Legal
Data processing agreement
This is a draft, not yet reviewed by a lawyer
This text sets out as precisely as we can what Nermio actually does with data, so that a lawyer has something to build on. It is not legally binding and not something to rely on. Where a choice has to be made, you'll find a marked placeholder with the question in it rather than an invented clause.
Draft of 4 November 2026. While that status holds, the page sits in the footer but not in the sitemap, and asks search engines to leave it out. If you need a data processing agreement now, ask us for one at info@nermio.com.
The Dutch text is the binding one
Nermio is a Dutch company, the agreement is governed by Dutch law, and the Dutch version is the text a lawyer reviews. This English version is a translation offered for convenience. Where the two differ, the Dutch text prevails.
If you put your contacts' details into Nermio, we process personal data on your behalf. Below is what we do and don't do with it, how it is walled off, and what still has to be agreed.
Parties and status
This data processing agreement belongs with the terms and conditions. You decide which details you record about your contacts and why; you are therefore the controller. Nermio processes those details only to make the software work, and is therefore the processor.
For your own account details the split is different: there Nermio decides what happens. That part is in the privacy notice, not here.
To be settled by a lawyer
Which legal entity is the processor (name, legal form, Chamber of Commerce number, address), and how does a customer receive and accept this agreement?
Two gaps that belong together. The legal entity isn't fixed anywhere — the same gap as in the privacy notice and article 1 of the terms. And there is no process: the homepage says a data processing agreement comes with your account, but nobody receives one, accepts one at sign-up or signs one. While that is the case, the promise isn't kept — and the existence of this page doesn't keep it either.
Article 1. Subject matter and instructions
Nermio processes personal data solely on behalf of the customer and for the purposes in Annex 1. Processing takes place on the customer’s instructions; use of the service, the settings the customer chooses and this agreement together constitute those instructions. Nermio does not process customer data for its own purposes.
In concrete terms: we do not sell it, do not pass it to third parties for advertising, and do not use it to train models. If Nermio considers that an instruction appears to conflict with the law, it says so before carrying it out.
Article 2. Confidentiality
Everyone who can reach customer data on Nermio’s behalf is bound to confidentiality, and access stays limited to what the work requires. Nermio is small at the moment: in practice this means the person who builds the product. That is a more honest way of putting it than a general formulation about “authorised personnel”.
To be settled by a lawyer
How do we put confidentiality in writing for future employees and for contracted help?
Article 3. Security
Nermio takes appropriate technical and organisational measures, described in Annex 2. Those measures may be changed as long as the level of protection does not drop as a result.
To be settled by a lawyer
Is the data also encrypted at rest, and to what standard?
Traffic over an encrypted connection we can confirm, and we encrypt the AI keys ourselves (AES-GCM, with a secret held outside the database). Encryption of the database storage belongs to the database provider; that has to be checked with them before it stands in Annex 2 as a promise.
To be settled by a lawyer
Who can log in to the production environment of the database provider and the hosting provider, and with what protection?
Inside the software the second factor is mandatory and that is verifiable. Who can get into the Supabase or Vercel dashboard is not in this code — that is a setting at those providers and belongs here as a recorded fact, not an assumption.
Article 4. Sub-processors
The customer consents to the sub-processors listed in Annex 3. If Nermio wants to add or replace one, it gives at least thirty days’ notice. The customer may object; if the parties cannot agree, the customer may terminate the subscription with effect from the date the change takes effect. Nermio imposes on a sub-processor the same obligations as are set out in this agreement.
Article 5. Transfers outside the EEA
A transfer to a country outside the European Economic Area takes place only on a valid basis: an adequacy decision, or standard contractual clauses with the necessary supplementary measures.
To be settled by a lawyer
Which transfer route applies to each sub-processor in Annex 3, and does customer data leave the EEA with any of them?
Three of the four providers are US companies with European regions. For each one it has to be established where the data sits, whether their support can reach it and on what basis. Without that answer this agreement cannot be offered; the same question stands in the privacy notice.
Article 6. The customer’s AI providers
If the customer connects an API key of their own from an AI provider, that provider is not a sub-processor of Nermio. The customer has their own agreement with them and pays for the usage directly. Nermio sends data to that provider only when a user asks it to in the software, sends a fixed selection of fields from the record, and does not keep the answer.
Article 7. Assistance with data subject requests
If one of your contacts asks for access, correction or erasure, you handle it; it is your data in your workspace, and you can view, change, export and delete it there yourself. If the screens on offer don’t get you there, Nermio helps. If a request reaches us by mistake, we forward it to you and do not answer it ourselves.
Article 8. Personal data breaches
If Nermio becomes aware that data from your workspace has been seen or has got out, it tells you without undue delay, with what is known at that point: what happened, which categories of data and roughly how many people are affected, the likely consequences, and the measures taken.
Notifying your supervisory authority or the people affected is your decision, because you are the controller — for a Dutch customer that authority is the Autoriteit Persoonsgegevens, for a British one the ICO. We supply the information you need in order to do it.
To be settled by a lawyer
Within what period do we report a breach, and what must that report contain as a minimum?
The supplied draft set proposes forty-eight hours after discovery. That is customary, and it is the customer who is bound to a 72-hour deadline with their authority, so they need room left over. Whether we can keep to 48 hours with a one-person team is a realistic judgement and not a formality — and a deadline you miss is worse than a wider one you keep.
Article 9. Assistance with other obligations
Nermio assists the customer, as far as reasonable and necessary, with a data protection impact assessment (DPIA) and with any prior consultation of the supervisory authority, by supplying information about the processing and the measures.
