1. Parties and scope
The customer is the controller for customer CRM data. Nest Digital Canada Inc. is the processor for that data. This DPA applies when Nestree processes personal data on behalf of the customer in connection with the service.
2. Processing details
- Subject matter: operation of the Nestree CRM service.
- Duration: the term of the customer account plus the period needed for deletion, export, backup expiry, legal compliance, and security retention.
- Nature and purpose: hosting, securing, organizing, searching, exporting, erasing, emailing, analyzing, and assisting with CRM workflows selected by the customer.
- Categories of data subjects: the customer's users, employees, leads, contacts, customers, support requesters, and business counterparties.
- Categories of data: contact details, company details, pipeline records, tasks, notes, messages, consent records, support tickets, custom fields, AI prompts and outputs, usage logs, and audit records.
3. Processor obligations
- Process customer personal data only on documented instructions from the customer, including instructions contained in the product and online terms.
- Ensure personnel authorized to process personal data are bound by confidentiality obligations.
- Apply appropriate technical and organizational measures to protect customer personal data.
- Assist the customer, where reasonably possible, with data-subject requests, security obligations, DPIAs, and regulator inquiries.
- Notify the customer without undue delay after becoming aware of a personal-data breach affecting customer personal data.
- Delete or return customer personal data at the end of service, subject to legal, backup, audit, and security retention needs.
4. Customer obligations
- Use Nestree lawfully and provide all notices, consents, and lawful bases required for the customer's CRM data.
- Configure access, roles, exports, erasure, campaigns, and AI features responsibly.
- Do not submit prohibited sensitive data unless the customer has a lawful basis and the service is appropriate for that processing.
- Respond to data-subject requests where the customer is the controller.
5. Security measures
- Postgres row-level security for tenant isolation.
- Authentication and session controls through Supabase Auth.
- Encryption in transit and at rest through managed platform providers.
- Server-only handling of secret keys and service-role access.
- Least-privilege database access for normal application paths.
- Export, erasure, AI-use, and usage-signal records to support accountability.
- Security headers, health checks, CI checks, and dependency review as part of launch hardening.
6. Sub-processors
The customer authorizes the sub-processors below. Nest Digital Canada Inc. remains responsible for sub-processor performance to the extent required by applicable data protection law.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Managed Postgres database, authentication, and platform services | Canada, ca-central-1 |
| Vercel | Application hosting, deployment, edge delivery, and web analytics | Global edge, United States control plane |
| Anthropic | Claude inference for assistive AI features selected by users | United States |
| Resend | Transactional and campaign email delivery when email features are enabled | United States |
7. International transfers
The primary database is hosted in Canada, in ca-central-1. Some sub-processors may process data in the United States or through global infrastructure. Where required, Nest Digital Canada Inc. uses appropriate contractual and transfer safeguards.
8. Audit cooperation
Nest Digital Canada Inc. will make reasonable information available to demonstrate compliance with this DPA. Audit requests must be proportionate, scoped to Nestree, protect the confidentiality of other customers and platform providers, and avoid disrupting service operations.
9. Contact
DPA and privacy questions can be sent to privacy@nestdigital.ca.