Data Processing Agreement

1. Parties, scope and definitions

1.1 This agreement is between NexusQual Technologies Ltd, registered in England and Wales under company number 17383593, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("NexusQual", "we", "us"), and the customer identified in the signature block ("you", "the Agency").

1.2 It forms part of the Terms of Service between us and applies for as long as we process personal data on your behalf.

1.3 It is entered into to satisfy Article 28 of the UK GDPR. "UK GDPR", "Data Protection Legislation", "personal data", "processing", "controller", "processor", "personal data breach" and "data subject" have the meanings given in that legislation.

1.4 Protected Data means personal data processed by us on your behalf under the Terms of Service, as described in Annex A. It does not include the account data of your staff who hold a login to our client area — we are the controller of that, and our Privacy Policy governs it.

1.5 Where this agreement conflicts with the Terms of Service on the processing of Protected Data, this agreement prevails.

2. Current limitations — read before signing

2.1 Before you appoint a processor, you have to satisfy yourself that it provides sufficient guarantees to meet the requirements of the UK GDPR. You cannot do that on incomplete information. So rather than leave you to discover them, the following are the capabilities and measures that do not exist as at the date of this agreement. Each is either a commitment with a date, or an exclusion.

2.2 The measures listed in Annex C Part 1 are in place and each has been verified. Clause 6 and Annex C should be read together with this clause: the warranties we give in clause 6 are given in respect of the measures in Annex C Part 1 and are qualified by this clause 2.

2.3 You acknowledge that you have read this clause and taken it into account in deciding to appoint us. Nothing in it limits our obligations under Data Protection Legislation, and nothing in it is a waiver of your rights.

2.4 We will update this clause as items are completed and tell you when one changes. A commitment date in this clause is a contractual obligation, not an aspiration; if we will miss one, we will tell you before the date rather than after it.

3. Roles of the parties

3.1 The parties' roles differ by category of data, and the distinction is not uniform across the service:

3.2 The same person may appear in more than one row. When one of your staff exercises their own right of access against us, we answer as controller. When that same person forwards a Lead's request, you are the controller and we assist you under clause 8. These are different events with different routes.

3.3 Each party complies with its own obligations under Data Protection Legislation. You are responsible for the lawfulness of the collection of Protected Data, for the lawful basis relied on, and for the information given to data subjects.

3.4 Notice to Leads. The service does not currently deliver privacy information inside the WhatsApp conversation. You are responsible for providing the information required by Articles 13 and 14 by another route. We will tell you when in-conversation notice becomes available.

3.5 Inferred data. The enquiry records described in Annex A are generated by our systems from the content of conversations, on your instruction and for your purposes. We process them as your processor. If your legal advice is that the generation of those inferences makes us a joint controller with you for that step, tell us and we will agree an arrangement under Article 26.

4. Processing on your instructions

4.1 We process Protected Data only on your documented instructions, unless we are required to do otherwise by law — in which case we will tell you before processing, unless the law forbids it.

4.2 Your documented instructions are: this agreement and its annexes; the Terms of Service; the configuration you set in the client area; and any further instruction you give us in writing to info@nexusqual.com. We will confirm receipt of a written instruction and tell you if we cannot act on it.

4.3 We will tell you if, in our opinion, an instruction infringes Data Protection Legislation. We may suspend the affected processing until it is resolved.

4.4 We do not use Protected Data for our own purposes, except as set out in clause 12.3. We do not sell it, use it for advertising, or use it to train our own models. We aggregate conversation counts to bill you and to operate the service; those aggregates do not identify individuals.

4.5 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Annex A.

5. Confidentiality and personnel

5.1 We authorise access to Protected Data only for people bound by a duty of confidence. Where a person is not already under a contractual or professional duty, we put one in place before authorising access.

5.2 We limit access to those who need it to provide the service or to support you, and we tell you on request who holds administrative access.

