Version 1.0 · August 19, 2026
This Data Privacy Addendum (“DPA”) is part of the Nera Services Agreement and any Order Form (collectively, the “Agreement”) between Customer and Nera Systems, Inc. (“Nera”). This DPA describes the commitments of Nera and Customer concerning the Processing of Personal Data in connection with the Services purchased by Customer. Capitalized terms not defined here have the meaning given in the Agreement.
1.1 “Applicable Data Protection Law” means, to the extent applicable to a party’s Processing of Customer Personal Data under the Agreement: (i) European Data Protection Laws; (ii) US Privacy Laws; and (iii) any other data protection law applicable to the Processing, in each case as amended, superseded, or replaced.
1.2 “European Data Protection Laws” means, as applicable: (i) Regulation 2016/679 (GDPR); (ii) the UK Data Protection Act 2018 and UK GDPR; (iii) the Swiss Federal Act on Data Protection; and (iv) any applicable national implementing legislation, each as amended, superseded, or replaced.
1.3 “US Privacy Laws” means US state data privacy, information security, and data breach notification laws applicable to Nera’s Processing of Customer Personal Data, excluding HIPAA, which is addressed in a Business Associate Agreement (“BAA”) incorporated into this DPA by reference as an addendum, applicable where Customer Processes protected health information through the Services.
1.4 “Controller” means the entity that determines the purposes and means of Processing Personal Data. “Processor” means the entity that Processes Personal Data on behalf of the Controller (and, under US Privacy Laws, “service provider” or equivalent, as applicable to Nera’s role).
1.5 “Customer Personal Data” means Personal Data contained in Customer Data that Nera Processes under the Agreement solely on Customer’s behalf.
1.6 “Personal Data” means information relating to an identified or identifiable natural person, or any equivalent term defined under Applicable Data Protection Law.
1.7 “Process,” “Processing” means any operation performed on Personal Data, including collection, storage, use, and computation, whether on plaintext or encrypted values.
1.8 “Security Incident” means a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Data, or any event Nera reasonably suspects may constitute such an occurrence.
1.9 “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, as may be updated.
1.10 “Sub-processor” means any third party engaged by Nera to Process Customer Personal Data in connection with providing the Services.
Nera Processes Customer Personal Data only on Customer’s documented instructions, as described in Schedule 1 and this DPA, and only for the limited purposes of providing the Services. Nera will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose outside the direct business relationship with Customer; or (c) combine Customer Personal Data with data Nera receives from other sources, except as permitted by Applicable Data Protection Law. Nera will notify Customer if it determines it can no longer meet its obligations under this DPA.
Unlike a conventional Processor, Nera’s Services are designed so that Customer’s underlying data values are encrypted before they reach Nera’s systems, using keys Customer holds, and are not reconstructed into readable form during Processing. Nera Processes the structure of Customer Data (such as schema and metadata) and the encrypted values necessary to return computed results, but does not access Customer’s underlying data values in plaintext at any point.
For Personal Data relating to Customer’s user accounts (such as name, email, and authentication metadata) and system usage logs, Nera acts as a Controller for the limited purposes of account management, billing, security, and service improvement, as described in the Agreement.
Customer is solely responsible for the accuracy, legality, and content of Customer Personal Data, and represents that it has all necessary rights and consents to have Nera Process it as contemplated by the Agreement.
Nera has implemented and will maintain technical and organizational measures designed to protect the security, confidentiality, integrity, and availability of Customer Data, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256); Customer-side encryption of underlying data values, using Customer-held keys, before data reaches Nera’s systems; multi-factor authentication across infrastructure access; and least-privilege, logged access to production systems limited to named personnel. These measures are layered on top of the security controls maintained by Nera’s infrastructure providers, Google Cloud Platform and Microsoft Azure, both of which hold SOC 2 Type II and ISO 27001 certification at the infrastructure layer under their own published addenda (see Section 4.1.1). A full description of Nera’s own technical and organizational measures is available at nera.systems/trust and under NDA.
Customer will implement reasonable security measures for its own systems and accounts, including credential management and use of any security controls Nera makes available for configuration.
Upon becoming aware of a reasonably suspected Security Incident, Nera will promptly investigate. Nera will notify Customer without undue delay, and in any event within forty-eight (48) hours, after confirming a Security Incident affecting Customer Personal Data, and will provide information reasonably necessary for Customer to meet its own notification obligations under Applicable Data Protection Law, including GDPR’s 72-hour supervisory authority notification requirement where applicable. Nera’s notification of a Security Incident is not an admission of fault or liability.
Customer provides general authorization for Nera to engage Sub-processors to Process Customer Personal Data. Nera’s current Sub-processors, including cloud infrastructure providers (Google Cloud Platform, Microsoft Azure) and AI model providers (Anthropic, Google, which receive query structure only, never underlying data values), are listed at nera.systems/trust. Nera will impose data protection obligations on each Sub-processor no less protective than those in this DPA, and remains responsible for each Sub-processor’s compliance.
