Legal
Data Processing Agreement
For customers with GDPR obligations to their end users. Countersigned copy available on request.
When you need this
If your business processes personal data of EU / UK residents and uses NFL to do so, you need a signed DPA. Most self-serve users do not.
What it covers
Data controller / processor roles. Sub-processor list. Data-transfer mechanisms (SCCs). Breach notification. Audit rights. Data-return / deletion on termination.
How to request
Email legal@nutritionfactlabel.com with your entity name and jurisdiction. We countersign within 5 business days.
Sub-processors
See /sub-processors for the full list.