Data Protection Addendum - Nygma
Last Updated: October 13, 2026
This Data Protection Addendum (“DPA”) forms part of the Nygma Terms of Service (the “Terms”) between you and Genie9 LTD (“Genie9”, “we”, “us”). It applies only when you use Nygma for business or professional purposes and store or send personal data in Nygma for which you are a controller, or a processor for someone else. It does not apply to purely personal or household use. For the personal data we collect about you as our customer, Genie9 is the controller; see our Privacy Policy.
1. Definitions
- • “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (EU GDPR).
- • “Customer Data” means the personal data, within the files you store in your Nygma drives and the messages and attachments you send with Nygma Chat, for which you are a controller or processor.
- • “Controller”, “processor”, “personal data”, “personal data breach”, “data subject” and “processing” have the meanings given in Data Protection Law.
- • “Sub-processor” means a company we engage to process Customer Data for us.
2. Roles and Details of Processing
2.1 Roles
- • You are the controller (or a processor acting for another controller) of Customer Data. Genie9 is your processor, or sub-processor, of Customer Data.
- • Genie9 is a separate controller of account, billing, security and log data, which our Privacy Policy covers. This DPA does not apply to that data.
2.2 Details of Processing
- • Subject matter and purpose: providing Nygma — storing, transmitting and deleting Customer Data as you direct.
- • Nature: Customer Data is encrypted on your devices before it reaches us. We store and transmit it only in encrypted form, and we do not hold the keys to decrypt it.
- • Duration: for as long as you use Nygma, and until the data is deleted as described in section 9.
- • Types of personal data and data subjects: whatever you choose to store or send. Because Customer Data is encrypted, we do not know what it contains.
2.3 Encryption and Its Limits
What we can and cannot see, and the limits that apply (including to files uploaded before Nygma 1.0 and to drives with a PIN), are set out in our Zero-Knowledge Statement. You are responsible for deciding whether Nygma is suitable for the personal data you store in it.
3. Our Obligations as Processor
- • Instructions. We process Customer Data only on your documented instructions, including with regard to international transfers. The Terms, this DPA and the way you use and configure Nygma (for example deleting files, setting up Time Bomb or deleting your account) are your complete instructions. If the law requires us to process Customer Data in another way, we will tell you first, unless the law prohibits that.
- • Unlawful instructions. We will tell you if, in our opinion, an instruction infringes Data Protection Law.
- • Confidentiality. People we authorise to process Customer Data are bound by confidentiality.
- • Security. We take the measures required by Article 32 of the UK GDPR, as described in our Security Practices. We may change these measures over time, as long as they continue to meet Article 32.
- • Sub-processors. We engage sub-processors only as described in section 5.
- • Data subject requests. Taking into account the nature of the processing, we help you respond to data subjects through Nygma itself: you can open, download, change and delete Customer Data in the apps. Because Customer Data is encrypted, we cannot find or change it for you. If a data subject contacts us about Customer Data, we will refer them to you where we can identify you.
- • Other assistance. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations on security, personal data breaches, data protection impact assessments and prior consultation with a regulator. Where the law allows, we may charge a reasonable fee for help beyond what Nygma provides.
- • Information. We will make available the information needed to demonstrate that we meet this section, as described in section 8.
4. Your Obligations
- • You are responsible for having a lawful basis for the Customer Data you store and send, for giving data subjects the information the law requires, and for making sure your instructions comply with Data Protection Law.
- • You are responsible for your drive passwords, PINs, recovery phrases, devices and the people you give access to. If they are lost, we cannot recover Customer Data.
- • You are responsible for keeping your own copies of Customer Data you need.
5. Sub-processors
5.1 Current Sub-processors
You give us general written authorisation to use sub-processors. Our current providers are listed on our Third-Party Services page. Those that process Customer Data, always in encrypted form, are:
- • Amazon Web Services (Amazon S3, Amazon RDS) — hosting, encrypted file storage and our database — USA (us-east-1).
- • Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) — content-free notifications that wake the Nygma app; they receive a device push token, not Customer Data.
5.2 Changes
- • We may add or replace sub-processors. We will give you notice of an intended change by updating the Third-Party Services page before the change takes effect, unless an urgent change is needed for security or to keep Nygma running.
- • You may object on reasonable data protection grounds by emailing dpo@genie9.com within 14 days of the update. If we cannot resolve your objection, your remedy is to stop using Nygma for Customer Data and close your account.
5.3 Sub-processor Terms
We put data protection terms in place with each sub-processor as Data Protection Law requires (for large providers, their standard data processing terms). We remain responsible to you for our sub-processors as the law requires, subject to section 10.
6. International Transfers
- • Our servers are in the United States (Amazon Web Services, us-east-1), so Customer Data is transferred to and stored in the USA.
- • Transfers from the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK International Data Transfer Agreement), and on the UK–US data bridge where it applies. Transfers from the EEA rely on the EU Standard Contractual Clauses.
- • You authorise these transfers.
7. Personal Data Breaches
- • We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data.
- • We will give you the information we reasonably can to help you meet your own obligations, and add to it as more becomes available.
- • Notifying you is not an admission of fault or liability.
8. Information and Audits
- • We meet our obligation to allow and contribute to audits by giving you written information about our processing, including our answers to a reasonable security questionnaire.
- • You may ask for this at most once in any 12 months, with at least 30 days’ written notice, at your own cost. The information is confidential.
- • If the law requires an inspection that written information cannot satisfy, we will agree a reasonable scope, timing and method with you, at your cost.
9. Return and Deletion
- • You can download Customer Data from Nygma at any time while your account is open. This is how Customer Data is returned to you.
- • When your account is deleted, we delete Customer Data from our live systems promptly and from backups as they roll over, unless the law requires us to keep it.
- • We cannot return Customer Data after it has been deleted.
10. Liability
- • Each party’s liability under or in connection with this DPA is subject to the exclusions and limits of liability in the Terms, to the fullest extent the law allows. Those limits apply to the Terms and this DPA together, not separately.
- • Nothing in this DPA limits any liability that cannot be limited by law, or any rights data subjects have under Data Protection Law.
11. General
- • If this DPA conflicts with the Terms on the processing of Customer Data, this DPA applies, except that the limits of liability in the Terms always apply.
- • We may update this DPA, for example to reflect changes in the law or in Nygma. The version on this page applies from its “Last Updated” date.
- • This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute about it.
12. Contact Information
Data protection:
Email: dpo@genie9.com or privacy@genie9.com
Legal:
Email: legal@genie9.com
Mailing Address:
Genie9 LTD
3 Shortlands
London W6 8DA
United Kingdom
This Data Protection Addendum was last updated on October 13, 2026.