Data processing agreement

3NV will:

treat this agreement and the order form as the Customer's instructions. The Customer can give more in writing, for example in a support ticket. If an instruction goes beyond the services bought, we treat it as a change request and quote first. We follow EU or Estonian law where it requires otherwise. If so, we tell the Customer first, unless the law forbids it;

tell the Customer if we think an instruction breaks data protection law. We may pause it until the Customer confirms or changes it;

make sure everyone who can reach the personal data is bound by confidentiality, and stays bound after they leave;

apply the security measures in Annex 2;

use sub-processors only as set out in section 5;

help the Customer respond to requests from data subjects, as far as our role allows. In practice the Customer holds the data and can answer most requests directly;

help the Customer with security, breach notification, data protection impact assessments and prior consultation, as far as our role allows;

at the end of the service, erase the personal data as set out in section 7;

give the Customer the information needed to show compliance with this agreement, and allow audits as set out in section 8;

charge fairly for help. Some help is free: passing on a request we receive, sharing information we already hold, and the documents in section 8.1. For bigger tasks we quote first and only start once the Customer agrees. If the help is needed because we broke this agreement, it is free.

The Customer:

is responsible for the lawfulness of the data on its servers and for its instructions to 3NV;

is responsible for security at and above the operating system: accounts, patching, encryption, backups and application security;

keeps its own backups. 3NV doesn't back up data on Customer servers unless agreed in writing;

names a security contact in the order form, for breach notices.

The Customer authorises 3NV to use the sub-processors in Annex 3. Annex 3 shows when each of them could see the Customer's data. Only the data centre operator can reach the hardware that holds workload data, and only through physical access on our ticket.

3NV gives at least 30 days' notice before adding or replacing a sub-processor. We email the Customer's named contact. The Customer may object in writing within that time, on reasonable data protection grounds. We then talk, and we may offer not to use the new sub-processor for the Customer. If we can't solve it within 30 days of the objection, the Customer may end the affected servers by written notice. There is no early-exit fee, and the Customer pays only up to the day they stop. This applies to any sub-processor change.

3NV puts each sub-processor under data protection terms at least as protective as this agreement, and stays responsible to the Customer for its sub-processors.

Some companies never handle the personal data on the Customer's servers. They are not sub-processors. Examples: our power supplier, network carriers that only pass traffic through without storing it, and hardware vendors that receive parts with no drives in them. We don't list them, and we don't give notice when they change.

In an emergency, for example if a sub-processor fails without warning, we may replace it at shorter notice. We tell the Customer as soon as we can, and the objection right in 5.2 still applies.

3NV tells the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the Customer's data. We tell the Customer's named security contact and post in the Customer's support channel. If we don't know everything yet, we send what we know and add the rest as we learn it.

The notice includes what we know at the time: what happened, the data and people likely affected, the likely consequences and what we're doing about it.

Because 3NV doesn't operate the Customer's operating system, many breaches can only be detected by the Customer. 3NV's duty covers breaches in the parts it runs: the facility, the hardware, the management controller, the network up to the Customer's server, and our own systems.

The Customer can report a suspected breach to us at security@3nv.io.

Authorities, seizure and insolvency. If an authority asks us for the Customer's data, we point it to the Customer, unless the law forbids that. We check that the request is valid, and we give only what we must. If the Customer's servers are at risk of seizure, or if 3NV faces insolvency, we tell the Customer at once, unless the law forbids it. We tell the authority or the administrator that the data belongs to the Customer.

At the end of the term, the Customer has at least 30 days to retrieve its data, as set out in section 8 of the Terms of Service.

Reserve. Within 10 business days after the retrieval period ends, we erase every drive in the Customer's servers. We use the drive's built-in secure erase or cryptographic erase, and overwrite only where a drive supports neither. We check the result. Then we send the Customer a certificate that lists each drive by serial number.

If a drive can't be erased, we destroy it on site and record its serial number.

Own and Colocate. The drives belong to the Customer. We erase or destroy them only if the Customer asks in writing. Otherwise we hand them back with the hardware, as they are.

Failed drives during the term. On Reserve, failed drives are destroyed on site and never go back to a vendor. On Own and Colocate, the order form records the Customer's consent to this by default, and the Customer can choose there to have failed drives handed back instead. The Customer gets a record of each destroyed drive, by serial number.

First, we give the Customer documents. These are this agreement, Annex 2, the login records for the Customer's management controllers and consoles, and erasure and destruction records. This is free.

If that isn't enough, the Customer or an independent auditor may inspect us once a year. The Customer gives us 30 days' notice. The auditor signs a confidentiality agreement and may not be our competitor. Inspections happen in business hours and must not put other customers at risk.

The Customer pays its own costs. We charge our time at the rate in the order form, unless the audit finds we materially broke this agreement.

Extra inspections are allowed after a personal data breach, or when a supervisory authority requires one.

Inside the data centre, the operator's visitor and safety rules apply. We arrange the visit and escort the auditor.

The Customer's workload data stays on its hardware, in the data centre in Estonia named in the order form. Our engineers work from inside the EEA. When travelling, they reach management controllers and consoles only through our encrypted VPN, and no data is copied out of the facility.

Support tools may hold personal data the Customer shares with us, for example a log in a ticket or support chat. Some of these tools are run by companies outside the EEA. For each of them we rely on the EU standard contractual clauses, and the EU–US Data Privacy Framework where the provider is certified (Annex 3).

If we ever need to move other personal data under this agreement outside the EEA, we tell the Customer first. We then use the EU standard contractual clauses (module 2 or 3) or an adequacy decision.

This agreement shares the liability cap in the main contract. There is one cap for both, not a separate one.

This agreement lasts as long as 3NV processes personal data for the Customer.

Estonian law applies. Disputes go to Harju County Court in Tallinn, as in the Terms of Service.

We review these measures at least once a year. We may change them, but a change never lowers the overall protection.

Who does what

Certifications

• 3NV holds no security certification yet. We are implementing ISO 27001 and aim to be certified in Q2 2027.
• Greenergy's Tallinn DC-1 has been certified to EN 50600 by TÜV NORD CERT (Availability Class 3, Protection Classes 1 to 3). We share the certificate on request. Greenergy also states ISO 27001, ISO 9001 and PCI DSS for its own operations. These cover the facility, not 3NV's information security.

Physical

• As Greenergy publishes for Tallinn DC-1: perimeter fencing with road blocks, thermal and motion cameras with video analytics, 24/7 guard and in-house operations centre, multi-level access control with anti-passback, palm biometrics and mantraps.
• The data centre's staff touch our racks only on a 3NV ticket.
• Visitors by appointment with photo ID.
• Failed Reserve drives destroyed on site.

Access to Customer hardware

• No 3NV access to the Customer's operating system without a written request from the Customer.
• Management controllers are used only for hardware and firmware work.
• Engineers reach management controllers and the remote console over an encrypted private network, from inside the EEA, or through the encrypted VPN when travelling.
• Every login to a management controller or console is logged with who and when. The record is available to the Customer and kept for the term plus one year.

3NV's own systems

• Multi-factor login on business systems.

Network

• Our own network (AS214132).

End of term

• Drives erased with secure erase or cryptographic erase, checked, and certified per serial number. Drives that can't be erased are destroyed on site.

Organisation

• Staff bound by confidentiality, during and after employment.

These are the companies that help us provide our services and may process personal data for our customers. Providers we use only for our own website and sales are in our Privacy Policy.

Questions about this list: privacy@3nv.io.