Data Processing Agreement

DATA PROCESSING AGREEMENT

This Data Processing Agreement (“Agreement”) is incorporated into and forms part of the Terms of Use (“Terms”) for the Nexley AI software-as-a-service platform operated by Nexley AI Limited. This Agreement shall be effective from the date the Client accepts the Terms, whether by clicking “I accept” or similar button or by accessing or using the Nexley AI services. By accepting the Terms, the Client explicitly agrees to be bound by this Agreement. This Agreement is deemed to be an integral part of the Terms entered into between Nexley AI Limited (“Processor” or “Company”) and the Client (“Controller” or “Client” or “Customer”).

Under this Agreement, Company acts as a Data Processor processing Personal Data on behalf of the Client (who acts as the Data Controller) in connection with the Client’s use of the Nexley AI services, including the hosting, provision, support, and management of the software-as-a-service platform and the processing of client-provided prompts, inputs, files, output data, user account data, and other personal data submitted to or generated through the services. The Processor processes Personal Data solely on documented instructions from the Controller and does not determine the purposes or means of processing, except where required by applicable law. The Processor may act as an independent Controller only for its own business administration purposes (such as invoicing, account management, service communications, and legal compliance) as set out in the Processor's Privacy Policy, which is separate from this Agreement.

DEFINITIONS

For the purposes of this Agreement, the terms: “Controller”, “Data Subject”, “Joint-Controller(s)”, “Personal Data”, “Personal Data Breach”, “Processing”, “Processor”, “Special Categories of Personal Data”, and “Sub-Processor” shall have the meanings given to them in Article 4 of the UK GDPR and the Data Protection Act 2018. The following additional terms shall have the meanings:

Any other capitalised terms in this Agreement, not defined herein, shall have the meanings set out in the Terms.

1Scope of this AGREEMENT

For the purposes of this Agreement and the Terms, the parties acknowledge and agree that:

(a)This Agreement applies to all Personal Data processed by the Processor through the Nexley AI platform on behalf of the Client, including data uploaded or submitted by the Client, data contained in prompts, files, documents, datasets, messages, and other inputs, data generated through the platform's functionality, data processed via third-party integrations and Sub-Processors used to provide the services, and related metadata and usage logs, all of which shall be processed in compliance with Applicable Privacy Laws and solely on the documented instructions of the Client.

(b)Independent Controllers. This Agreement does not apply to the parties’ respective obligations as independent Controllers of Personal Data. Company and the Customer operate as separate Controllers in respect to the Personal Data either party may independently process in connection with the performance of obligations under the Terms or otherwise. Accordingly:

(i)the Processor shall be deemed a separate Controller only for Personal Data it processes for its own business administration purposes, such as invoicing, account management, service communications, and compliance. The Processor shall not act as a Controller for any Personal Data uploaded by the Client or processed through the Nexley AI services, including any prompts, files, documents, datasets, messages, outputs, or other content provided by the Client or generated by the platform. The Processor shall not use Client-uploaded data or outputs derived from such data for AI model training, service improvement using identifiable Personal Data, or any other secondary purpose without the express prior written consent of the Client.

(ii)The Client shall be deemed a separate Controller for Personal Data related to its own employees, contractors, end users, customers, and any third parties whose data the Client independently collects and processes outside the scope of the Nexley AI services. Where the Client uploads or otherwise submits Personal Data of third parties through the services, the Client warrants and represents that it has all necessary rights, notices, lawful bases, consents, and permissions required under Applicable Privacy Laws for the Processor to process that Personal Data on the Client’s behalf in accordance with the Terms and this Agreement, including in connection with any authorised Sub-Processors and international transfers. The Client shall indemnify the Processor against any claims, losses, or liabilities arising from the Client's breach of these warranties.

(iii)The parties hereby undertake to respect applicable laws which apply to them as separate Controllers and to be liable separately for their own controllership obligations and responsibilities when acting as separate Controllers.

2Roles of the parties

The parties agree that this Agreement shall only apply to processing activities whereby:

(a)The Protected Data is uploaded or otherwise submitted by the Client to the Nexley AI platform, processed by the Processor on behalf of the Client, and exchanged between the Processor and the Client as part of and in the course of performance of their respective obligations under the Terms of Use. This includes data uploaded or submitted by the Client, data generated through the platform’s functionality, and data processed via third-party integrations and Sub-Processors used to provide the services.

