Data processing agreement

• Subject matter: hosting and delivering digital business card profiles, contact exchange, lead capture, analytics and integrations.
• Duration: for as long as you use Nexus, plus the deletion period described below.
• Data subjects: people who view your profile or share their details with you, and your team members.
• Categories of data: names, email addresses, phone numbers, company and job title, messages, consent records and anonymous usage data.
• Special categories: none are required. Please don't collect them through lead forms.

• Process personal data only on your instructions and tell you if we believe an instruction breaks data protection law.
• Make sure everyone with access is bound by confidentiality.
• Apply appropriate technical and organisational measures (see below).
• Help you respond to data subject requests and with data protection impact assessments where relevant.
• Notify you without undue delay, and within 48 hours of confirming it, of a personal data breach affecting your data.
• Delete or return your data when the service ends.

• Encryption in transit (TLS with HSTS) and at rest, plus field-level AES-256-GCM encryption of contact details, lead submissions, activation codes, integration tokens and webhook secrets, with key rotation.
• Hashed passwords (scrypt), breached-password checks, optional two-factor authentication and session management.
• Rate limiting, bot protection, a strict content security policy and re-encoding of uploads to strip metadata.
• Least-privilege access, audit logging of security-relevant actions and time-limited support access.
• Anonymous analytics without cookies or stored IP addresses.
• Data hosted in European Union, with encrypted backups.

The full description is on our security page.

You authorise us to use the subprocessors listed on our security page. Each is bound by data protection terms at least as protective as the DPA. We'll give you notice before adding or replacing a subprocessor that processes your personal data, and you can object on reasonable grounds.

Your data is stored in European Union. Where a subprocessor processes personal data outside the European Economic Area or the United Kingdom, we rely on an adequacy decision or the European Commission's standard contractual clauses, with the UK addendum where it applies.

We'll make available the information you reasonably need to show compliance, including answers to security questionnaires. Where that isn't enough, you may audit our compliance with reasonable notice, at a mutually agreed time and no more than once a year, unless a regulator requires otherwise.

You can export your contacts at any time. When your account ends, we delete personal data processed on your behalf from our live systems within 30 days, and it expires from backups on their normal cycle, unless the law requires us to keep it.

Questions about the DPA or data protection: hello@nexustap.co. Security incidents and vulnerability reports: hello@nexustap.co.