For institutions
Data Processing Addendum
Effective April 1, 2026 · Last updated September 2026
When an institution licenses or white-labels our products, the institution is the controller of its users' data and we act as its processor under this Data Processing Addendum (DPA). This page summarizes the key terms; the full text is available to download and is what the parties sign.
Key terms at a glance
| Topic | Summary |
|---|---|
| Roles | You are the controller; we are the processor, acting only on your documented instructions. |
| Security | Technical & organizational measures (Annex 2): encryption in transit, least-privilege access, monitoring, vendor review. |
| Sub-processors | General authorization with ≥ 30 days' notice of changes and a right to object. Current list at /subprocessors. |
| Breach notice | Notice without undue delay, within 72 hours, plus cooperation on your PIPA/PIPEDA “real risk of significant harm” assessment. |
| Transfers | EU/UK Standard Contractual Clauses; Canadian data-residency options where elected. |
| Return / deletion | Deletion or return of data within 60 days of termination, subject to legal retention. |
| Governing law | Alberta, Canada. |
Requesting the DPA
Download the full DPA above, or request a countersigned copy and our security documentation via the compliance page or by emailing privacy@ngnsimulation.com. White-label partners should also review the White-Label / Reseller Agreement.