Data Processing Agreement

Last updated: [DATE]

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between Nexource SRL, a company registered in Baia Mare, Romania, with trade register number J2003000263246 and tax identification code RO15281435 ("Processor", "we", "us"), and the customer identified in the Account or order form ("Controller", "you").

It applies to the extent that we process Personal Data on your behalf in providing the Hosted Service. It does not apply to the Self-Hosted Platform, where you operate the software yourself and we process no Personal Data on your behalf.

Capitalised terms not defined here have the meanings given in the Terms.

1. Definitions

GDPR — Regulation (EU) 2016/679.

Data Protection Law — the GDPR, applicable national laws implementing or supplementing it, including Romanian Law no. 190/2018, and any other data protection law applicable to the processing under this DPA.

Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach, Supervisory Authority — as defined in the GDPR.

Customer Personal Data — Personal Data contained in Customer Data that we process on your behalf.

Sub-processor — any third party we engage to process Customer Personal Data.

Standard Contractual Clauses (SCCs) — the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1 You are the Controller of Customer Personal Data. We are the Processor.

2.2 Where you act as a processor on behalf of your own clients — for example, as an agency building Apps for third parties — you warrant that your instructions to us, including the appointment of us as your sub-processor, have been authorised by the relevant controller. In that case we act as your sub-processor, and this DPA applies between you and us accordingly.

2.3 The subject matter, duration, nature and purpose of processing, and the categories of Personal Data and Data Subjects, are set out in Annex I.

2.4 We act as an independent Controller for Account, billing and usage data relating to you and your Editors, as described in our Privacy Policy. This DPA does not apply to that processing.

3. Your obligations

3.1 You are responsible for the lawfulness of the processing you instruct, including having a legal basis for it and providing any required notices to Data Subjects.

3.2 You are responsible for determining what Customer Personal Data your Apps send to AI Features, and for ensuring that doing so is lawful and consistent with your notices to Data Subjects.

3.3 You will not instruct us to process special categories of Personal Data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) unless you have ensured a lawful basis for that processing and that the Hosted Service's security measures are appropriate to it.

4. Instructions

4.1 We process Customer Personal Data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by Union or Member State law. In that case we will inform you of the legal requirement before processing, unless the law prohibits it on important grounds of public interest.

4.2 Your documented instructions consist of: (a) the Terms and this DPA; (b) your configuration and use of the Hosted Service, including the Apps you build, the AI Features you invoke and the data your Apps reference; and (c) any further written instructions you give us that are consistent with the Terms.

4.3 We will inform you immediately if, in our opinion, an instruction infringes Data Protection Law.

5. Confidentiality

We ensure that all persons authorised to process Customer Personal Data are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and access it only as necessary to provide the Hosted Service or support.

6. Security

6.1 We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. Those measures are described in Annex II.

6.2 We may update our measures over time, provided the updated measures do not reduce the overall level of protection.

6.3 You are responsible for the security measures within your control, including configuring access roles appropriately within your Apps, managing your Editors' and External Members' credentials, and determining what data your Apps expose to which users.

7. Sub-processors

7.1 General authorisation. You give us general written authorisation to engage Sub-processors. Our current Sub-processors are listed in Annex III.

7.2 Changes. We will notify you at least [30] days before adding or replacing a Sub-processor, by email to your Account address and by updating Annex III.

7.3 Objection. You may object to a new Sub-processor on reasonable data protection grounds by notifying us at [privacy@nxr.ai] within the notice period. We will discuss your concerns in good faith. If we cannot resolve them, you may terminate the affected part of the Hosted Service before the change takes effect and receive a refund of prepaid fees for the unused period.

7.4 Flow-down. We impose on each Sub-processor, by written contract, data protection obligations providing at least the same level of protection as this DPA, in particular sufficient guarantees of appropriate technical and organisational measures.

7.5 Responsibility. We remain responsible to you for the performance of each Sub-processor's obligations.

8. AI processing

8.1 When you or your Apps invoke AI Features, the Customer Personal Data included in the relevant prompt, template, AI block or retrieval context is sent to our AI Sub-processor listed in Annex III for the sole purpose of generating the requested output.

8.2 Customer Personal Data sent to AI Sub-processors is not used to train artificial intelligence or machine learning models, whether ours or the Sub-processor's.

8.3 Retention of Customer Personal Data by AI Sub-processors is limited to the period set out in Annex III.

8.4 Where you require that particular Customer Personal Data never be sent to AI Sub-processors, you can achieve this by not referencing that data in AI Features within your Apps. Processing by AI Features occurs only as a result of your configuration or use.

9. International transfers

9.1 We store Customer Personal Data in [the European Union — AWS region eu-central-1 (Frankfurt)].

9.2 Customer Personal Data is transferred outside the European Economic Area only to the Sub-processors and for the purposes identified in Annex III.

9.3 For each such transfer we rely on one of the following safeguards, as identified in Annex III: (a) an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it; or (b) the Standard Contractual Clauses, Module Three (processor to processor), entered into between us and the Sub-processor.

9.4 Where required, we have assessed the laws of the destination country and implemented supplementary measures appropriate to the transfer.

