Terms of Service

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Next Reason (“Processor” or “Next Identity”) and the customer entity using the Services (“Controller”).

1. Definitions

• Controller: The customer who determines the purposes and means of processing personal data.

• Processor: Next Identity, which processes data on behalf of the Controller.

• Personal Data: Any information relating to an identified or identifiable individual.

• Sub-Processor: Any third party engaged by the Processor to process data on the Controller's behalf.

2. Subject Matter and Duration

The subject matter of processing is the provisioning of CIAM orchestration services. Processing will continue for the duration of the service agreement unless otherwise terminated in writing.

3. Nature and Purpose of Processing

• Identity and access management for end users

• Storage and synchronization of user data

• Providing secure login, registration, and access flows

4. Types of Personal Data Processed

• Names

• Email addresses

• Mobile Numbers

• Authentication data (passwords, tokens, metadata)

• IP addresses and usage metadata

5. Obligations of the Processor

• Only process personal data for the purpose of user authentication and user data storage and management by the Controller.

• Implement appropriate technical and organizational measures to ensure data security

• Ensure confidentiality of all personnel handling data

• Assist Controller in responding to data subject rights

• Notify Controller of any personal data breach without undue delay

• Cooperate with supervisory authorities where required

6. Sub-Processors

Controller authorizes the use of sub-processors listed below:

• Amazon Web Services

Processor shall ensure sub-processors are bound by equivalent data protection obligations.

Processor shall inform the Controller at least 30 days in advance of any intended changes concerning the addition or replacement of sub-processors. During this period, the Controller may object in writing to such changes on reasonable and documented grounds related to data protection.

7. Data Transfers

If data is transferred outside of the designated storage region, Processor shall ensure adequate safeguards are in place, such as Standard Contractual Clauses (SCCs) or an approved certification mechanism.

8. Data Return and Deletion

Upon termination of the Services, Processor will delete or return all personal data at the choice of the Controller, unless legal obligations require its retention.

9. Audits and Inspections

Processor will allow for and contribute to audits by the Controller or an appointed auditor (subject to confidentiality and notice requirements).

10. Liability

Each party’s liability under this DPA shall be subject to the limitations set forth in the Terms of Service.