customer connects (webhooks, HubSpot, Salesforce, AI assistants: the Customer’s own recipients, section 4.2).