Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Use between the business customer ("Customer") and NexoraNow. It applies when NexoraNow processes personal data on Customer’s behalf in providing the Services.

Customer is the controller or business, and NexoraNow is the processor or service provider, as those terms are defined by applicable data protection law. Each party will comply with its own legal obligations. Terms not defined here have the meaning in the Terms of Use or applicable law.

NexoraNow will process personal data only to provide, secure, support, and improve the Services; comply with the agreement and documented Customer instructions; and meet legal obligations. The agreement, Customer’s configuration, and authorized use of the Services are Customer’s documented instructions.

Customer is responsible for the lawfulness of its instructions, notices, consents, and data collection. NexoraNow will notify Customer if an instruction appears to violate applicable data protection law, unless legally prohibited.

NexoraNow will ensure people authorized to process personal data are bound by confidentiality duties. NexoraNow will maintain appropriate technical and organizational measures designed to protect personal data based on the nature of processing, available technology, implementation cost, and risks to individuals.

Customer authorizes NexoraNow to use subprocessors for hosting, databases, storage, authentication, communications, payments, support, analytics, and AI functions. NexoraNow will require subprocessors to protect personal data through written obligations appropriate to their services.

NexoraNow remains responsible for subprocessor performance to the extent required by applicable law. Customer may object to a new subprocessor on reasonable data-protection grounds by contacting us promptly after notice. The parties will work in good faith on a commercially reasonable resolution.

Taking into account the nature of processing, NexoraNow will reasonably assist Customer with requests from individuals to exercise privacy rights. If NexoraNow receives a request concerning Customer-controlled data, we may direct the requester to Customer unless law requires otherwise.

NexoraNow will provide reasonable information to help Customer complete legally required impact assessments, consultations, security reviews, and compliance inquiries, considering the information available to NexoraNow.

NexoraNow will notify Customer without undue delay after confirming unauthorized access to or acquisition, alteration, loss, or disclosure of Customer personal data for which notice is required by applicable law. Notice will include available information reasonably needed for Customer’s response and will be updated as appropriate.

Notification is not an admission of fault or liability. Customer is responsible for notifications to individuals and regulators unless law assigns that duty to NexoraNow.

At the end of the Services, NexoraNow will delete or return Customer personal data upon Customer’s reasonable request, unless retention is required by law or permitted for security, backup, dispute, or compliance purposes. Data in backups will be protected and deleted through normal backup cycles.

If Customer personal data is transferred across borders in a way that requires a transfer mechanism, the parties will use an applicable lawful mechanism, which may include standard contractual clauses and supplementary safeguards. Customer authorizes processing in locations used by NexoraNow and its approved subprocessors subject to these protections.

NexoraNow will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may request a reasonable audit no more than once per year, or after a confirmed material security incident, subject to confidentiality, security, non-disruption, and cost-allocation terms. Third-party reports or certifications may satisfy the request where appropriate.

Where U.S. state privacy law applies, NexoraNow acts as Customer’s service provider or processor. NexoraNow will not sell Customer personal data, share it for cross-context behavioral advertising, retain or use it outside the business purposes in the agreement, or combine it with personal data received from another source except as permitted by applicable law.

If this DPA conflicts with the Terms of Use on processing Customer personal data, this DPA controls. All other provisions of the Terms remain in effect.

Data protection questions may be sent to privacy@nexoranow.com.