(b)The Processor acts as a Data Processor for all Client data processed through the Nexley AI platform, and as an independent Controller only for its own business administration purposes as detailed in the Terms and its Privacy Policy. The Processor shall not process Client-uploaded Personal Data for AI model training or any purpose other than delivering, securing, supporting, and administering the contracted services, unless the Client provides separate, explicit written consent for such processing.

Nothing in this Agreement relieves either party of any of their respective responsibilities or liabilities under the Applicable Privacy Laws. Each party shall be liable for its own breaches of the Applicable Privacy Laws. The Processor shall be liable for any unauthorised or unlawful processing of Protected Data, failure to implement appropriate security measures as required by Article 32 UK GDPR, or breach of the obligations set out in this Agreement, to the extent caused by the Processor's acts or omissions. Where a breach involves a Sub-Processor, the Processor shall remain responsible for that Sub-Processor's processing to the extent required by Applicable Privacy Laws and the terms of this Agreement. The Client shall be liable for ensuring that all instructions to the Processor are lawful and that it has obtained all necessary legal bases and permissions for the processing contemplated under this Agreement, including for any third-party Personal Data uploaded to the platform.

3CUSTOMER’s compliance with Applicable Privacy Laws

When acting as Controller, the Client shall at all times comply with all Applicable Privacy Laws. The Client shall ensure that all instructions given by it to the Processor in respect of Protected Data (including the terms of this Agreement) shall at all times be in accordance with Applicable Privacy Laws. The Client shall be solely responsible for: (a) ensuring that it has obtained all applicable legal bases, consents, and authorisations required under Applicable Privacy Laws for the processing contemplated under this Agreement; (b) providing all notices and information to Data Subjects required under Applicable Privacy Laws, including notice of the use of the Nexley AI services, authorised Sub-Processors, and any relevant international transfers; (c) where the Client uploads or otherwise submits Personal Data of third parties, obtaining all necessary consents or permissions where required; (d) ensuring that any special category data uploaded to the platform is processed in accordance with Article 9 UK GDPR and that the Client has identified an appropriate Article 6 lawful basis and Article 9 condition; and (e) responding to any complaints or requests from Data Subjects in relation to the processing of their Personal Data through the Nexley AI platform, with reasonable assistance from the Processor as set out in Section 8 of this Agreement.

4Company’s compliance with Applicable Privacy Laws

The Processor shall process Protected Data in compliance with the obligations placed on it under Applicable Privacy Laws and the terms of this Agreement. In particular, the Processor shall: (a) process Protected Data only on documented instructions from the Client as set out in this Agreement and the Terms of Use; (b) ensure that persons authorised to process Protected Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk as required by Article 32 UK GDPR, including measures to protect against unauthorised or unlawful processing and accidental loss, destruction, or damage; (d) not engage any Sub-Processor without prior specific or general written authorisation from the Client as set out in Section 7 of this Agreement; (e) assist the Client in responding to requests from Data Subjects exercising their rights under Chapter III UK GDPR as set out in Section 8 of this Agreement; (f) assist the Client in ensuring compliance with the obligations under Articles 32 to 36 UK GDPR (security, breach notification, DPIA, and prior consultation); (g) delete or return Protected Data in accordance with Section 12 of this Agreement after the end of the provision of services, unless retention is required by applicable law; and (h) make available to the Client all information necessary to demonstrate compliance with Article 28 UK GDPR and allow for and contribute to audits and inspections as set out in Section 10.

5Processing Instructions and Lawful Basis

Processor shall only process (and shall ensure that its personnel and Sub-Processors only process) the Protected Data in accordance with the Client’s documented instructions as set out in Schedule 1 (Part A) of this Agreement, the Terms of Use, and any additional written instructions provided by the Client from time to time, except to the extent: (a) that alternative processing instructions are agreed between the parties in writing; or (b) otherwise required by Applicable Privacy Laws (in which case, the Processor shall inform the Client of that legal requirement before processing, unless applicable law prevents it doing so on important grounds of public interest). The Processor shall not process Protected Data for any purpose other than as instructed by the Client, and shall not disclose, share, or transfer Protected Data to any third party except as expressly authorised in this Agreement or as instructed in writing by the Client. If the Processor believes that any instruction received by it from the Client is likely to infringe the Applicable Privacy Laws, the Processor shall promptly inform the Client. The Processor shall not use Protected Data, including prompts, files, documents, datasets, messages, outputs, or other uploaded content, for AI model training or any secondary purpose without the Client's separate prior written consent.

