Data Processing Agreement

This Data Processing Agreement ("DPA") is between you, the business customer that holds the account ("Customer", "you"), and TIMPIA S.R.L., operating as Noda Energy ("Noda", "we", "us"). Our company details are in Section 1 of the Terms and Conditions. This DPA sets out how we process personal data for you when you use the Service. It contains the terms Article 28(3) of the GDPR requires.

This DPA forms part of the Terms. It applies to every business customer automatically from sign-up, and no signature is needed. You accept it when you accept the Terms, in the ways Section 2 of the Terms describes. It is a contract in electronic form, which Article 28(9) GDPR allows.

If you need a copy signed by us, write to hello@noda.energy and we will send it. If you and we have signed a data processing agreement on your own form, that agreement prevails over this DPA where the two conflict.

Where this DPA and the rest of the Terms conflict on the processing of personal data, this DPA prevails.

"GDPR" means Regulation (EU) 2016/679. "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings the GDPR gives them. "Service", "report" and "Terms" have the meanings the Terms give them. "EEA" means the European Economic Area.

Project material means everything you and your users submit to the Service, such as prompts, notes, site geometry and uploaded files, and everything the Service produces from it for you, such as projects, maps, chats and reports.

Customer personal data means the personal data contained in project material.

Each party complies with applicable data protection law. For customer personal data, you are the controller and we are your processor. Annex 1 describes that processing.

For account, billing and security data, we are the controller, as Section 12 of the Terms states. That covers the names and work emails of your users, your plan, invoices and payment status, and technical logs. The GDPR page covers that data. This DPA does not.

If you act as processor for another controller, for example as a consultant working for a developer, you confirm that the controller has authorised your instructions and our engagement. We then act as your sub-processor. You remain our only point of contact, and you pass on to that controller what it needs from this DPA.

We process customer personal data only on your documented instructions. This includes any transfer of it to a country outside the EEA. Your instructions are:

• the Terms and this DPA;
• what you and your users do in the Service, such as the prompts you write, the files you upload, the settings you choose and the projects you delete;
• any further instruction you give us in writing at hello@noda.energy that is consistent with the Terms. If an instruction needs something the Service cannot do, we tell you.

We do not process customer personal data for our own purposes, with one exception you authorise by accepting the Terms: to improve the Service, as Section 10 of the Terms describes, our engineers may read project material to find faults and to make Noda AI work better. No personal data from it goes into Noda's prompts, examples or tests, none of it is shown to another customer, and we do not use it to train AI models. This exception applies to accounts created from 17 October 2026. For an older account, it applies only if you agree.

If EU or Member State law requires us to process customer personal data in another way, we tell you of that legal requirement before we process, unless that law forbids it on important grounds of public interest. This includes an order from a court, a regulator or another public authority to disclose customer personal data.

If we think an instruction infringes the GDPR or other EU or Member State data protection law, we tell you immediately. We may pause that instruction until you confirm or change it.

You are responsible for the lawfulness of the processing you instruct. In particular, you:

• have a lawful basis for the personal data you put in project material, as Section 9 of the Terms requires;
• give data subjects the information Articles 13 and 14 GDPR require, where they apply to you;
• do not upload special categories of personal data (Article 9 GDPR) or data about criminal convictions and offences (Article 10 GDPR) unless the work needs it and the processing is lawful;
• give only instructions that comply with the GDPR.

Put in project material only the personal data the work needs. You are also responsible for the security of your users' credentials, as Section 9 of the Terms states.

Only the people at Noda who need access to customer personal data to run, support and secure the Service have it. Each of them has committed to confidentiality or is under a statutory duty of confidentiality, and their obligations are at least as protective as Section 11 of the Terms.

Project material is your confidential information under Section 11 of the Terms. That Section continues to apply to customer personal data alongside this DPA.

We take the technical and organisational measures Article 32 GDPR requires. They take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risk to the rights and freedoms of data subjects. Annex 2 lists them.

We may update the measures as technology and risks change. An update will not reduce the overall level of security that Annex 2 describes.

You give us general written authorisation to engage sub-processors, as Article 28(2) GDPR allows. The current list, with what each sub-processor does and where it is, is published at trust.noda.energy/#subprocessors. By accepting this DPA you authorise the sub-processors on that list on that date.

