Data Processing Agreement

Overview

This Data Processing Agreement ("DPA") forms part of the agreement between the customer identified in the applicable Order Form, signature block, or other written agreement ("Controller") and Nexus Core, Inc. ("Processor"). Where no separate written agreement exists, the main agreement is the Nexus Terms of Service.

It sets out the terms on which the Processor processes personal data on behalf of the Controller in connection with the Nexus platform and related services, and it is intended to satisfy Article 28 of the EU General Data Protection Regulation ("GDPR") and the UK GDPR. Where this DPA conflicts with the main agreement on the processing of personal data, this DPA prevails.

1. Scope and roles

1.1 The Controller appoints the Processor to process personal data on its behalf.

1.2 The Controller determines the purposes and means of processing. The Processor processes personal data only on documented instructions from the Controller. This DPA, the main agreement, and the Controller's use of the platform's settings and features are the Controller's documented instructions.

1.3 The Controller warrants that it has a lawful basis for the processing it instructs, and that it has provided the notices to its members that applicable data protection law requires.

2. Nature and purpose of processing

2.1 The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1.

2.2 In summary, processing includes:

• Hosting and managing member profiles
• Suggesting, drafting and facilitating introductions and connections between members
• Scheduling and conducting video meetings
• Transcription and call notes, where the participants have consented
• Analytics and search ranking to improve matching and recommendations for the Controller's community

3. Processor obligations

The Processor shall:

3.1 Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by applicable law; in that case the Processor shall inform the Controller of the legal requirement before processing, unless the law prohibits it.

3.2 Ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Implement the technical and organizational measures set out in Section 6 and Annex 2.

3.4 Assist the Controller, by appropriate technical and organizational measures and insofar as this is possible, in responding to requests from data subjects exercising their rights (Section 8).

3.5 Notify the Controller without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting the Controller's data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, together with any further information reasonably required for the Controller to meet its own notification obligations under applicable law.

3.6 Assist the Controller in ensuring compliance with its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to the Processor.

3.7 Delete or return personal data in accordance with Section 10.

3.8 Make available to the Controller all information necessary to demonstrate compliance with this DPA (Section 9), and inform the Controller immediately if, in its opinion, an instruction infringes applicable data protection law.

4. Sub-processors

4.1 The Controller gives the Processor general authorisation to engage sub-processors. The sub-processors engaged at the effective date of this DPA are listed in Annex 3, and the current list is published at nexus.app/trust.

4.2 The Processor shall impose on each sub-processor, by written contract, data protection obligations that are no less protective than those set out in this DPA, and remains fully liable to the Controller for the performance of each sub-processor's obligations.

4.3 The Processor will notify the Controller of any intended addition or replacement of a sub-processor at least 30 days before the change takes effect, by email to the Controller's registered contact and by updating the published list.

4.4 The Controller may object to such a change on reasonable data protection grounds within that 30-day period. If the parties cannot resolve the objection in good faith, the Controller may terminate the affected services without penalty and Section 10 applies.

4.5 Services the Controller itself connects to its community (for example a CRM or spreadsheet integration authorised by a community admin) are engaged by the Controller, not by the Processor, and are not sub-processors under this DPA.

5. International data transfers

5.1 The Processor is established in the United States and hosts the Controller's personal data there. Where the Controller, or the members whose data it instructs the Processor to process, are in the European Economic Area, the United Kingdom or Switzerland, the Controller's use of the services involves a transfer of personal data to the United States.

5.2 The parties enter into the following transfer mechanisms, which form part of this DPA:

• EU Standard Contractual Clauses. The standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914 (the "SCCs"), Module Two (controller to processor), are incorporated by reference, with the Controller as data exporter and the Processor as data importer. The options and annex content the SCCs require are set out in Annex 5. Annexes 1, 2 and 3 of this DPA serve as Annexes I, II and III of the SCCs.
• UK International Data Transfer Addendum. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0 in force from 21 March 2022 (the "UK Addendum"), is incorporated by reference and completed as set out in Annex 6. The UK Addendum amends the SCCs for those transfers, and the UK Addendum's mandatory clauses prevail over the SCCs to the extent of any conflict.
• Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the adaptations the Federal Data Protection and Information Commissioner requires: references to the GDPR are read as references to the FADP, the competent supervisory authority is the FDPIC, and data subjects in Switzerland may enforce their rights in Switzerland.

5.3 If a transfer mechanism in Section 5.2 is invalidated or replaced, the parties will cooperate in good faith to put a replacement mechanism in place promptly, and the Processor may suspend the affected transfer in the meantime.