Nera’s cloud infrastructure providers Process Customer Personal Data under their own published data processing agreements, which flow down to and inform Nera’s obligations under this DPA:
Both providers maintain SOC 2 Type II, ISO 27001, and related certifications at the infrastructure layer, independently of Nera’s own compliance program.
Nera will notify Customer, via the Trust Center or by email, before adding or replacing a Sub-processor with access to Customer Personal Data. Customer may object in writing within thirty (30) days of notice, stating its reasons. If the parties cannot resolve the objection within ninety (90) days, Customer may terminate the affected Services without further liability.
Where Customer cannot independently fulfill a data subject request using the Services, Nera will provide reasonable assistance, taking into account the nature of the Processing, particularly the fact that Nera does not hold Customer’s underlying data values in readable form and access to that content remains with Customer. If Nera receives a request directly from a data subject, it will not respond substantively without Customer’s authorization, except to acknowledge receipt and redirect the requester to Customer.
Unless legally prohibited, Nera will promptly notify Customer of any subpoena, warrant, or order compelling disclosure of Customer Personal Data, to allow Customer to seek a protective order or other remedy.
Customer may access, retrieve, or delete Customer Data during the term of the Agreement. Upon termination, or upon written request, Nera will delete Customer Data (including Customer Personal Data) from its systems and instruct Sub-processors to do the same, within thirty (30) days of request, except that deletion from backup or archival systems may take up to ninety (90) days. Nera may retain data as required by law, subject to continued confidentiality obligations under this DPA.
Nera has not yet completed an independent third-party audit; SOC 2 Type II examination is in progress, and once complete, the resulting report will be made available to customers via the Trust Center under NDA. In the interim, Nera will respond in writing to reasonable, documented requests for information regarding its Processing of Customer Personal Data, no more than once every twelve months, on a confidential basis.
On-site audit rights are available to customers on Enterprise-tier agreements. Where such a Customer cannot reasonably verify Nera’s compliance through Section 7.1, or where required by Applicable Data Protection Law, Customer may request an audit of Nera’s applicable controls, conducted during business hours, with at least sixty (60) days’ advance written notice, on a confidential basis, no more than once every twelve months, and reasonably scoped to avoid disrupting Nera’s business or other customers.
Nera will provide reasonable cooperation to support Customer’s own data protection impact assessments, to the extent the relevant information is available and not already accessible to Customer directly.
Nera hosts production data in United States regions only, with no replication elsewhere by default. Nera serves customers with users and data subjects in the United States, the European Union, the United Kingdom, and the United Arab Emirates; the transfer mechanisms below apply accordingly.
Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to the United States and no adequacy decision applies, the parties agree the SCCs are incorporated by reference, with Nera as data importer and Customer as data exporter, Module Two (Controller to Processor) or Module Three (Processor to Processor) applying as appropriate to Customer’s role. For UK transfers, the SCCs apply as amended by the UK International Data Transfer Addendum; for Swiss transfers, the SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner.
Where Customer Personal Data is subject to the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), Nera will Process and transfer such data in accordance with that law’s cross-border transfer requirements, including contractual safeguards no less protective than this DPA. See Schedule 2.
This DPA is governed by the governing law and jurisdiction provisions in the Agreement, except where Applicable Data Protection Law requires otherwise, in which case that law controls solely as to this DPA. If this DPA conflicts with the Agreement, this DPA controls as to data protection terms; the Agreement controls otherwise.
Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, and any references there to aggregate liability apply in aggregate across the Agreement and this DPA together. Breaches of this DPA are treated as Excluded Claims under Section 9.3 of the Agreement.
Claims arising from this DPA may only be brought by the entity that is a party to the applicable Order Form.
Categories of data subjects: Determined by Customer. Customer controls what categories of individuals are reflected in the data it submits to the Services.
Subject matter of Processing: Customer Personal Data that Customer elects to submit in connection with the Services.
Types of Personal Data: Determined by Customer. Nera does not require specific categories of Personal Data (including health data or payment card data) in readable form to deliver the Services, since underlying data values are encrypted before they reach Nera’s systems.
Duration and frequency: Continuous during the term of the Agreement.
Nature and purpose of Processing: Nera Processes the structure of Customer Data and encrypted representations of underlying values to execute Customer’s queries and return computed results. Nera does not access, and its Sub-processors (including AI model providers) do not receive, Customer’s underlying data values in readable form.
EEA (GDPR). The SCCs (Module Two or Module Three, per Customer’s role) are incorporated per Section 8.1. Nera does not represent participation in the EU-U.S. Data Privacy Framework or any other certification-based transfer mechanism.
United Kingdom. The SCCs apply as amended by the UK International Data Transfer Addendum issued by the UK Information Commissioner’s Office, and references to the GDPR are read as references to the UK GDPR.
Switzerland. The SCCs apply with the adaptations required under the Swiss Federal Act on Data Protection, including references to the competent Swiss supervisory authority.
United Arab Emirates. For Customer Personal Data subject to the UAE PDPL, Nera Processes such data only on Customer’s documented instructions and transfers it only with safeguards no less protective than this DPA, consistent with the PDPL’s cross-border transfer provisions.