New sub-processors. At least 15 days before a new sub-processor starts processing customer personal data, we tell you by email to the account's billing owner and post the change on the Updates list of that page. The same applies when we replace a sub-processor.

Your right to object. You may object within those 15 days on reasonable data protection grounds, by writing to hello@noda.energy. We will discuss the objection with you in good faith and look for a way to address it. If we cannot, you may terminate the agreement by notice before the new sub-processor starts processing your customer personal data. Section 4 of the Terms then governs any unused credits.

How we bind them. We engage each sub-processor under a written contract that imposes data protection obligations at least as protective as this DPA. In particular, it must give sufficient guarantees that the sub-processor applies the measures Article 32 GDPR requires. If a sub-processor fails to meet its data protection obligations, we remain fully liable to you for its performance, as Article 28(4) GDPR requires.

Some sub-processors on the list at trust.noda.energy/#subprocessors are outside the EEA, and the list shows where each one is. You instruct us to make those transfers under this DPA.

We transfer customer personal data outside the EEA only with a safeguard that Chapter V GDPR accepts:

• an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified under it; or
• the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, in the module that fits the transfer.

If a safeguard stops applying to a transfer, we put another one in place or stop the transfer. On request, we tell you which safeguard applies to each sub-processor.

If a data subject asks us to exercise a GDPR right over customer personal data, we do not answer the request ourselves. We pass it to you without undue delay and tell the data subject that we have done so. We answer the data subject directly only if you instruct us to or the law requires it.

Taking into account the nature of the processing, we help you answer these requests through appropriate technical and organisational measures. You can delete a project in the app, and you can open and export your reports there. For anything the app does not do, such as a full export or the deletion of an account, write to hello@noda.energy. We will do it in time for you to answer within the period Article 12(3) GDPR allows.

Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 GDPR:

• security of processing (Article 32), by keeping the measures in Annex 2 in place;
• notification of a personal data breach to the supervisory authority and to data subjects (Articles 33 and 34), as Section 12 sets out;
• a data protection impact assessment (Article 35), by giving you the information about the Service that you need for it;
• prior consultation with the supervisory authority (Article 36), by giving you the same information.

We also cooperate with a supervisory authority on its request, as Article 31 GDPR requires.

If we become aware of a personal data breach affecting customer personal data, we notify you within 24 hours of becoming aware of it, as Section 7 of the GDPR page states. We send the notice by email to the account's billing owner.

The notice describes, as far as we know at the time:

• the nature of the breach, including, where possible, the categories and approximate number of data subjects and records concerned;
• its likely consequences;
• the measures we have taken or propose to take to deal with it and to limit its effects;
• the contact point at Noda who can give you more information.

Where we cannot give all of this at once, we give it in phases without further undue delay. We take reasonable steps to contain the breach and find its cause, and we give you what you need to document it under Article 33(5) GDPR.

You decide whether to notify the supervisory authority and data subjects. We do not notify them of a breach of customer personal data for you unless you ask us to or the law requires it. A notice from us is not an admission of fault.

On request, we make available the information you need to show that we meet our obligations under Article 28 GDPR and this DPA.

You may verify our compliance once in any twelve-month period, on 30 days' notice and at your own cost. You do so in two steps:

• you send us a written questionnaire, and we answer it in writing;
• where the questionnaire does not answer your question, we hold a remote session with the engineers who run the platform.

If the questionnaire and the remote session still do not let you verify our compliance, we allow for and contribute to an inspection, as Article 28(3)(h) GDPR requires. You or an independent auditor you mandate may carry it out, within the same limits of frequency, notice and cost. We agree its scope, date and length with you in advance. The auditor must be bound by confidentiality and must not be a competitor of Noda. An inspection covers only the processing under this DPA and does not give access to the data of other customers.

To start a verification, write to hello@noda.energy. These limits do not restrict the powers of a supervisory authority.

When the Service ends, you choose whether we return or delete customer personal data.

• Return. On termination we keep your reports available for 30 days so that you can export them. No request is needed. If you need an export of other project material, write to hello@noda.energy within those 30 days.
• Deletion. Write to hello@noda.energy and we will delete customer personal data within 30 days and confirm when it is done. You can also ask for this at any time while the account is open.

