[ Legal · Nomisma LLC ]

Data Processing Addendum

Version v1 · Effective 26 October 2026 · Last updated 26 October 2026

This Data Processing Addendum sets out the terms on which Nomisma LLC processes personal data on behalf of its Customers in providing Smartsteps. It reflects Article 28 of the GDPR and the UK GDPR and the service-provider requirements of the CCPA, and it forms part of the Terms of Service.

1. Scope and Incorporation

1.1 This Data Processing Addendum ("DPA") applies where Nomisma LLC ("Nomisma" or "Processor") processes Customer Personal Data on behalf of the Customer ("Controller") in providing the Service, and that processing is subject to the GDPR, the UK GDPR or the CCPA.

1.2 For such Customers, this DPA is incorporated into and forms part of the Terms of Service (together with the documents incorporated in them, the "Agreement"). No separate signature is required. If there is a conflict between this DPA and the rest of the Agreement concerning the processing of Customer Personal Data, this DPA prevails. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

1.3 This DPA does not apply to personal data for which Nomisma is a controller, such as account, billing, support-relationship, security and website data. That processing is described in the Privacy Policy.

2. Definitions

In this DPA, capitalised terms not defined here have the meanings given in the Terms of Service, and:

Data Protection Laws means, as applicable to the processing: the GDPR; the UK GDPR and the UK Data Protection Act 2018; and the CCPA.
GDPR means Regulation (EU) 2016/679.
UK GDPR means the GDPR as it forms part of the law of the United Kingdom.
CCPA means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations.
Customer Personal Data means personal data contained in Customer Content that Nomisma processes on the Customer's behalf.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
Standard Contractual Clauses or SCCs means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR, and business, service provider, consumer, sell and share have the meanings given in the CCPA.

3. Roles

3.1 For Customer Personal Data, the Customer is the controller (or business) and Nomisma is the processor (or service provider). Where the Customer is itself a processor for a third party, Nomisma is its sub-processor, and the Customer is responsible for obtaining any authorisations required from that third party.

3.2 The Customer is responsible for the lawfulness of the Customer Personal Data it submits and of its instructions, including having a lawful basis for the processing, giving any required notices, and being authorised to have each Customer Website and document scanned, as required by the Terms of Service and the Acceptable Use Policy.

4. Processing on Documented Instructions

4.1 Nomisma will process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do otherwise by law to which Nomisma is subject. In that case, Nomisma will inform the Customer of that legal requirement before processing, unless the law prohibits it.

4.2 The Agreement, this DPA, the Customer's Orders, and the Customer's use and configuration of the Service (including the websites and documents it submits and the markets it selects) are the Customer's complete documented instructions. Additional instructions require written agreement.

4.3 Nomisma will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

5. Description of Processing

The subject matter, duration, nature and purpose of the processing, and the categories of personal data and data subjects, are described in Annex I.

6. Confidentiality of Personnel

Nomisma will ensure that persons it authorises to process Customer Personal Data, including employees and contractors, are bound by appropriate obligations of confidentiality and have access only where needed for their role. Support staff may view the Customer Content needed to resolve a support ticket. Staff access is role-based, protected by two-factor authentication and recorded in an audit log.

7. Security

7.1 Nomisma will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. The measures in place are described in Annex II and in the Security Overview and Vulnerability Disclosure.

7.2 Nomisma may update those measures from time to time, provided that the update does not materially reduce the overall level of protection.

7.3 The Customer is responsible for its own security choices within the Service, including who it gives access to its Workspace, and for the security of its own systems and credentials.

8. Sub-processors

8.1 The Customer gives Nomisma general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex III and on the Sub-processors page.

8.2 Nomisma will:

impose on each Sub-processor, by written contract, data-protection obligations that provide at least the same level of protection for Customer Personal Data as this DPA, to the extent applicable to the services the Sub-processor provides;
remain responsible to the Customer for the performance of each Sub-processor's obligations; and
give at least thirty (30) days' notice before adding or replacing a Sub-processor, by updating the Sub-processors page.

8.3 The Customer may object to a new Sub-processor on reasonable data-protection grounds by writing to info@nomisma.ai within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the Agreement by written notice before the change takes effect, as its sole remedy for the objection.

9. Assistance with Data Subject Requests

9.1 Taking into account the nature of the processing, Nomisma will assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights under Data Protection Laws.

9.2 If Nomisma receives a request directly from a data subject concerning Customer Personal Data, it will not respond to it except to refer the data subject to the Customer, where the Customer can be identified, and will promptly inform the Customer unless prohibited by law.