6Security

To protect the Protected Data against accidental, unauthorised or unlawful destruction, loss, alteration, disclosure or access, the Processor shall implement and maintain appropriate technical and organisational measures in accordance with Article 32 of the UK GDPR, including as appropriate: (a) hosting data on secure infrastructure with encryption at rest and in transit; (b) maintaining logs of relevant system access, administrative actions, and security events; (c) implementing access controls, least-privilege permissions, and authentication measures; (d) providing secure access through the Nexley AI platform with authentication and session management controls; (e) ensuring secure integration with third-party service providers and APIs through encrypted connections and access controls; (f) implementing controls for the secure handling, segregation, retention, and deletion of customer content and output data; (g) regular security assessments and vulnerability management; (h) incident response and breach notification procedures; and (i) personnel training on data protection and security, all as further detailed in Schedule 1 (Part B) of this Agreement.

7Sub-processing

The Client grants the Processor general written authorisation to engage the Sub-Processors listed in Schedule 1 (Part C) and any additions or replacements notified in accordance with this section. The Processor’s current list of Sub-Processors is set forth in Schedule 1 (Part C). The Processor shall maintain an up-to-date list of Sub-Processors on its website or otherwise make such list available to the Client on request and shall notify the Client of any intended addition or replacement of a Sub-Processor by email at least thirty (30) days before the addition or replacement takes effect. The Client may object to a new or replacement Sub-Processor on reasonable data protection grounds by written notice to the Processor within that thirty (30) day period. If the Client objects and the Processor cannot reasonably accommodate the objection, the Client may terminate the affected services by written notice. The Processor shall ensure that each Sub-Processor is bound by written obligations that provide a level of protection for Protected Data no less protective than the obligations set out in this Agreement, to the extent applicable to the nature of the services provided by that Sub-Processor.

8Data Subjects Rights

(a)Company shall, taking into account the nature of the processing, provide reasonable assistance to the Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer’s obligations to respond to requests for exercising Data Subjects’ rights under Chapter III of the UK GDPR (and any similar obligations under Applicable Privacy Laws) in respect of any Protected Data. Company acknowledges that responding to Data Subject requests may require technical assistance to locate, retrieve, correct, restrict, export, or delete data from the platform and relevant integrated systems, and shall provide such assistance within a reasonable timeframe.

(b)Customer shall promptly notify Company if it receives a request from a Data Subject under any Applicable Privacy Law in respect of Personal Data processed through the Nexley AI services. Customer shall remain responsible for responding to such requests as the Data Controller, save to the extent that technical assistance from Company is reasonably required to fulfil the request. Company shall provide reasonable assistance to Customer in responding to Data Subject requests within a reasonable time after receiving a request for assistance from Customer.

9International transfers

Company shall not transfer Protected Data to countries outside the United Kingdom except where appropriate safeguards are in place in accordance with Applicable Privacy Laws, including through the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations, or another lawful transfer mechanism. Where Company uses Sub-Processors or integrations located outside the United Kingdom, such transfers shall be governed by the applicable transfer mechanism identified in Part C where relevant. For transfers to countries that are not subject to adequacy regulations, Company shall implement the relevant transfer mechanism and any supplementary technical and organisational measures reasonably required under Applicable Privacy Laws. Company shall provide information about such transfers to the Customer on request.

10Audits and processing

Company shall, in accordance with Applicable Privacy Laws, make available to the Customer such information as is necessary to demonstrate Company's compliance with its obligations under this Agreement, including relevant security documentation, certifications, and audit reports relating to the services and their Sub-Processors where available. Company shall maintain appropriate records of processing activities and security measures relating to Personal Data processed through the Nexley AI platform to demonstrate compliance with Article 28 of the UK GDPR and any equivalent Applicable Privacy Laws. Company shall allow for and contribute to audits, including inspections, by the Customer (or another auditor mandated by the Customer), subject to confidentiality obligations, a maximum of one audit request in any 12-month period, reasonable advance notice, normal business hours, and minimal disruption to Company's business, except where the audit relates to or follows a Personal Data Breach.

11Personal Data Breach

Company shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Protected Data, including any such breach occurring at a Sub-Processor, and shall provide the Customer with information reasonably available to Company to assist the Customer in meeting its obligations under Applicable Privacy Laws. Such information may include: (a) a description of the nature of the breach; (b) the categories and approximate number of Data Subjects affected, where known; (c) the categories and approximate number of Personal Data records affected, where known; (d) the likely consequences of the breach, where known; and (e) the measures taken or proposed to address, investigate, mitigate, and remediate the breach. Company shall cooperate with the Customer and take reasonable steps to investigate, mitigate, and remediate each such Personal Data Breach.

