Legal

Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is entered into between ZAHA GLOBAL ("Processor") and the organization using NexusKit ("Controller"). This DPA supplements the Terms of Use and Privacy Policy and governs the processing of personal data in connection with the NexusKit service.

1. Parties and Roles

Processor: ZAHA GLOBAL, acting as the data processor for the NexusKit platform. Controller: The organization using NexusKit, determining the purposes and means of personal data processing.

2. Scope of Processing

The Processor processes personal data on behalf of the Controller exclusively for the purposes of providing the NexusKit service as described in the applicable service agreement. All processing is carried out in accordance with the Controller's documented instructions.

3. Types of Personal Data

• Contact form submission data (name, email, message content)
• API usage metrics and analytics data
• Account provisioning and subscription information

4. Processor Obligations

• Process data only on the Controller's documented instructions
• Ensure persons handling data are subject to confidentiality obligations
• Implement appropriate technical and organizational security measures
• Delete or return all personal data at the end of the processing relationship
• Assist the Controller with data subject rights requests

5. Subprocessors

The Processor may engage subprocessors for specific processing activities. The current list of subprocessors is maintained at /subprocessorsand the Processor will notify the Controller of any changes at least 30 days prior to engagement, unless contractually prohibited.

6. Controller Obligations

• Provide lawful basis for each processing activity
• Maintain records of processing activities
• Assist the Processor as necessary for compliance

7. Data Subject Rights

The Processor will assist the Controller in fulfilling obligations under applicable data protection laws, including responding to access, rectification, erasure, restriction, and portability requests within commercially reasonable timelines.

8. Security Measures

The Processor implements appropriate technical and organizational measures including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Access controls and role-based authorization
• Regular security assessments and vulnerability scanning
• Incident response procedures with 72-hour breach notification to Controller

9. Duration and Termination

This DPA remains in effect for the duration of the Controller's NexusKit agreement and survives termination of the service agreement for purposes of data deletion and ongoing compliance obligations.

10. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the jurisdiction in which ZAHA GLOBAL is registered, without regard to its conflict of law provisions.