5.3 Your staff cannot currently read the conversations or enquiry records held for your Workspace. The service provides no screen for it and no accounts for your staff on the system that holds those records. The Assistant notifies one of your brokers over WhatsApp when an enquiry is ready for a person, and everything else is held by us on your behalf. This means that in practice we, as processor, have access to that data and you, as controller, do not — which you should take into account in how you answer requests from Leads. We are building that view for you; committed for 31 December 2026.

6. Security

6.1 Taking account of the state of the art, the cost of implementation and the risks presented by the processing, we implement appropriate technical and organisational measures under Article 32. The measures in place are listed in Annex C Part 1. Measures that are not in place are listed in Annex C Part 2 and in clause 2.

6.2 We will not materially reduce the measures in Annex C Part 1 during the term.

6.3 We will tell you before making a change that materially affects the security of Protected Data.

6.4 Each Workspace is separated at the database level so that a request made in the context of one agency cannot read another's records. One configuration table is readable across agencies by design, because an incoming phone number must be matched to an agency before isolation can be applied; it holds agency configuration, not Lead Data.

7. Sub-processors

7.1 You give us general authorisation to appoint the sub-processors listed in Annex B, and to appoint others in accordance with this clause.

7.2 We will give you at least 30 days' notice before adding or replacing a sub-processor, by email to your account contact.

7.3 You may object on reasonable data protection grounds within 30 days. We will work with you to find an alternative. If we cannot, either of us may terminate the affected part of the service without penalty, and you will not be charged for the terminated part beyond the termination date.

7.4 Article 28(4) terms are not yet in place. We have not concluded written agreements imposing the obligations in this agreement on the sub-processors in Annex B; they operate on their standard published terms. We will put written terms in place by 31 October 2026 and notify you when each is concluded.

7.5 We have not assessed whether the AI model providers in Annex B retain inputs, or use them to improve or train their models. We will establish that position and record it in Annex B by 31 October 2026. If the answer is unacceptable to you, clause 7.3 applies.

7.6 We remain fully liable to you for the acts and omissions of our sub-processors as if they were our own.

7.7 The service can be configured to send notifications to additional destinations, including messaging and email channels. None is enabled today. Enabling one is a configuration change, so if you ask us to enable one, that destination becomes a sub-processor and clauses 7.2 to 7.6 apply to it.

8. Assisting with data subject requests

8.1 You are the controller. Requests from Leads come to you, and you decide the outcome. We assist you.

8.2 If we receive a request from a Lead we will not respond to it substantively. We will forward it to your account contact within two working days and tell the data subject that we have done so.

8.3 What we can do today.

8.4 Individual Lead erasure is committed for 31 December 2026. Until it is delivered, the only mechanism capable of removing one person's data is deletion of your entire Workspace, which we accept is not a proportionate answer to one individual's request. We will tell you when it is available and what it covers. You should take this into account in the information you give Leads and in how you answer requests in the meantime.

8.5 Three constraints will apply to individual erasure even once it exists, and they should shape what you tell data subjects:

1. Identification is by phone number only. A Lead is identified to the service solely by the WhatsApp number they messaged from. If the same person has used two numbers, the service cannot know they are one person. Any confirmation must be scoped to "the data associated with this number", not "all your data".
2. Scope is one agency. A person who contacted two agencies exists twice, under two separate controllers. A request made to you can only be actioned against your Workspace. They must make a separate request to the other agency.
3. Billing records. The phone number forms part of the record that identifies a unique billable conversation. Some record must survive to substantiate what you were charged. Clause 12.3 and Annex D deal with this.

8.6 We do not charge you for assistance under this clause, except where a request is manifestly unfounded or excessive and we agree a charge with you in advance.

9. Personal data breaches

9.1 We will notify you without undue delay after becoming aware of a personal data breach affecting Protected Data. Once a documented procedure is in place under clause 2.1 we will commit to a fixed maximum period; until then, "without undue delay" is the standard we hold ourselves to and we will notify you as soon as we are aware.

9.2 The notification will describe, so far as we know it: what happened and when; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed. Where we cannot provide everything at once we will provide it in stages.

