Your customers’ data, handled with care.

Scope and roles

This Data Processing Agreement (“DPA”) applies when Nexlla Creative Agency (“Processor”) processes personal data on behalf of a client (“Controller”) through the Website Dashboard, Marketing Suite, Customer Portal, Nello AI, their mobile apps and APIs, or as part of agency services where we handle the client’s personal data. Inboxy, Dragy and Rafeeq have their own data terms (for Inboxy, see its DPA).

Controller responsibilities

The Controller confirms that it has a lawful basis and has given any required notices for the processing, including consent for marketing messages; that its instructions comply with the law; and that it will handle requests from its own data subjects, with our assistance.

Our obligations as processor

• Instructions. We process personal data only on the Controller’s documented instructions: these Terms, the Controller’s configuration and use of the Platforms, and written requests. If we believe an instruction breaks the law, we will tell the Controller. If the law requires us to process data in another way, we will tell the Controller first unless the law forbids it.
• No other use. We do not sell Controller personal data, use it for our own marketing or profiling, or use it to train AI models.
• Confidentiality. Everyone authorised to process the data is bound by confidentiality and has access only as needed.
• Security. We maintain the measures described in the security section below.
• Assistance. We help the Controller, taking into account the nature of the processing, to answer data subject requests, carry out impact assessments and consult authorities. Most requests can be handled directly with export, edit and delete tools in the Platforms.
• Records. We keep the records of processing that applicable law requires.

Security measures

• Encryption in transit (TLS) for all Platform traffic; passwords stored as one-way hashes; secrets kept out of source code.
• Role-based access with least privilege, separate administrative access, and removal of access when people leave.
• Network protection through Cloudflare, firewalls, rate limiting, bot and spam protection, and isolated application services.
• Logging of security-relevant events and audit trails in the Platforms.
• Regular backups, and restore procedures.
• Security reviews of code changes, dependency updates, and fixing confirmed vulnerabilities according to their severity.
• Confidentiality agreements and security guidance for staff and contractors.

We may update these measures as long as overall protection does not decrease.

Personal data breaches

If we become aware of a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller personal data, we will notify the Controller without undue delay, and within 48 hours of confirming it. The notice will describe what happened, the data and people likely affected, likely consequences and the steps taken. We then update the Controller as we learn more and help it meet its own notification duties to authorities and individuals.

Sub-processors

The Controller authorises us to use the sub-processors below. Each one is bound by written terms that protect the data at least as well as this DPA, and we remain responsible for their performance.

We will announce any new sub-processor on this page and notify active clients by email at least 30 days before it starts processing their data. The Controller may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Controller may end the affected service and receive a refund of prepaid fees for the remaining term.

International transfers

Personal data may be processed in the countries listed above and where our team works (the UAE, Turkey and Syria). We transfer data only with the safeguards applicable law requires:

• UAE PDPL: transfers to countries with adequate protection or under the contractual and other conditions the law and its regulations allow.
• GDPR and UK GDPR: where Controller data is subject to them and is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2 or 3 as relevant), with the UK Addendum where needed, are incorporated into this DPA by reference.
• Other GCC laws (such as the Saudi PDPL): the transfer conditions those laws set out.

Information and audits

On reasonable request, we provide the information needed to show we comply with this DPA, including answers to security questionnaires and a summary of our controls. If that is not enough, or an authority requires it, the Controller may audit us once per year on 30 days’ notice, during business hours, at its own cost, under confidentiality, and in a way that does not compromise other clients’ data or our security.

Return and deletion

When the service ends, the Controller can export its data for 30 days. After that, we delete Controller personal data from live systems, and copies leave our backups as they rotate, unless the law requires us to keep them. On request, we confirm deletion in writing.

Liability and precedence

Each party’s liability under this DPA is subject to the limitation of liability in our Terms, except where the law does not allow a limit. If this DPA conflicts with the Terms on personal data, this DPA prevails; the Standard Contractual Clauses prevail over both where they apply. Clients who need a countersigned copy can request one at [email protected].