10. Personal Data Breaches

10.1 Nomisma will notify the Customer without undue delay after becoming aware of a Personal Data Breach. The notice will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where information is not available at once, Nomisma will provide it in phases as it becomes available.

10.2 Nomisma will take reasonable steps to contain and remedy the breach and will provide reasonable assistance to the Customer in meeting its obligations to notify supervisory authorities and data subjects.

10.3 Notice of a Personal Data Breach is not an acknowledgement of fault or liability.

11. Assistance with Assessments

Taking into account the nature of the processing and the information available to it, Nomisma will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities that the Customer is required to carry out under Data Protection Laws, to the extent they relate to the Service.

12. International Transfers

12.1 Nomisma is based in the United States, and the Service is hosted in the AWS us-east-1 region (Virginia, United States). Customer Personal Data is therefore processed in the United States.

12.2 To the extent the processing involves a transfer of Customer Personal Data from the European Economic Area to Nomisma that requires a transfer mechanism under the GDPR, Nomisma relies on the EU Standard Contractual Clauses, which are incorporated into this DPA by reference as follows:

Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor;
in Clause 7, the optional docking clause does not apply;
in Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in Section 8 of this DPA;
in Clause 11, the optional language does not apply;
in Clause 13, the competent supervisory authority is the one determined in accordance with that Clause;
in Clause 17, Option 1 applies and the governing law is the law of Ireland;
in Clause 18, disputes are resolved before the courts of Ireland; and
Annexes I, II and III of the SCCs are completed with the information in Annexes I, II and III of this DPA.

12.3 To the extent the processing involves a transfer of Customer Personal Data from the United Kingdom that requires a transfer mechanism under the UK GDPR, Nomisma relies, where applicable, on the UK International Data Transfer Addendum, which is incorporated by reference and completed with the information in this DPA and its Annexes. Neither party may end the UK Addendum under its Section 19 except as that Section allows.

12.4 Nomisma's representative in the European Union and the United Kingdom under Article 27 of the GDPR and the UK GDPR is to be designated if and when required.

13. CCPA Service-Provider Terms

Where the CCPA applies, Nomisma, as service provider:

will process Customer Personal Data only for the limited and specified business purpose of providing the Service described in the Agreement and Annex I;
will not sell or share Customer Personal Data;
will not retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purpose specified in the Agreement, or outside the direct business relationship between the Customer and Nomisma, except as the CCPA permits;
will not combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as the CCPA permits;
will comply with the CCPA and provide the same level of privacy protection as the CCPA requires of businesses;
will notify the Customer if it determines that it can no longer meet its obligations under the CCPA; and
grants the Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data.

Nomisma certifies that it understands and will comply with these restrictions.

14. Deletion and Return

14.1 During the term, the Customer may view, download or print its Reports in the Service and may ask Nomisma for a copy of its Customer Content by writing to info@nomisma.ai.

14.2 When a Workspace is deleted, including when its only member deletes their account in Settings (Delete my account), its Customer Content, including crawl evidence and Reports, is deleted immediately from the live database. Database backups expire within seven days. The Customer may also instruct Nomisma to delete a Workspace by writing to info@nomisma.ai.

14.3 Crawl evidence files, including screenshots, are deleted together with the Workspace. Nomisma does not keep a separate copy of crawl evidence after a Workspace is deleted, except in database backups that expire within seven days.

14.4 Nomisma may retain Customer Personal Data where required by law, subject to the confidentiality and security obligations of this DPA.

15. Information and Audits

15.1 Nomisma will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, including written responses to reasonable security and privacy questionnaires.

15.2 Where that information is not sufficient to demonstrate compliance, or where a supervisory authority requires it, Nomisma will allow for and contribute to audits, including inspections, by the Customer or an independent auditor it mandates. Audits require at least thirty (30) days' written notice, are limited to once in any twelve-month period (unless following a Personal Data Breach or required by a supervisory authority), must take place during normal business hours, must be subject to appropriate confidentiality obligations, and must not compromise the security of the Service or the data of other Customers. The Customer bears its own costs of any audit.

15.3 Nomisma does not currently hold third-party security certifications. Sub-processors' own certifications and reports may be available from those Sub-processors.

16. Liability and Term

16.1 Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except to the extent that such limitation is not permitted under Data Protection Laws or the Standard Contractual Clauses.

