Data Processing Agreement

1. Roles and instructions

You are the controller of Customer Personal Data and Nuronix is your processor (service provider). Nuronix processes it only to provide, secure and support the service, and otherwise only on your documented instructions — your use and settings of the software are those instructions — unless the law requires otherwise, in which case we will tell you first unless the law forbids it.

You are responsible for having a lawful basis for the data you put into Nuronix and for giving the people concerned the notices the law requires.

2. What is processed

• Subject matter and duration: providing the Nuronix service for as long as your account exists, plus the deletion period below.
• People concerned: your users, employees, contractors, customers, suppliers and their contacts.
• Types of data: names, contact details, addresses, tax and company registration numbers, bank details, order, invoice and payment history, and for employees, pay, attendance, leave and the identifiers you enter for payroll.
• Special categories: Nuronix is not designed for health or other special-category data; do not enter it unless the law allows and you have taken the needed safeguards.

3. Confidentiality and security

Everyone at Nuronix who can access Customer Personal Data is bound by confidentiality. We keep appropriate technical and organisational measures in place, including encryption in transit and at rest, hashed passwords, optional two-step sign-in, role-based access, separation of each business's data, audit logging, backups and restricted staff access.

4. Sub-processors

You authorise the sub-processors listed in our Privacy Policy. Nuronix binds each one to data protection terms no less protective than this DPA and stays responsible for them. We will announce a new sub-processor for Customer Personal Data at least 30 days in advance; if you object on reasonable data protection grounds and we cannot resolve it, you may end the affected service and receive a refund of prepaid fees for the unused period.

5. International transfers

Customer Personal Data is stored in the United States. For transfers from the EEA, the UK or Switzerland, the European Commission's Standard Contractual Clauses (Module 2 controller-to-processor, or Module 3 where you are yourself a processor) and the UK International Data Transfer Addendum are incorporated into this DPA by reference, with Nuronix as data importer, and the same safeguards are passed on to our sub-processors.

6. Helping you

• Requests from individuals: the software lets you find, correct, export and delete records; we will help with any request you cannot handle yourself, and pass on any request we receive directly.
• Personal data breaches: we will notify you without undue delay, and in any case within 48 hours of becoming aware, with the information you need to meet your own reporting duties.
• Impact assessments and regulator consultations: we will give reasonable help, taking into account the nature of the processing.

7. CCPA service-provider terms

Nuronix will not sell or share Customer Personal Data, keep, use or disclose it for any purpose other than providing the service, or combine it with personal data from other sources except as the CCPA allows. Nuronix will tell you if it can no longer meet these obligations.

8. Deletion and return

You can export your records at any time. When your account is closed and you ask us to delete it, we delete Customer Personal Data within 30 days, and copies in backups are overwritten in the normal backup cycle, unless the law requires us to keep it.

9. Audits

We will make available the information reasonably needed to show compliance with this DPA, and answer a reasonable security questionnaire once a year. On-site audits, where the law requires them, need 30 days' notice, take place in business hours, and are at your cost.

10. Order of precedence

If this DPA and the Terms of Service conflict about personal data, this DPA applies. If the Standard Contractual Clauses conflict with either, the Clauses apply.