5.4 Onward transfers to sub-processors in third countries are made under the Processor's written agreements with those sub-processors, which incorporate the SCCs (Module Three, processor to processor) and, where applicable, the UK Addendum.

6. Security measures

The Processor implements appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, including:

• Encryption in transit using industry-standard protocols (TLS 1.2 or higher)
• Encryption of personal data at rest within production systems and backups
• Role-based access controls ensuring access is limited to authorized personnel on a least-privilege basis
• Multi-factor authentication (MFA) for access to production systems and administrative interfaces
• Monitoring and logging of system activity, including access to personal data, with logs retained for at least 30 days
• Regular vulnerability assessments and security reviews
• Backup and disaster recovery procedures, with encrypted backups rotated within 35 days
• Procedures for regularly testing, assessing, and evaluating the effectiveness of security measures

Further detail on each of these measures is set out in Annex 2.

7. Use of data and artificial intelligence

7.1 No model training. The Processor shall not use the Controller's personal data, or any content, introductions, match outcomes, transcripts or edits generated in the Controller's community, to train, fine-tune, or otherwise improve any machine learning or artificial intelligence model, whether the Processor's own or a third party's. The Processor's agreements with the AI sub-processors listed in Annex 3 prohibit those providers from using data submitted through the Processor's accounts to train their models.

7.2 Community-scoped use. The Processor uses the Controller's personal data to provide and improve the services for the Controller's own community: to search, rank, suggest and draft introductions between the Controller's members, and to learn the Controller's admins' preferences for how introductions are written. The Processor shall not use the Controller's personal data to generate matches, recommendations, introductions or any other output for a different customer, and shall not disclose it to a different customer, except as set out in Section 7.3.

7.3 Bridges. Where the Controller opens or accepts a bridge with another community through the platform, the Controller instructs the Processor to use the member data the Controller selects for that bridge to suggest and facilitate introductions with members of that other community, for as long as the bridge is open. Each party to a bridge sees only the details the other party chose to share, and only for members who have each agreed to an introduction. Closing the bridge ends that instruction.

7.4 Members in more than one community. A person's own profile (name, role, company, location, about, expertise and interest tags) belongs to that person and accompanies them into every community they join on the platform. Data that belongs to the Controller's community, including community-specific profile fields, notes, match history, outcomes, transcripts and call notes, does not.

7.5 Internal quality evaluation. The Processor may use samples of the Controller's personal data for internal testing and quality evaluation of the services by the Processor's own staff, under the confidentiality and access controls in this DPA. Such use never trains a model, never discloses the data to another customer, and never produces output for another customer.

7.6 Aggregated service data. The Processor may derive and retain aggregated, de-identified statistics about the use of the services (for example counts of introductions made or acceptance rates) that do not identify the Controller, its members, or any individual.

8. Data subject rights

8.1 The platform lets members view, correct, export and delete their own profile and account. For any request that cannot be fulfilled in-app, the Processor shall assist the Controller within 10 business days of a written request to privacy@nexus.app.

8.2 If a data subject contacts the Processor directly about the Controller's processing, the Processor shall refer the request to the Controller without undue delay and shall not respond on the merits except on the Controller's instructions or where applicable law requires it.

9. Audit and information

9.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA, including its current security documentation, sub-processor list and this DPA's annexes, and shall respond to reasonable written security questionnaires no more than once per year.

9.2 Where that information is insufficient to demonstrate compliance, the Controller or an independent auditor mandated by the Controller and bound by confidentiality may audit the Processor's relevant controls once per year, or following a personal data breach affecting the Controller's data, on at least 30 days' written notice, during business hours, without unreasonable disruption, and at the Controller's cost.

10. Retention and deletion

10.1 The Processor retains personal data for the periods set out in Annex 4, and deletes or de-identifies it when the period ends.

10.2 Upon termination or expiry of the services, the Processor shall, at the Controller's choice, delete or return all personal data to the Controller within 30 days and delete existing copies, unless applicable law requires continued retention, in which case the Processor shall retain only what the law requires, for only as long as it requires, and shall continue to protect it under this DPA. Encrypted backups are rotated out within 35 days of deletion.

10.3 A member may delete their own account at any time, and the Controller may remove a member from its community at any time. Section 10.2 applies to that member's data in the Controller's community accordingly.

11. Term and termination

11.1 This DPA remains in effect for as long as the Processor processes personal data on behalf of the Controller.

11.2 Obligations that by their nature survive termination, including Sections 3.2, 7, 10 and 12, survive.

12. Liability

12.1 Each party's liability under this DPA is subject to the limitations set forth in the main agreement, except that nothing in this DPA limits either party's liability to data subjects under the SCCs or the UK Addendum, or any liability that cannot be limited under applicable law.