16.2 This DPA remains in effect for as long as Nomisma processes Customer Personal Data on the Customer's behalf.

17. Annex I: Parties and Description of Processing

Item	Description
Data exporter / controller	The Customer, as identified by its Workspace and account details in the Service. Contact: the Users with access to the Workspace. Activities: use of the Service to assess its policies and websites against legal obligations. Role: controller (or processor, where it acts for a third party)
Data importer / processor	Nomisma LLC, a limited liability company formed under the laws of the State of Wyoming, United States. Address: 30 N Gould St, Ste R, Sheridan, Wyoming 82801, United States. Telephone: +1 510-565-0510. Contact: info@nomisma.ai. Activities: provision of the Smartsteps Service. Role: processor
Categories of data subjects	Individuals whose personal data appears in Customer Content, such as: the Customer's personnel and contact persons named in its policies, imprint or website; operators of the Customer Website; and any other individual whose personal data appears in a document submitted or on a page crawled
Categories of personal data	Names, job titles, business contact details (email, postal address, telephone) and other information appearing in submitted documents or on crawled pages; personal data visible in screenshots of Customer Websites; the content of support tickets to the extent it contains such data. The crawler records form field names and types only, never values, and never submits forms
Sensitive data	None intended. The Customer must not submit special categories of personal data except to the limited extent they appear in a public policy document or on a public page of a Customer Website
Frequency of transfer	Continuous, for the duration of the Agreement, including monthly re-checks on Plans that include them
Nature of processing	Collection by an automated headless browser (SmartstepsBot) from Customer Websites; receipt of uploaded and linked documents; optical character recognition; storage; parsing and clause labelling; evaluation by AI models (Anthropic's Claude models through Amazon Bedrock, or through Anthropic's API as a fallback); second-opinion review; generation of Reports; display to Users; support access; backup; deletion
Purpose	To provide, maintain, secure and support the Service for the Customer, as described in the Terms of Service
Retention	While the Workspace exists, then as described in Section 14 (deleted with the Workspace; backups expire within seven days)
Transfers to Sub-processors	As listed in Annex III, for the purposes stated there, for the duration of the Agreement
Competent supervisory authority	As determined under Clause 13 of the SCCs

18. Annex II: Technical and Organisational Security Measures

Hosting. The Service runs on Amazon Web Services in the us-east-1 region (Virginia, United States), on Amazon ECS with AWS Fargate.
Encryption in transit. All connections to the Service use TLS 1.2 or higher.
Encryption at rest. The PostgreSQL database (Amazon RDS) is encrypted at rest using keys managed in AWS Key Management Service. Files and evidence in Amazon S3 are encrypted at rest.
Evidence integrity. Each analysis records the versions of the law database, prompts and documents it used, so results can be traced to their inputs.
Secrets. Application secrets are stored in AWS Secrets Manager rather than in code.
Least privilege. Cloud components operate under AWS Identity and Access Management roles granted only the permissions they need.
User authentication. Passwords are hashed with Argon2id. Email addresses are verified. Repeated failed sign-in attempts lead to account lockout. Sign-in errors are uniform, so they do not reveal whether an account exists. Single-use sign-in links are available.
Sessions. Sessions are held on the server and referenced by httpOnly, Secure cookies, so they can be revoked server-side.
Workspace access. Access to a Workspace's data is limited to the Users of that Workspace, according to their role, and to authorised Nomisma staff.
Staff access. Staff use a separate administration site, with time-based one-time-password two-factor authentication, role-based permissions and a short-lived session. Staff access to Workspace data is recorded in an audit log.
Audit logging. Security-relevant actions are recorded in audit logs, retained for two years.
Monitoring. Operational logs and metrics are collected in Amazon CloudWatch.
Perimeter. A web application firewall (AWS WAF) can be applied in front of the Service.
Payments. Payment card data is collected and processed by Stripe and never reaches Nomisma's systems.
AI processing. AI inference runs through Amazon Bedrock, which does not use customer inputs or outputs to train the underlying models. Nomisma does not use Customer Content to train models. Passwords and payment details are never sent to AI models.
Crawler safeguards. The crawler identifies itself, never submits forms and does not record form values.
Backups and deletion. Database backups expire within seven days. Deletion is carried out as described in Section 14.
Vulnerability management. Nomisma accepts vulnerability reports and offers safe harbour for good-faith research, as described in the Security Overview and Vulnerability Disclosure.

19. Annex III: Sub-processors

Sub-processor	Purpose	Location
Amazon Web Services, Inc.	Hosting and compute, including the crawler; database; file and evidence storage; secret storage; transactional email; DNS; logging and monitoring; optical character recognition (Amazon Textract); AI inference (Amazon Bedrock)	United States (us-east-1, Virginia)
Stripe, Inc.	Payment processing	United States
Anthropic, PBC (conditional)	AI inference through Anthropic's API, used only as a fallback provider	United States

The current list is maintained on the Sub-processors page.