Data Processing Addendum

Last updated 6 November 2026 · Alcings Limited

Draft for legal review. This text describes how NRG-Drill works today but has not yet been approved by our lawyers, and bracketed items are still to be completed.

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the Customer and [Company legal name] (“Processor”). It applies where we process personal data on the Customer’s behalf while providing NRG-Drill.

1. Roles

1.1 The Customer is the controller of personal data in its NRG-Drill account, and we are its processor.

1.2 We act as a controller only for the records we need to run, secure and administer the service and the Customer’s licence (account security records, audit records and usage totals), as described in our Privacy Policy.

2. Details of processing
Subject matter Providing the NRG-Drill service
Duration The licence term, and the deletion period after it
Nature and purpose Hosting, storing, displaying, alerting on and exporting drilling data; managing users and access
Data subjects The Customer’s users; people named in annotations
Personal data Names, work email addresses, roles, well access, preferences, session and device data, IP addresses and countries, usage and audit records, any names typed into annotations
Special category data None expected; the Customer should not send any

3. Our obligations

We will:

  1. Process personal data only on the Customer’s documented instructions, which are these Terms and the Customer’s use of the service’s settings, unless the law requires otherwise (in which case we’ll tell the Customer, unless the law forbids it).
  2. Make sure people authorised to process the data are bound by confidentiality.
  3. Apply the security measures in section 5.
  4. Use subprocessors only as set out in section 4.
  5. Help the Customer respond to data subjects’ requests, taking into account the nature of the processing.
  6. Help the Customer with security, breach notification, data protection impact assessments and consultations with regulators.
  7. At the end of the service, delete or return the personal data as set out in section 7.
  8. Make available the information needed to show compliance with this DPA, and allow for and contribute to reasonable audits, as set out in section 8.

4. Subprocessors

4.1 The Customer authorises the subprocessors listed on our Subprocessors page.

4.2 We will give at least 30 days’ notice of a new subprocessor by updating that page and notifying the Customer’s administrators. The Customer may object on reasonable data protection grounds; if we can’t address the objection, the Customer may end the affected service and receive a refund of prepaid fees for it.

4.3 We impose data protection terms on each subprocessor at least as protective as this DPA, and remain responsible for its performance.

5. Security measures

  • Isolation: each organisation’s data in its own database schema; every request scoped to the signed-in organisation; access to wells by explicit grant.
  • Authentication: passwords stored as salted hashes; account lockout after repeated failures; rate-limited sign-in; one active session per user; short-lived access tokens held in memory; refresh tokens in httpOnly, Secure, SameSite=Strict cookies.
  • Rigsite keys: 256-bit random facility keys, stored only as SHA-256 hashes, and revocable.
  • Transport: HTTPS for all traffic between the Transmitter, browsers and the service.
  • Access control: roles (Admin, Engineer, Viewer, Display); platform administrators use authenticator-app two-factor authentication.
  • Monitoring: an audit trail of security-relevant events, available to the Customer’s administrators.
  • Location restriction: optional per organisation.
  • Backups: [backup frequency and retention].

6. Personal data breaches

We will notify the Customer without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting its data, with the information the Customer needs to meet its own obligations.

7. Deletion and return

At the end of the licence the Customer may ask within [30] days for an export of its data. We then delete the Customer’s personal data within [90] days, unless the law requires us to keep it. Data in backups is deleted as the backups expire.

8. Audits

We will answer reasonable written security questionnaires once a year, or after a breach. Further audits are by agreement, at the Customer’s cost, with reasonable notice and confidentiality.

9. International transfers

Where personal data is transferred outside Nigeria or the EEA/UK, we rely on an adequacy decision or the appropriate standard contractual clauses, which are incorporated into this DPA by reference.

10. Contact

Data protection contact: [privacy-nrgdrill@alcings.com].