13. Governing law

13.1 This DPA is governed by the law that governs the main agreement. The SCCs and the UK Addendum are governed by the law and courts stated in Annexes 5 and 6, and where this DPA and those instruments conflict, the SCCs or UK Addendum prevail for the transfers they cover.

14. Contact

For data protection inquiries, including Controller instructions under this DPA and assistance with data subject requests:

Nexus Core, Inc.
701 Brazos St, Austin, TX 78701, United States
privacy@nexus.app

Annex 1 — Description of the processing

This Annex also serves as Annex I of the SCCs and Table 1 of the UK Addendum.

A. List of parties

Data exporter (Controller): the customer identified in the applicable Order Form, signature block, or other written agreement. Role: controller. Activities: operating a professional community on the Nexus platform and instructing the processing described below. Contact: as given in the signature block.

Data importer (Processor): Nexus Core, Inc., 701 Brazos St, Austin, TX 78701, United States. Role: processor. Activities: providing the Nexus platform. Contact: privacy@nexus.app.

B. Description of transfer and processing

C. Competent supervisory authority

For transfers under the SCCs, the supervisory authority of the EU member state in which the data exporter is established, or, where the data exporter is not established in the EU, the Irish Data Protection Commission. For transfers under the UK Addendum, the UK Information Commissioner.

Annex 2 — Technical and organizational measures

This Annex also serves as Annex II of the SCCs. The Processor maintains and implements the following technical and organizational measures:

1. Access control

• Access to systems containing personal data is restricted to authorized personnel only
• Role-based access control (RBAC) is enforced
• Multi-factor authentication (MFA) is required for privileged access

2. Data protection

• Personal data is encrypted in transit using TLS 1.2 or higher
• Personal data is encrypted at rest in production systems and backups
• Logical separation of customer data is maintained, and search, matching and introduction drafting are scoped to one community at a time (Section 7)

3. Monitoring and logging

• System access and activity are logged and monitored
• Logs are retained for at least 30 days
• Alerts are configured for suspicious or unauthorized activity

4. Infrastructure security

• Systems are hosted on secure cloud infrastructure provided by Amazon Web Services and Vercel
• Network security controls include firewalls and access restrictions
• Regular patching and updates are applied to infrastructure and dependencies

5. Backup and recovery

• Regular automated backups of personal data are performed
• Backups are encrypted and stored securely
• Backups are rotated out within 35 days
• Disaster recovery procedures are in place to restore availability

6. Organizational security

• Personnel are subject to confidentiality obligations
• Security awareness practices are followed
• Access to personal data is limited based on job responsibilities

7. Testing and evaluation

• Security measures are periodically reviewed and updated
• Vulnerability assessments are conducted
• Measures are adjusted to address evolving risks

Annex 3 — Sub-processors

This Annex also serves as Annex III of the SCCs. Sub-processors engaged at the effective date of this DPA; the live list is at nexus.app/trust.

Annex 4 — Retention schedule

Periods run from the event named in each row. Where a period ends before the account is deleted, the data is deleted or de-identified by a scheduled job; what remains is deleted under Section 10.

Annex 5 — Standard Contractual Clauses: module and options

The SCCs (Commission Implementing Decision (EU) 2021/914) are incorporated by reference as follows:

Signature of this DPA by both parties constitutes signature of the SCCs. The full text of the SCCs is published by the European Commission and is available from the Processor on request.

Annex 6 — UK International Data Transfer Addendum

The UK Addendum (version B1.0, in force 21 March 2022) is incorporated by reference. Its Part 1 tables are completed as follows; its Part 2 mandatory clauses apply as published by the Information Commissioner.

Table 1: Parties

Exporter: the Controller, as identified in the signature block. Importer: Nexus Core, Inc., 701 Brazos St, Austin, TX 78701, United States; key contact privacy@nexus.app. Start date: the effective date of this DPA or the date of the last signature, whichever is later.

Table 2: Selected SCCs, modules and selected clauses

The Approved EU SCCs as incorporated in Annex 5, Module Two, with the options selected there (Clause 7 not included; Clause 11 optional language not included; Clause 9(a) Option 2 with a 30-day notice period), and with the UK Addendum's mandatory clauses applied.

Table 3: Appendix information

Annex 1A (parties): Annex 1, Part A. Annex 1B (description of transfer): Annex 1, Part B. Annex II (technical and organisational measures): Annex 2. Annex III (list of sub-processors): Annex 3.

Table 4: Ending the Addendum when the Approved Addendum changes

Either the Importer or the Exporter may end the UK Addendum as set out in Section 19 of its mandatory clauses.

Signature of this DPA by both parties constitutes signature of the UK Addendum.