Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (“you”, the controller) and NexGen eHub Limited (company number 15533142), registered in England and Wales at 72 Sparrow Hall Road, Liverpool, L9 6BU (“NexGen eHub”, “we”, the processor).

It applies where we process personal data on your behalf in providing the service, including uploaded files, datasets, customer records, AI prompts and managed-service work. For the personal data described in our Privacy Policy — such as your account and billing data — we act as controller, and this DPA does not apply to that processing.

If there is a conflict between this DPA and the main agreement on the processing of personal data, this DPA prevails. You can accept this DPA by emailing info@nexgenehub.com; a signature copy is available on request.

• Data protection law means the UK GDPR, the Data Protection Act 2018, PECR where applicable, and any law replacing or supplementing them.
• Personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the UK GDPR.
• Sub-processor means a third party engaged by us to process personal data on your behalf.
• Restricted transfer means a transfer of personal data to a country outside the UK that is not covered by UK adequacy regulations.

We process personal data to provide the service described in your plan, order form or statement of work. Processing continues for the duration of the agreement and then for the period needed to return or delete data under section 15, unless a longer period is required by law. The details are set out in Schedule 1.

Processing includes storage, retrieval, organisation, structuring, modification, analysis, transmission to a sub-processor for a feature you use, and deletion. It is carried out to:

• host your account, content and files;
• run the tools and AI features you choose to use;
• provide support, investigate faults and secure the service;
• deliver managed services within the agreed scope; and
• maintain backups and audit records.

We do not process your personal data for our own marketing, sell it, or use it to train our own models. Our AI providers process content only to deliver the feature you request, under their terms as our sub-processors.

We process personal data only on your documented instructions, which include the settings and actions you take in the service, the plan and any order form or written instruction you give us. You are responsible for the lawfulness of those instructions and for having a lawful basis for the data you submit.

We will tell you promptly if an instruction appears to breach data protection law, unless the law prevents us from doing so. We may suspend the relevant processing until the instruction is clarified. We will not process data for our own purposes or on behalf of another controller.

We keep personal data confidential and ensure that anyone we authorise to process it is bound by appropriate confidentiality obligations, has received appropriate training, and has access only where their role requires it. Access is removed promptly when a person leaves or changes role.

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking account of the nature of the data and the risks. The current measures are summarised in Schedule 2.

We review and update those measures as the service and risks change. No set of measures can guarantee absolute security, but we will not materially reduce the protections described in Schedule 2 during the term without telling you.

You give general written authorisation for us to engage the sub-processors listed in Schedule 3. We impose data protection obligations on each sub-processor that are substantially the same as those in this DPA, and we remain responsible to you for their performance.

We will give you reasonable notice before adding or replacing a sub-processor that processes your data, and you may object on reasonable data protection grounds. If we cannot resolve the objection, you may terminate the affected part of the service without penalty. Schedule 3 records the providers engaged at the date of this DPA.

Stripe processes payment data as an independent controller for payment services and is not a sub-processor under this DPA; its own terms and privacy notice apply to that processing.

We may process personal data outside the UK, including in the European Union and the United States, and some support is delivered from India. Where a restricted transfer occurs, we will ensure that a valid transfer mechanism applies — such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses — together with any supplementary measures we consider necessary.

Schedule 3 records the location and safeguard we hold for each sub-processor. We are reviewing the executed transfer terms for each provider; if you need the specific mechanism for a provider before signing, contact us and we will confirm it in writing.

Taking into account the nature of the processing, we help you respond to requests from data subjects to exercise their rights. The portal provides export and correction tools for account data. For other requests, we will provide reasonable assistance, including information about the processing and, where technically feasible, deletion or restriction.

If we receive a request directly from a data subject about data you control, we will not respond substantively unless the law requires it or you ask us to. We will pass the request to you without undue delay.

We notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you. The notification will describe, as far as we can at the time, the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed.

We will cooperate with your investigation and your obligations to notify the Information Commissioner’s Office or affected individuals. We will not notify data subjects or regulators on your behalf unless you ask us to or the law requires it. Where a breach is unlikely to result in a risk to rights and freedoms, the notification may be limited accordingly.

Taking into account the nature of the processing and the information available to us, we provide reasonable assistance where you carry out a data protection impact assessment or consult the Information Commissioner about processing carried out through the service. Where a feature is likely to require an assessment, we will tell you in the product information or on request.

We will provide the information reasonably needed to demonstrate compliance with this DPA, including our current security summary, sub-processor list and relevant certifications or reports we hold. We will also allow for an audit, including inspections by you or an auditor you appoint, subject to:

• reasonable prior notice and scheduling;
• no more than once in any 12-month period, unless required by a regulator or following a breach;
• confidentiality and no access to other customers’ data;
• our reasonable security and access requirements; and
• reimbursement of our reasonable costs for an audit beyond a standard questionnaire.

Where an audit would risk the security of the service or other customers, we may provide a report or remote review instead.

At the end of the agreement, or on your written instruction, we will return your personal data in a commonly used format where the service provides export, and delete it from live systems within a reasonable period. Copies may remain in backups until they are overwritten in the normal cycle, and we may retain data where the law requires it or to establish, exercise or defend legal claims. Retained data remains subject to this DPA.

Each party’s liability under this DPA is subject to the limitations and exclusions in the main agreement. Nothing in this DPA limits liability that cannot lawfully be limited, including liability for a breach of data protection law where the law does not permit an exclusion. A party that suffers a loss caused by the other party’s breach of this DPA may seek compensation in accordance with the main agreement.

This DPA applies for as long as we process personal data for you and survives termination to the extent needed to return or delete data and to comply with confidentiality, security and liability obligations.

This DPA is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction, subject to any mandatory consumer or data protection jurisdiction that applies. It is consistent with our Privacy Policy, Terms of Service and AI Usage Policy.

The current measures include:

• Access control — unique staff accounts, role-based permissions, least privilege, multi-factor authentication where enabled, and prompt removal of access.
• Tenant separation — database row-level security and server-side entitlement checks so customers can access only their own data.
• Encryption — TLS for data in transit between your browser, our servers and providers; at-rest protection is provided through our hosting and database platform controls.
• Logging and monitoring — authentication, administrative and security events are logged; error reports are redacted and capped; audit records are retained for a defined period.
• Backups and resilience — periodic database backups stored securely, with documented restoration procedures.
• Secure development — dependency review, automated tests, security-focused code review and prompt patching of known vulnerabilities.
• Incident response — a documented process for triage, containment, notification and review, including the breach notification in section 11.
• Supplier management — providers are reviewed for security and data protection terms before use and when the service changes.
• People — confidentiality obligations, role-based training and restricted access for staff and contractors, including overseas support teams.

We can provide a current security summary for your procurement review. Measures are reviewed as the service and risks change.

The providers below are engaged as at the date of this DPA. We are completing the transfer review for each provider; the mechanism confirmed for your contract is available in writing before you sign.

Stripe is not listed because it processes payment data as an independent controller for payment services, under its own terms. Back-office support is provided by our own teams in India under confidentiality and access controls, not by a separate sub-processor.

We will update this schedule before a new sub-processor processes your data and will give notice as described in section 8.

To accept this DPA, email info@nexgenehub.com with your company name, account reference and the date. We will confirm acceptance and provide a signature copy if you need one for your records. If you need amendments for your procurement process, tell us and we will review them; we cannot agree to terms that conflict with our security or legal obligations.