9.3 We will assist you in meeting your own obligations to notify the Information Commissioner's Office or any other competent authority, and to communicate with data subjects.

9.4 We will not make a public statement identifying you in connection with a breach without your prior agreement, unless we are required to by law.

9.5 Notification is not an admission of fault or liability.

9.6 An operational point you should know. Because there is no audit log of reads of Lead Data (clause 2.1), our ability to establish which records were accessed in an incident is limited to what other logs and system state can show.

10. Impact assessments

10.1 We will provide reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority, taking account of the information available to us.

10.2 We draw two matters to your attention as controller, because they may require assessment before you rely on the service:

1. The enquiry records described in Annex A involve inferring financial and personal circumstances from conversation, and routing an enquiry on that basis. Whether that constitutes a decision producing legal or similarly significant effects under Article 22 has not been assessed.
2. Message content is unconstrained free text. Leads may disclose special category data unprompted, and the service does not detect, filter or redact it.

11. International transfers

11.1 The locations of our sub-processors are stated in Annex B.

11.2 No transfer mechanism has yet been executed. Transfers of Protected Data to the providers in Annex B located outside the United Kingdom currently proceed without an international data transfer agreement, addendum or other Article 46 safeguard in place. We will put appropriate safeguards in place by 31 October 2026 and provide you with copies.

11.3 We will carry out and share a transfer risk assessment for each transfer covered by clause 11.2.

11.4 Where you require us to enter into the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, as controller-to-processor or processor-to-processor, we will do so.

11.5 This agreement addresses UK data protection law. It does not address the data protection law of the United Arab Emirates or of any other jurisdiction in which you or your Leads are located, and you should take your own advice on it.

12. Deletion and return

12.1 During the term you can export the data available through the client area, and can ask us for anything we hold that the export does not cover.

12.2 On termination, and on your written instruction, we run a dedicated deletion process, operated under a restricted database role, against your Workspace. Unless you instruct otherwise we will do this 30 days after termination. You must read the following before relying on this clause. On 19 August 2026 we established that the process removes your configuration, staff and broker records, handoff records, images and metering records, but does not reach the separate database in which conversations and enquiry records are held. Those rows survive, and the process reports success without them. We had previously described this deletion as proven end to end; that proof covered one of two databases and we were wrong to describe it as complete. Extending the process to every store is committed work and is our highest engineering priority. We will tell you when it is delivered and we will not describe this clause as complete before then. We will confirm each deletion when it is done, and that confirmation will state what was and was not reached.

12.3 Things that survive deletion. The list below was accurate for the stores it covered, and is now known to be incomplete: the conversation and enquiry records described in clause 12.2 also survive, and further stores are being enumerated as part of that work. We are leaving the known-incomplete list visible rather than replacing it with a tidier one, and it will be restated in full when the enumeration closes.

1. The billing archive. Records evidencing the basis on which you were billed are archived for six years so that both parties can substantiate the account. Those archives are copied from the conversation records the billing was calculated from, and contain Lead phone numbers. We rely on the need to establish and defend legal claims and to meet accounting record obligations. The six-year period matches the limitation period in England and Wales for contractual claims. We should be clear that this period was inherited from how the deletion process was built rather than chosen as a policy, and it is under review.
2. A snapshot of the deletion. The deletion process records what was removed, and that record includes conversation content. No retention period is currently set for it.
3. Automation engine records. The engine that processes messages retains execution records, including message payloads, for up to 14 days before removing them under its supplier's own default.

Our cache holds short-lived per-Lead conversation state, including recent message text. Every key expires, the longest one hour after last activity, so it clears itself rather than being reached by the deletion process. See Annex C Part 2.

12.4 We recognise that clause 12.3 describes retention that affects your data subjects, that it should be visible to you rather than buried, and that it must be reflected in the information you give them. If you require a shorter period, or a form of archive that does not retain phone numbers, tell us in Annex D and we will agree an approach with you.

12.5 We may retain Protected Data where we are required to by law, and in that case we tell you what we are retaining and why, and continue to protect it under this agreement.