Article 10. Audits
On request, Nermio gives the customer the information needed to assess whether this agreement is being complied with. If the customer wants more, they may have an audit carried out by an independent expert bound to confidentiality, with four weeks’ notice, at most once a year — unless there is specific cause — and at the customer’s expense.
There is no ISO 27001 or SOC 2 report and no external penetration test report; what there is can be found on the security page and in Annex 2.
Article 11. Term and ending
This agreement runs for as long as Nermio processes personal data for the customer. If the subscription ends, there should be a clear moment at which the customer data is deleted, and before that the opportunity to obtain a copy. Data Nermio is required by law to keep — invoices and payments — stays, independently of this agreement.
How it works today: the automatic clean-up does not touch customer data, so nothing disappears by itself after termination. Deleting is an action here that requires a stated reason, that only a super admin can perform, and that stays in the security log. And the export only works while the organisation is not suspended.
To be settled by a lawyer
How long does the data stay after termination, within what window can the customer export, in what form is a copy supplied, and when is it gone from the backups too?
This is a real gap, not a matter of wording. The supplied set says thirty days; those thirty days are not built, and access closes on the end date instead. On top of that comes the backup question: that rhythm belongs to the database provider and determines when something is really gone. The agreement and the technology have to be settled here together; the same question stands in the privacy notice and in article 8 of the terms.
Article 12. Liability
For liability under this agreement, article 11 of the terms and conditions applies. That article is still a proposal there with an open question; while that is the case, the same uncertainty applies here.
Annex 1. The processing
| Topic | What has been agreed |
|---|---|
| Purpose | Providing a CRM: managing relationships, a sales pipeline, tasks and follow-ups, and supporting the customer in that. |
| Nature of processing | Storing, organising, displaying, changing, exporting and deleting. At a user's request: forwarding a selection of fields to the customer's AI provider (article 6), and accepting an email the user has sent to their organisation's own BCC address. |
| Data subjects | Contacts at the customer's business relations, and the users the customer invites themselves. |
| Data about relations | Company name, town, country, sector, size, website, Chamber of Commerce number, customer number and payment terms; per contact a name, job title, email address and phone number; deals with a title, a value and a stage; tasks with a date; activities such as a call or an email; free-text notes; and — if the customer uses their organisation's BCC address — the subject of such a message, its first two sentences, the email addresses involved and the time. |
| Data about users | Name, email address, role and status, plus a record of their actions in the audit log, with IP address and browser information. If someone sends a message to the customer's BCC address from an address that doesn't belong to it, only that address is kept, with a timestamp (90 days), so the customer can see why the message didn't arrive. |
| Special categories of data | There is no field for special categories or criminal offence data, and the service is not intended for them. The note fields are free text, so technically the customer can type anything into them; they shouldn't, and it falls under their own responsibility from article 8 of the terms. |
| Duration | For as long as the subscription runs. What applies afterwards is the open question at article 11. |
Annex 2. Security measures
This is the part that is built today and that you can check. The fuller description is on the security page.
- Separation per organisation in the database itself. Not in the screens, but in Postgres with row level security on every table: the database decides for every query which rows a signed-in account may see. A mistake in the application therefore cannot surface data from another organisation, and there is a test suite that demonstrates that isolation.
- Roles and permissions per user, from full access to read-only, also enforced in the database.
- An audit log that only grows. Changing or deleting a line has been made impossible, including for our highest admin role, with exactly one named exception for the automatic clean-up.
- Support access with a reason and a time limit. Fifteen, thirty or sixty minutes and never longer, always with a stated reason, read-only by default, never with the ability to delete, and readable afterwards by the owner of the organisation.
- Two-factor authentication for everyone. Not only for our admin portal but for every user of the CRM, without exception. On top of that the software logs you out after eight hours without activity.
- Encrypted connections with HSTS, and a Content Security Policy with a nonce per request.
- Passwords we cannot read — they sit hashed at the authentication service — with a policy of at least twelve characters and a check against known breached passwords. API keys from AI providers are stored encrypted (AES-GCM), with the secret held outside the database.
- A brake on login attempts that closes if it fails itself, a security log with an alert on repeated failed attempts, and the ability to block an IP address.
To be settled by a lawyer
How often does the database provider take backups, how long are they kept, and can the customer rely on them?
Without that figure Annex 2 is incomplete and article 11 cannot be answered. The rhythm belongs to the database provider; we don't set it.
To be settled by a lawyer
Do we keep this annex up to date as the technology changes, and how do we stop it going stale?
An annex of measures is contractually binding. If something in the software changes, this list has to follow — otherwise we end up promising something that no longer works that way, or staying quiet about something that has got better.
Annex 3. Sub-processors
Nermio does not run on its own servers. These providers process customer data because the service doesn’t work without them.
| Provider | Service | What happens to customer data |
|---|---|---|
| Supabase | Database and authentication | The Postgres database holding all customer data, and the signing in of users. |
| Vercel | Hosting | Running the application; customer data passes through it on every request and is not stored there separately. |
| Resend | Transactional email | Invitations and password resets: a user's email address and name. No data about the customer's business relations. |
| Cloudflare | Abuse checks on forms | The IP address and browser characteristics of whoever submits a form. No content from the CRM. |
To be settled by a lawyer
For each provider: what is the legal entity, the country of establishment, the region the data sits in, and the transfer route?
The database region is known: Supabase sits on eu-central-1 (Frankfurt), confirmed by the owner who set the project up there. Still open are the legal entity per provider, where the Vercel environment runs and which transfer route applies. This is the annex a business customer looks at first, so no assumptions belong in it. If a payment provider is added, it belongs in here too.
Relationship to the terms
If this agreement and the terms and conditions contradict each other on a point that concerns personal data, this agreement prevails. How consent is recorded is the open question at the top of this page.