Data Processing Agreement

The standard contractual clauses between controllers and processors adopted by the European Commission under Article 28(7) GDPR, in Implementing Decision (EU) 2021/915, are incorporated into this DPA by reference. The customer is the controller and Nodes-IP is the processor. Where the clauses leave a choice, the parties choose as follows:

• Clause 1: Option 1, Article 28(3) and (4) of Regulation (EU) 2016/679 (GDPR).
• Clause 5 (docking clause): not used.
• Clause 7.7: Option 2, general written authorisation, with 30 days of notice (section 2).
• Clauses 8 and 9: Option 1, the articles of the GDPR.

The annexes to the clauses are completed below. Sections 2 to 6 add safeguards, as Clause 2(b) permits. Where anything in this DPA or another agreement between the parties conflicts with the clauses, the clauses prevail.

The agreed list of sub-processors under Clause 7.7(a) is the public list at /legal/sub-processors, which records every change with its date. Nodes-IP informs the customer by email, sent to the address of the account, at least 30 days before it adds or replaces a sub-processor. The notice names the provider, its purpose, the data it processes and where it operates.

The customer can object by writing to info@nodes-ip.com within those 30 days. If Nodes-IP cannot resolve the objection, the customer may terminate the agreement before the new sub-processor is engaged.

Nodes-IP stores customer data in the EU. Some sub-processors operate outside the European Economic Area, and the list at /legal/sub-processors shows where each one does. Transfers to them rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified providers, or on the Commission’s standard contractual clauses under Article 46(2) GDPR, as Clause 7.8(b) allows.

Nodes-IP does not use customer data, including matter content and AI assistant conversations, to train or fine-tune AI models. Its AI providers process customer data under terms that exclude training their models on it.

Nodes-IP treats all customer data as confidential, including invention disclosures that have not been filed. It discloses customer data only on the customer’s instructions, to its sub-processors to the extent they need it to provide the service, or where Union or Member State law requires it. In that case it informs the customer first, unless that law forbids it.

On request, Nodes-IP makes available the information needed to demonstrate compliance, as Clause 7.6 requires. This includes the access records for the customer’s matters: every read or change of matter content is written to an append-only log that records who, when, which matter and the outcome, never the content itself.

Controller

The customer that holds the account, as identified by its account and billing details. Contact: the email address of the account.

Processor

Nodes-IP, Roerstraat 25, 7523TK Enschede, Netherlands, Chamber of Commerce (KvK) number 42039112, VAT number NL005448587B73. Contact: info@nodes-ip.com.

Accession date

The date the customer accepts the Terms of Service. A copy signed by the processor is available on request.

Data subjects

The customer’s own users; inventors, applicants, representatives and other persons named in the customer’s matters; persons named in documents the customer uploads.

Personal data

Account data (name, email address, sign-in identifiers); names, addresses and roles of the parties to a matter; personal data contained in matter content (invention disclosures, claims, drafts, figures, uploaded files, AI assistant conversations); access records (user, time, matter, outcome, IP address and browser).

Sensitive data

None intended. The service is not designed for the special categories of data in Article 9 GDPR, and the customer should not upload them. All matter content is protected by the measures in Annex III.

Nature

Hosting and storage, retrieval and display, search, processing of prompts and matter context by AI models, export, and deletion.

Purpose

Providing the service the customer has subscribed to, including prior art search, claims drafting, figures, application composition and the AI assistant, and keeping it secure.

Duration

The term of the customer’s agreement, followed by deletion as set out in Annex III.

Sub-processors

The subject matter, nature and data of each sub-processor’s processing are stated at /legal/sub-processors. Each processes for the term of the customer’s agreement.

• Location. The application and its databases run in Amsterdam, and file storage is held in the EU. Data sent to sub-processors outside the EEA is limited to what each one needs, as stated on the sub-processor list.
• Encryption. All traffic is encrypted with TLS. Databases and file storage are encrypted at rest.
• Customer isolation. Each customer’s data is separated by row-level security in the database, so a fault in the application cannot return another customer’s data.
• Identification and authorisation. Users sign in through Google, Microsoft or a one-time code sent by email. Every request is checked against the user’s right to the specific matter it touches.
• Access logging. Every read or change of matter content is written to an append-only log that the application cannot edit or delete, holding identifiers and outcomes only. The log survives account deletion and is kept as long as legal obligations require.
• Data minimisation. AI requests carry only the context needed for the task. Application logs and error reports hold identifiers, never matter content, and are kept for 30 days.
• Security testing. Every code change gets an automated security review before it ships, and the whole codebase is re-reviewed weekly.
• Backups and restore. Database backups are kept for 27 days. If a backup is ever restored, deletions requested after it was taken are re-applied before the restored data is served.
• Return and deletion. The customer can export its matter data at any time. On deletion of a matter or an account, or at the end of the agreement, the personal data is removed from live systems immediately and purged from all backups and logs within 30 days. Access records, which hold no content, are kept as set out in the privacy policy.
• Assistance to the controller. Users can view, correct, export and delete their data in the service themselves. Nodes-IP forwards any request it receives from a data subject to the customer and assists with requests, impact assessments and breach notifications through info@nodes-ip.com. A personal data breach is notified to the email address of the account.