13. Audit and information

13.1 We will make available to you the information reasonably necessary to demonstrate compliance with Article 28, including a description of our processing prepared for that purpose, which we will provide on request under the confidentiality obligations in the Terms of Service.

13.2 You may audit our compliance, or appoint an independent auditor to do so, on 30 days' written notice, no more than once in any twelve-month period, during business hours, subject to confidentiality and without unreasonable disruption. You may audit more often if we have notified you of a personal data breach or if a supervisory authority requires it. Audits are at your cost unless they establish a material breach by us.

13.3 We hold no third-party security certification, and no independent penetration test has been carried out, so no such report can be provided in place of an audit.

14. Liability, term and general

14.1 The liability provisions in the Terms of Service apply to this agreement. Nothing in them limits either party's liability to a data subject or a supervisory authority under Article 82.

14.2 This agreement takes effect on the date of the last signature below, or on the date you first use the service if earlier, and continues until we no longer process Protected Data on your behalf. Clauses 5, 12, 13 and 14 survive.

14.3 If any provision is unenforceable, the rest continues in force.

14.4 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

14.5 We will update the annexes as the service changes and will notify you. A change that reduces our obligations requires your agreement.

Annex A — the processing

Subject matter and duration

Processing of personal data about members of the public who message your WhatsApp number, and about the people whose details you provide to us, for as long as you use the service and until deletion under clause 12.

Nature and purpose

Receiving WhatsApp messages sent to your number; generating replies using third-party AI language models drawing on your documents and persona text; extracting and recording the details of each enquiry; routing enquiries and notifying a broker for handoff; recording images sent by Leads; metering conversations for billing; and storing all of the above in your Workspace.

Types of personal data

Categories of data subject

1. Leads — members of the public who message your WhatsApp number. The largest category.
2. Your staff and brokers — people whose names and phone numbers you supply so the Assistant can notify them. They have no access to the service and may not know it exists. They can be removed only by deleting the Workspace. You are responsible for informing them.
3. Anyone named in a document you upload — uncontrolled content, whose extent is known only to you.

Your client area account holders are a fourth category, but we are their controller and they are outside this agreement.

Annex B — sub-processors

Retention and training of inputs by the AI providers above has not been established. See clause 7.5.

We have not measured whether any component of the platform sends operational telemetry to its own supplier. Until we have, this annex should not be read as an exhaustive list of recipients. We will complete that check by 30 September 2026 and update this annex.

Annex C — security measures

Part 1 — measures in place

Each of the following has been verified as operating.

Part 2 — measures not in place

Stated so that you can assess us on what is true rather than on what is customary. Each of these also appears in clause 2.

• No off-site backups. The service runs on a single server with no copy on separate infrastructure. Loss of that server would mean loss of the data on it. Being resolved by the hosting migration.
• No audit log of access to Lead Data. Reads of conversations and enquiry records are not recorded.
• No encryption at rest at the storage layer. Checked and confirmed absent. Being addressed at the hosting migration.
• Log rotation is in place; targeted deletion is not. Application logs rotate at 10 MB / 7 days, error logs at 30 days, container output at 10 MB × 3 files. No deletion process reaches a named individual inside them.
• No documented incident response procedure. Monitoring exists; a written procedure with defined roles and timings does not.
• No independent certification and no penetration test.
• No written Article 28 terms with sub-processors. See Annex B.
• Our cache holds short-lived per-Lead records. We have checked. It holds conversation state keyed to a Lead, including a buffer of recent message text, and every key carries an expiry — the longest is one hour from last activity. They are removed by expiry rather than by our deletion process, so an erasure is effective there within an hour rather than immediately.

Annex D — your retention instructions

Retention of Lead Data is your decision as controller. Complete the table below with the period you require for each category. We will record your instruction.

Deletion on termination. Unless you specify otherwise here, we delete the Workspace as set out in clause 12.2, subject to the billing archive in clause 12.3.

Additional instructions:

Signed