12Deletion/Return

(a)Upon termination of the Terms, Company shall provide Customer with the ability to export the Protected Data through the platform's self-service export tools or another reasonable export mechanism in a commonly used machine-readable format for thirty (30) days following termination, unless earlier deletion is requested by Customer. No later than ninety (90) days following termination, Company shall securely delete all Protected Data from its systems, including backups, except where applicable law requires retention. Company shall, upon Customer's written request, provide written confirmation of deletion. Security and audit logs that Company keeps as an independent Controller under “Additional Processing Activities” may be kept for up to 12 months, as described in its Privacy Policy.

(b)Notwithstanding the foregoing, Company may retain anonymised and aggregated data derived from Customer's use of the Nexley AI services, provided that such data cannot be used to identify, directly or indirectly, any individual Data Subject, Customer, or third party and has been anonymised in accordance with Applicable Privacy Laws. Such anonymised and aggregated data may be used for security, service performance, analytics, and internal reporting purposes, but shall not include identifiable customer content.

13Additional Processing Activities

(a)Company may process certain Personal Data as an independent Controller strictly for its own business operations, including compliance, billing, account management, customer communications, fraud prevention, and service administration. Company shall not process identifiable customer-submitted content or output data as a Controller except as otherwise expressly permitted under the Terms, this Agreement, or applicable law. Such controller processing will be governed by Company's Privacy Policy and conducted in accordance with Applicable Privacy Laws. For the avoidance of doubt, all processing of customer-submitted content and output data on behalf of the Customer shall be conducted solely as a Processor on documented instructions from the Customer.

(b)Each party will provide any privacy notice required of it under Applicable Privacy Laws in connection with its own processing activities. Customer shall be responsible for obtaining all necessary consents, notices, and permissions from third parties whose Personal Data is submitted to the Nexley AI services where required by Applicable Privacy Laws.

14Liability

Company shall be liable for any breach of Applicable Privacy Laws resulting from its processing activities as a Data Processor to the extent provided under Applicable Privacy Laws and this Agreement. Customer shall be liable for ensuring the lawful basis for processing and compliance with Applicable Privacy Laws in its role as Data Controller. All liability under this Agreement shall be subject to the limitations and exclusions of liability set forth in the Terms.

15General Terms

(a)Confidentiality. The confidentiality provisions in the Terms shall apply to all information and data processed under this Agreement. Company shall ensure that all personnel with access to Protected Data are bound by appropriate confidentiality obligations and have received adequate data protection training.

(b)Notices. All notices and communications given under this Agreement must be in writing and will be delivered in accordance with the notice provisions set out in the Terms.

(c)Governing Law and Jurisdiction. This Agreement is governed by the laws of England and Wales. Any dispute arising in connection with this Agreement, which the parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the courts of England and Wales, provided that this does not affect the jurisdiction of the Information Commissioner's Office or other relevant supervisory authorities under Applicable Privacy Laws.

Schedule 1

Part AProcessing Activities

Processing of Protected Data by Company under this Agreement and the Terms shall be for the subject matter, duration, nature and purposes, and involve the types of Personal Data and categories of Data Subjects, set out in this Part A.

Part BMinimum technical and organisational security measures

In accordance with Applicable Privacy Laws, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of the Protected Data to be carried out under or in connection with the Terms and Conditions, as well as the risks to the rights and freedoms of natural persons, Company shall implement and maintain appropriate technical and organisational security measures proportionate to the risk, and shall review and update those measures periodically.

Part CCompany's Authorised Sub-Processors and International Data Transfers

The Sub-Processors below may receive, store, view or otherwise process Customer data in providing the services. This list is current at 9 October 2026.

Data categories: Content (messages, files and other material submitted to or generated by the services); Account (names, contact details and user identifiers); Technical (IP addresses, device identifiers and logs); Billing (billing contacts, payment details and transactions).

Transfer methods: DPF (the UK Extension to the EU-US Data Privacy Framework); SCCs (the EU Standard Contractual Clauses with the UK Addendum issued by the Information Commissioner); IDTA (the UK International Data Transfer Agreement); UK adequacy (UK adequacy regulations).

Customer data is not used to train AI models. The services learn from each Customer’s own data to improve that Customer’s experience of the platform; this forms part of the services, stays within the Customer’s own account and is never used for any other customer. Where a payment or messaging provider uses data for its own fraud or abuse prevention as an independent controller, this is shown below. The Company will give at least thirty (30) days’ notice before adding or replacing a Sub-Processor, as set out in the Sub-processing clause. Accounts the Customer connects under its own terms are not Sub-Processors.