Standard template · made under the UK GDPR and the Data Protection Act 2018 · v1.0
This Data Processing Agreement (the "Agreement" or "DPA") is entered into between:
(1) [Controller — client organisation name], a company registered in England and Wales under company number [company number], whose registered office is at [registered office address] (the "Controller"); and
(2) Nexus Network Ltd (trading as Nexus Growth Academy), a company registered in England and Wales under company number 16377446, whose registered office is at 2 Loughborough Road, Mountsorrel, Loughborough, LE12 7AT (the "Processor"),
each a "Party" and together the "Parties".
(A) The Processor provides an AI-enabled learning and recruitment-support platform comprising a web application ("AI Academy") and an associated AI agent ("Hermes") (together, the "Services").
(B) In providing the Services, the Processor processes personal data on behalf of the Controller. This Agreement sets out the terms on which that processing is carried out and governs the Parties' respective obligations under Data Protection Law.
(C) This Agreement is incorporated into and forms part of the principal services agreement between the Parties (the "Principal Agreement"). Where there is a conflict on data protection matters, this Agreement prevails.
1.1 Unless otherwise defined, the following terms have the meanings set out below; other capitalised terms have the meaning given in the Principal Agreement.
2.1 The Parties acknowledge that, for the Personal Data processed under this Agreement, the Controller is the controller and the Processor is the processor.
2.2 The Processor will process Personal Data only as a processor acting on the Controller's behalf and not for its own purposes.
3.1 The Processor shall process Personal Data only on the documented instructions of the Controller, including the instructions set out in this Agreement and the Principal Agreement, unless required to do otherwise by law (in which case it shall, where legally permitted, inform the Controller first).
3.2 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.
3.3 The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Law.
3A.1 Tools and reference data created or maintained by the Controller or its users through the Build Studio feature form part of the Controller's content and, where they contain Personal Data, are processed by the Processor as processor on the Controller's documented instructions under this Agreement.
3A.2 Build Studio tools are sealed by default and do not transmit data externally. Where the Controller enables optional connectivity or an "open" mode for a tool, any resulting transfer of data is performed on the Controller's instruction and responsibility; the Controller is responsible for ensuring a lawful basis and appropriate safeguards for any such transfer, and shall not enable open connectivity for tools processing Personal Data or Special Category Data.
3A.3 Where the Controller enables approved live-data connectors, the relevant connector providers act as Sub-processors, listed in Annex 3. The Processor does not verify, and is not the source of record for, the Controller's reference data or content.
4.1 The Processor shall ensure that all personnel authorised to process the Personal Data are bound by appropriate confidentiality obligations and are made aware of the confidential nature of the data.
4.2 The Processor shall limit access to the Personal Data to those personnel who need access to it to provide the Services.
5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in Annex 2.
5.2 The Processor shall regularly review and, where appropriate, update those measures.
6.1 The Controller provides general authorisation for the Processor to engage the Sub-processors listed in Annex 3 for the purposes described.
6.2 The Processor shall impose on each Sub-processor, by written contract, data protection obligations equivalent to those in this Agreement, and remains fully liable to the Controller for the performance of each Sub-processor's obligations.
6.3 The Processor shall give the Controller 30 days' prior notice of any intended addition or replacement of a Sub-processor, and the Controller may object on reasonable data-protection grounds within that period.
7.1 Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in responding to requests from Data Subjects exercising their rights under Data Protection Law.
7.2 If the Processor receives a request directly from a Data Subject, it shall not respond except on the Controller's documented instructions, and shall promptly forward the request to the Controller.
8.1 The Processor shall assist the Controller, taking into account the nature of processing and the information available to it, in ensuring compliance with its obligations relating to security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner's Office (ICO).
9.1 The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting the Controller's Personal Data.
9.2 The notification shall describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address it.
10.1 On termination or expiry of the Services, the Processor shall, at the Controller's choice, delete or return all Personal Data and delete existing copies, unless retention is required by law.
10.2 The Processor shall complete such deletion or return within 30 days of the Controller's request and, where requested, certify in writing that it has done so. Small files held in object storage are automatically purged after 14 days; other Personal Data is deleted as an operational process within the period stated.
11.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by it, subject to reasonable notice, confidentiality, and frequency limits set out in the Principal Agreement.
12.1 The Processor shall not transfer Personal Data outside the United Kingdom except where an appropriate transfer mechanism under Data Protection Law is in place (for example the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses), together with any supplementary measures required.
12.2 Where Sub-processors process Personal Data outside the UK, the relevant transfer mechanism and safeguards are noted in Annex 3.
13.1 This Agreement takes effect on the date of the Principal Agreement and continues for as long as the Processor processes Personal Data on the Controller's behalf.
13.2 Each Party's liability under this Agreement is subject to the limitations and exclusions of liability set out in the Principal Agreement.
13.3 This Agreement is governed by the laws of England and Wales, and the Parties submit to the exclusive jurisdiction of the courts of England and Wales.
Signed for and on behalf of the Controller:
Name: …………………………… Title: ……………………………
Signature: …………………………… Date: ……………………………
Signed for and on behalf of the Processor (Nexus Network Ltd t/a Nexus Growth Academy):
Name: …………………………… Title: ……………………………
Signature: …………………………… Date: ……………………………
| Item | Detail |
|---|---|
| Subject matter | Provision of the AI Academy platform and Hermes AI agent to the Controller. |
| Duration | For the term of the Principal Agreement and any retention period required by law. |
| Nature and purpose | Hosting of user accounts; delivery of AI-supported learning and recruitment-support functions; processing of files uploaded by the Controller's users; related support and administration. |
| Types of Personal Data | Names, business contact details (email, telephone), login/account data, job role, learning progress and usage data, and content uploaded by the Controller's users — which, for recruitment users, may include candidate CVs, work history and similar recruitment information. |
| Special category data | The Services are not intended to process special category data. Users are instructed not to input special-category data or identifiable information about third parties (including, for children's-services clients, any identifiable information about a child). Where such data is nonetheless included in free-form content uploaded by a user, it is processed only as part of that content, on the Controller's instruction, and the Controller remains responsible for ensuring an appropriate lawful basis and any additional conditions for processing. |
| Categories of Data Subjects | The Controller's authorised users (e.g. consultants/learners) and candidates whose information is uploaded by those users. |
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Anthropic, PBC (Claude API) | AI / LLM processing for the Hermes agent and Academy | USA | UK Addendum to the EU SCCs; API data not used for model training |
| OpenAI, L.L.C. | AI text-to-speech (lesson narration) and related AI processing | USA | UK Addendum to the EU SCCs |
| Replit, Inc. | Web application hosting (front end, accounts, database, small-file storage) | USA (on Google Cloud) | UK Addendum to the EU SCCs |
| Google Cloud (Google LLC) | Underlying hosting, managed database and object storage | USA / EU | UK Addendum to the EU SCCs |
| DigitalOcean, LLC | AI-agent server hosting and large-file storage | United Kingdom (London region) | UK-based processing; UK Addendum to the EU SCCs where applicable |
| Stripe, Inc. | Payment processing | USA | UK Addendum to the EU SCCs |
| Resend (Amazon SES) | Transactional email delivery | USA | UK Addendum to the EU SCCs |