DATA PROCESSING AGREEMENT (DPA)
This Data Processing Agreement ("DPA") forms part of the Terms of Service provided by Sudeis Hussein Nuru, trading as Atience ("Atience").
By accepting the Terms of Service, the Client also agrees to this DPA.
This DPA governs how Atience processes personal data on behalf of the Client when providing automation implementation and management services.
The Client acts as the Data Controller, and Sudeis Hussein Nuru, trading as Atience, acts as the Data Processor for the processing covered by this DPA.
1. Scope and Purpose
Atience processes personal data only as necessary to provide the agreed automation services.
This may include:
- Building and configuring automation workflows.
- Connecting software, APIs and integrations.
- Creating API and MCP connections where authorized.
- Mapping and transforming data between systems.
- Setting up logging structures and Google Sheets.
- Testing and deploying workflows.
- Monitoring, troubleshooting and repairing workflows.
- Maintaining and improving agreed workflows.
Atience will not use the Client's personal data for unrelated purposes, independent marketing or AI model training.
The processing details, including the types of personal data and Data Subjects, are described in Annex 1.
2. Client Responsibilities
The Client acts as Controller and is responsible for:
- Determining why and how personal data is processed.
- Having a lawful basis for collecting and using personal data.
- Providing appropriate privacy information to individuals.
- Deciding what personal data enters its workflows.
- Ensuring its instructions and data processing activities are lawful.
- Owning and managing its n8n environment and connected software accounts.
- Providing Atience with the necessary team-member invitations and permissions.
- Managing its credentials, API accounts and subscriptions.
- Paying for its software, hosting, API usage and AI credits.
- Approving workflows before production deployment.
- Managing requests from individuals concerning their personal data.
- Selecting and managing its own third-party software providers.
The Client remains responsible for the personal data stored within its own infrastructure and connected services.
3. Atience Responsibilities
Atience acts as Processor and agrees to:
- Process personal data only for the agreed services and according to the Client's documented instructions.
- Build, configure, test, deploy and maintain agreed workflows.
- Map and transform data as required by the agreed workflows.
- Access workflow configurations and execution data when necessary to provide the services.
- Limit access to what is reasonably necessary.
- Implement appropriate technical and organisational measures to protect personal data, taking into account Article 32 GDPR and the risks associated with the processing.
- Ensure authorized personnel are bound by confidentiality obligations.
- Assist the Client with relevant data protection requests and obligations.
- Notify the Client of personal data breaches involving Atience's processing without undue delay.
- Delete or return personal data held outside the Client's environment when the services end, as described in Section 7.
Atience will inform the Client if it believes an instruction violates applicable data protection law.
4. Infrastructure, Access and Security
The Client owns or controls its n8n environment, connected software accounts and end-customer data.
The Client grants Atience the minimum permissions reasonably required to deliver the services. This may include team-member access to n8n and connected platforms so Atience can configure integrations, create necessary API connections and maintain workflows.
The Client manages its own credentials and accounts. Atience may use authorized credentials and permissions to perform the agreed work.
Atience applies appropriate technical and organisational security measures, including:
- Individual user accounts and controlled access.
- Limited permissions where supported by the platforms.
- Confidentiality obligations.
- Use of synthetic data for testing wherever practical.
- Appropriate handling of information accessed during troubleshooting.
- Removal of access when no longer required.
Atience does not intentionally maintain a separate database or storage system for the Client's end-customer personal data. Such data remains within the Client's environment and connected services.
5. Personal Data Restrictions
The services are not designed or intended to process special-category personal data under Article 9 GDPR or personal data relating to criminal convictions and offences under Article 10 GDPR.
The Client must not instruct Atience to process these categories of data through the agreed services.
If such data is accidentally encountered, Atience will notify the Client and take reasonable steps to stop the relevant processing and delete or return the information under its control where appropriate.
6. Data Protection Assistance and Subprocessors
The Client is responsible for receiving and managing requests from individuals concerning their personal data.
Atience will provide reasonable assistance where necessary and technically possible, within the scope of its services.
Atience will notify the Client without undue delay after becoming aware of a personal data breach involving its processing and reasonably assist with the investigation and applicable GDPR obligations.
Atience does not currently appoint independent subprocessors to process Client personal data.
The Client provides general written authorization for Atience to appoint subprocessors where necessary to deliver the services. Atience will notify the Client of intended additions or replacements and allow 14 calendar days for reasonable objections based on data protection grounds.
If the Client raises a reasonable objection, the parties will attempt to resolve it. If no reasonable solution can be reached, either party may terminate the affected services in accordance with the Terms of Service.
Any appointed subprocessor must be bound by appropriate written data protection obligations. Atience remains responsible for its subprocessors as required by applicable law.
Software providers selected and contracted directly by the Client are generally the Client's own provider relationships.
7. International Transfers and Termination
Each party is responsible for ensuring that international transfers of personal data carried out under its responsibility comply with applicable data protection laws. The Client is responsible for selecting its third-party platforms and reviewing their data processing locations and transfer arrangements.
Atience will follow the Client's documented instructions and applicable international transfer requirements. If Atience independently appoints a subprocessor that transfers personal data outside the EEA, Atience will ensure appropriate legal safeguards are in place where required.
When the services end:
- Atience stops processing personal data on behalf of the Client, except where legally required.
- The Client retains its n8n environment, workflows, connected accounts and data.
- At the Client's choice, Atience will delete or return personal data held outside the Client's environment when the services end, unless applicable law requires its retention.
- Atience removes its access to the Client's systems.
- Atience will confirm deletion upon reasonable request.
The Client remains responsible for deleting data stored within its own systems.
8. Legal Terms
Atience will provide reasonable information necessary to demonstrate compliance with this DPA. The Client may request reasonable audits where necessary, subject to advance notice, confidentiality and security requirements. Documentary evidence will normally be the first method of demonstrating compliance.
This DPA forms part of the Terms of Service. If the Terms conflict with this DPA concerning personal data processing, this DPA takes precedence.
Changes to this DPA
Atience may update this DPA from time to time. Clients will be notified of material changes by email. Updated terms will take effect on the date specified in the notice. Continued use of the services after that date constitutes acceptance of the updated DPA. If a Client does not agree to the changes, they must discontinue use of the services and may terminate the agreement in accordance with the Terms of Service.
Each party remains responsible for its obligations under applicable data protection laws. Nothing in this DPA removes liability that cannot legally be excluded or limited.
This DPA is governed by Swedish law and the applicable requirements of the GDPR.
ANNEX 1 — PROCESSING DETAILS
Controller: The Client.
Processor: Sudeis Hussein Nuru, trading as Atience.
Subject matter: Automation implementation and management.
Duration: For the duration of the service relationship and any necessary period for return or deletion.
Nature of processing: Accessing, configuring, mapping, transforming, testing, executing, monitoring, troubleshooting, maintaining and deleting personal data through the Client's n8n environment and connected services.
Purpose: Delivering the automation services agreed between the Client and Atience.
Categories of Data Subjects:
- Leads and prospects.
- Customers.
- Client employees.
- Other individuals whose information enters the Client's workflows.
Categories of Personal Data:
- Names.
- Email addresses.
- Phone numbers.
- Business contact details relating to identifiable individuals.
- Lead and customer records.
- Customer communications.
- Appointment and booking information.
- Purchase and transaction information.
- Other ordinary personal data approved by the Client.
Special-category data: Excluded from the agreed processing scope.
SERVICE PROVIDER
Legal name: Sudeis Hussein Nuru
Trading name: Atience
Email: Support@atience.com