After access ends, we only store customer personal data until you ask us to delete it. Deletion covers all existing copies, unless EU or Member State law requires us to keep them. Where the law requires us to keep data, we keep it confidential and process it only for the purpose that law sets.

This DPA applies for as long as we process customer personal data for you. That includes the period after the agreement ends, until we have returned or deleted it.

Section 16 of the Terms governs liability under this DPA. Under that Section, the twelve-month cap does not apply to a party's liability under Article 82 GDPR for damage caused by its own processing, to a breach of Section 11 of the Terms, or to the other cases that Section lists.

Section 19 of the Terms governs this DPA. Romanian law applies, and the courts of Brașov, Romania have exclusive jurisdiction. Each party gives notices by email, as that Section sets out.

We may change this DPA as Section 17 of the Terms allows. Where a change materially affects you, we give you at least 30 days' notice by email before it takes effect, and you may terminate before it does. Changes required by law may take effect sooner where the law requires. The date at the top of this page shows the version in force.

• Parties and roles. You are the controller, or a processor acting for another controller as Section 3 describes. Noda is the processor. Data protection questions go to hello@noda.energy.
• Subject matter. The personal data in the project material that you and your users submit to the Service, and in what the Service produces from it for you.
• Duration. The term of the agreement under the Terms, and after it until we return or delete customer personal data under Section 14.
• Nature of the processing. Collection through prompts and uploads, storage, reading and analysis by AI models, combination with public grid, map, register and market sources, organisation into projects, maps, chats and reports, transmission to the sub-processors listed at trust.noda.energy/#subprocessors, making it available to the users of your account, export and deletion.
• Purpose. Running the platform for you: AI analysis of the grid, site and market questions you ask, storing your projects and files, producing reports, and supporting your account.
• Frequency. Continuous, for as long as you use the Service.
• Types of personal data. Whatever you put in project material. We expect names, roles and contact details of people named in documents, such as landowners, your staff and staff of grid operators, authorities and counterparties; information that links a named person to a parcel of land; personal data in the prompts you write and the files you upload; and the same data where it appears in the projects, maps, chats and reports the Service produces.
• Special categories. None are expected. You must not upload special categories of personal data or data about criminal convictions and offences unless the work needs it and the processing is lawful, as Section 5 sets out.
• Categories of data subjects. Landowners, land users and their representatives; your staff and the users of your account, where they appear in project material; contacts at grid operators, authorities, contractors, advisers, financiers and counterparties; any other person named in project material.
• Retention. While the account is open. After termination, reports stay available for 30 days for export. We delete customer personal data within 30 days of your request.
• Sub-processors and transfers. As published at trust.noda.energy/#subprocessors, under Sections 8 and 9.

These are the measures we have in place on the date at the top of this page. Section 7 says how they may change.

• Where the data is. Noda's servers, database, files and backups are at Hetzner Online in Falkenstein, Germany.
• In transit. Every public address of the Service uses HTTPS. A plain HTTP request is sent on to HTTPS.
• Sign-in. Passwords are stored only as bcrypt hashes. Sign-in tokens live in cookies that scripts cannot read. A password change ends the sessions that were open before it. Each network address can try to sign in only a limited number of times a minute. Company accounts can use single sign-on with SAML or OpenID Connect.
• Separation between customers. Every request for a project checks that the user is a member of the company that owns it.
• Code that Noda AI runs. It runs in its own container under gVisor, with every Linux capability dropped, on a separate network that cannot reach our internal services, other containers or the server itself.
• Access to production. Only the engineers who run the platform can reach the servers, by SSH key; password login is off. The database, the file store and the cache are not reachable from the internet. Noda staff sign in to the admin portal with passkeys only.
• Secrets. The credentials of the integrations you connect are encrypted with AES-256-GCM.
• Changes. Every change to the app runs on a separate staging environment, with its own database and secrets, before it reaches production.
• Monitoring. Error reports go to Sentry in the EU with personal data turned off and request headers removed. Server logs are kept for 14 days and metrics for 30 days.
• Backups. We copy the database before each release.
• Incidents. We notify you of a personal data breach within 24 hours, as Section 12 sets out.