context
[SEE IT ON YOUR DATA]
LEGAL

Data Processing Agreement

Last updated: March 27, 2026

1. Overview

This Data Processing Agreement ("DPA") supplements the Terms of Service between Nokta.dev Pte. Ltd. ("Processor" / "we") and the customer ("Controller" / "you") and governs the processing of personal data in connection with the Context software platform.

2. On-Premise Deployment Model

Context is deployed entirely within your infrastructure. This DPA reflects that unique architecture:

  • Your data stays in your environment. All documents, conversations, knowledge base content, and user data processed by Context remain within your infrastructure at all times.
  • We do not have access to your data. The Context software operates locally. We do not receive, transmit, store, or process your organizational data on our systems.
  • You are the data controller. You determine the purposes and means of processing personal data within your Context deployment.

3. Scope of Processing

3.1 Data We Process

We process limited personal data only for:

  • Account management (business contact details, billing information)
  • License verification and entitlement management
  • Support ticket communications
  • Aggregate, anonymized usage telemetry (if enabled by you)

3.2 Data We Do NOT Process

We do not process:

  • Documents, files, or content ingested into Context
  • Chat conversations or AI-generated responses
  • Knowledge graph data, embeddings, or search indices
  • Integration credentials or OAuth tokens
  • End-user activity or behavioral data within the platform

4. Your Obligations

As the data controller for your Context deployment, you are responsible for:

  • Ensuring lawful basis for processing personal data within Context
  • Implementing appropriate access controls and security measures in your environment
  • Responding to data subject requests relating to data in your deployment
  • Maintaining backups of your data
  • Conducting data protection impact assessments where required

5. Our Obligations

For the limited personal data we do process (Section 3.1), we commit to:

  • Processing data only for the purposes described in this DPA and the Terms of Service
  • Implementing appropriate technical and organizational security measures
  • Ensuring personnel with access to personal data are bound by confidentiality obligations
  • Assisting you with data subject requests that relate to data we hold
  • Notifying you of any personal data breach within 72 hours of becoming aware
  • Deleting or returning personal data upon termination of the agreement

6. Sub-processors

We use the following sub-processors for the limited data we handle:

  • Stripe (United States) - Payment processing
  • Cloudflare (Global) - Website hosting and delivery

We will notify you of changes to sub-processors with 30 days advance notice. You may object to a new sub-processor by notifying us within that period.

7. International Transfers

For the limited data we process, transfers outside Singapore are protected by:

  • EU Standard Contractual Clauses (Module 2: Controller to Processor) where applicable
  • Sub-processor compliance with applicable data protection frameworks

Your organizational data is never transferred internationally by us because it remains entirely within your infrastructure.

8. Security Measures

For our systems (website, billing, support), we implement:

  • Encryption in transit (TLS 1.2+) and at rest
  • Role-based access controls
  • Regular security assessments
  • Incident response procedures

For your on-premise Context deployment, security is your responsibility. We provide security documentation and hardening guides to assist you.

9. Audits

Upon reasonable request and with reasonable advance notice, we will provide information necessary to demonstrate compliance with this DPA. This may include security certifications, audit reports, or responses to assessment questionnaires.

10. Term

This DPA remains in effect for the duration of the Terms of Service. Obligations relating to data processing survive termination until all personal data is deleted or returned.

11. Contact

Data Protection Officer
Nokta.dev Pte. Ltd.
68 Circular Road #02-01
Singapore 049422
Email: privacy@nokta.dev