10. Assistance

10.1 Data Subject requests. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures in fulfilling your obligation to respond to requests from Data Subjects exercising their rights under Chapter III GDPR. The Hosted Service enables you to access, correct, export and delete Customer Personal Data directly. If we receive a request directly from a Data Subject, we will forward it to you without undue delay and will not respond ourselves except on your instruction.

10.2 Other assistance. Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with your obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a Supervisory Authority.

10.3 Assistance beyond what the Hosted Service's self-service features provide may be charged at our standard rates, except where the need for assistance arises from our breach of this DPA.

11. Personal Data Breaches

11.1 We will notify you without undue delay, and in any case within [48] hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

11.2 Our notification will include, to the extent then available: the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for further information. Where information is not yet available, we will provide it in phases without undue further delay.

11.3 We will take reasonable steps to contain and remediate the breach and will cooperate with you in meeting your notification obligations to Supervisory Authorities and Data Subjects.

11.4 Our notification of a Personal Data Breach is not an acknowledgement of fault or liability.

12. Audit

12.1 We will make available to you all information necessary to demonstrate compliance with Article 28 GDPR.

12.2 You may audit our compliance with this DPA, including by inspection, no more than once in any twelve-month period except following a Personal Data Breach or where required by a Supervisory Authority. Audits must be requested with at least [30] days' notice, conducted during business hours, subject to confidentiality obligations, and conducted in a manner that does not disrupt our operations or compromise the security of other customers' data.

12.3 We may satisfy an audit request, where reasonable, by providing written responses, documentation of our measures, or third-party certifications or audit reports.

12.4 Each party bears its own costs of an audit, except where the audit reveals a material breach of this DPA by us.

13. Return and deletion

13.1 On termination of the Hosted Service, you may export Customer Personal Data during the export period set out in section 15.5 of the Terms.

13.2 After the export period, we will delete Customer Personal Data from live systems within [30] days and from backups within [90] days, unless Union or Member State law requires its retention.

13.3 On request, we will confirm deletion in writing.

14. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability in the Terms, except to the extent those limitations are not permitted by Data Protection Law.

15. Term and precedence

15.1 This DPA remains in force for as long as we process Customer Personal Data on your behalf.

15.2 In the event of conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails. Where SCCs apply, they prevail over this DPA.

15.3 This DPA is governed by the law governing the Terms.

Annex I — Details of processing

Subject matter. Provision of the Hosted Service: a no-code platform for building business applications, including data storage, application hosting, document and email generation, and AI Features.

Duration. For the term of the Terms and the export and deletion periods that follow.

Nature of processing. Collection, storage, organisation, structuring, retrieval, consultation, use in generating documents and emails, transmission by email, indexing for retrieval, processing by AI models, backup, export and deletion — as determined by your configuration of your Apps.

Purpose. To provide the Hosted Service to you in accordance with the Terms and your instructions.

Categories of Data Subjects. Determined by you. Typically:

• your employees, contractors and other Editors;
• External Members, such as your clients, their employees, and course participants;
• your clients' and business partners' contact persons;
• any other individuals whose data you store in your Apps.

Categories of Personal Data. Determined by you. Typically:

• identification and contact data: names, email addresses, phone numbers, postal addresses, job titles;
• login credentials for Editors and External Members;
• business and transactional data: offers, invoices, orders, contracts, tender documents;
• training and certification data: course enrolment, completion and certificates;
• content of uploaded files and generated documents;
• any other data you choose to store.

Special categories. None intended. You must not store special category data unless you have satisfied section 3.3.

Frequency. Continuous, for the duration of the Hosted Service.

Annex II — Technical and organisational measures

Access control

• Role-based access to production systems, limited to personnel who require it
• Multi-factor authentication for administrative access to infrastructure
• Unique accounts; no shared credentials
• Access reviewed [quarterly] and revoked promptly on role change or departure

Data isolation

• Logical separation of data between Apps, with access enforced by the application
• User accounts separated per App

Encryption

• Encryption in transit using TLS [1.2] or higher
• Encryption at rest for databases and file storage [AWS-managed encryption / specify]

Infrastructure

• Hosted on Amazon Web Services in [region]
• Network access to databases restricted to application servers
• Security patches applied [within X days of release]

Backups and resilience

• Automated backups [daily], retained for [X] days
• Backups encrypted and stored [in the same region / specify]
• Restoration tested [frequency]

Monitoring and incident response

• Logging of administrative access and security-relevant events
• Documented incident response procedure
• Breach notification in accordance with section 11

Personnel

• Confidentiality obligations for all personnel with access to Customer Personal Data
• [Security and data protection training — frequency]

Development

• Separation of development, test and production environments
• Production Customer Personal Data not used in development or testing [unless anonymised]

Sub-processor management

• Due diligence before engaging Sub-processors; contractual data protection obligations under section 7.4

Annex III — Sub-processors

Last updated: [DATE]

Changes to this list are notified in accordance with section 7.2.

| [Other — e.g. error monitoring] | [ ] | [ ] | [ ] | [ ] | [ ] |