Data Processing Agreement

Preamble

This Data Processing Agreement (the "DPA") forms part of, and is incorporated into, the Nex Systems Terms of Service or any other written agreement for the provision of the Services (the "Terms") between Nex Global LLC, a limited liability company organized under the laws of the State of Wyoming, United States of America, with its registered office at 1621 Central Ave #69914, Cheyenne, WY 82001, USA, trading as "Nex Systems" ("Nex"), and the customer that has accepted the Terms ("Customer").

A. Purpose. The Services enable Customer to perform identity verification, screening, transaction monitoring, risk assessment, investigation and regulatory reporting activities. In providing the Services, Nex processes Personal Data on behalf of Customer. This DPA sets out the Parties' obligations in relation to that processing in accordance with Data Protection Laws.

B. Acceptance. This DPA takes effect, without the need for any further signature, on the date on which the Terms take effect, and continues for as long as Nex processes Customer Personal Data. Where Customer requires a countersigned copy, Customer may request one at privacy@nex.systems; a countersigned copy does not alter the terms of this DPA unless it expressly identifies the provision varied and is signed by an authorized officer of Nex.

C. Authorized Affiliates. Where Customer's Affiliates are permitted to use the Services under the Terms, Customer enters into this DPA on its own behalf and, to the extent required by Data Protection Laws, in the name and on behalf of those Affiliates ("Authorized Affiliates"). Customer remains the sole Party entitled to exercise rights and bring claims under this DPA, including on behalf of Authorized Affiliates, and is responsible for coordinating all communications with Nex.

D. Relationship with the Terms. Capitalized terms not defined in this DPA have the meanings given in the Terms. Except as expressly modified by this DPA, the Terms remain in full force and effect. This DPA does not create any obligation for Nex to provide any service that is not described in the Terms.

1. Definitions and Interpretation

1.1 Definitions. In this DPA:

• "Controller", "Processor", "Data Subject", "Personal Data", "Processing" (and "process"), "Personal Data Breach", "Supervisory Authority" and "Data Protection Impact Assessment" have the meanings given in the GDPR, and equivalent terms under other Data Protection Laws (including "business", "service provider", "contractor", "personal information" and "consumer") are to be read accordingly.
• "Customer Personal Data" means Personal Data contained in Customer Data that Nex processes as a Processor on behalf of Customer under the Terms.
• "Data Protection Laws" has the meaning given in the Terms and includes, where applicable: the GDPR; the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; the California Consumer Privacy Act, as amended, and other U.S. state privacy and biometric privacy laws; and the data protection laws of any other country that apply to the processing of Customer Personal Data, including laws of countries in Africa, the Middle East, Asia and Latin America.
• "EEA" means the European Economic Area.
• "GDPR" means Regulation (EU) 2016/679.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country or recipient that, under the applicable Data Protection Laws, requires an approved transfer mechanism.
• "Security Measures" means the technical and organizational measures described in Annex 2, as updated from time to time in accordance with Section 6.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to European Commission Implementing Decision (EU) 2021/914, as amended or replaced.
• "Sub-processor" means any Processor engaged by Nex or its Affiliates to process Customer Personal Data.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, as amended or replaced.

1.2 Interpretation. Section 1.2 of the Terms applies to this DPA. References to "Sections" and "Annexes" are to sections of and annexes to this DPA. Where Data Protection Laws use a term with an equivalent meaning to a term in this DPA, this DPA is to be read so that the term has the meaning required by those laws.

1.3 Scope of definitions. Where a term is defined both in this DPA and in the Terms, the definition in this DPA applies for the purposes of this DPA only.

2. Scope, Roles of the Parties and Order of Precedence

2.1 Scope. This DPA applies to the processing of Customer Personal Data by Nex in the course of providing the Services, including Nex eKYC, Nex Screening, Nex AML, Nex 360, Elodie, the APIs and any future product made available under the Terms. It does not apply to Nex's processing of Personal Data as an independent Controller, which is described in Section 16 and the Privacy Notice.

2.2 Customer as Controller. Customer is the Controller of Customer Personal Data, or, where Customer acts on behalf of another Controller (including an Affiliate or a client of Customer), a Processor. Where Customer is a Processor, Customer warrants that its instructions to Nex, including the appointment of Nex as a sub-processor, have been authorized by the relevant Controller, and Customer remains Nex's sole point of contact.

2.3 Nex as Processor. Nex is a Processor (or, where Customer is a Processor, a sub-processor) of Customer Personal Data and processes it only on behalf of Customer and in accordance with this DPA.

2.4 U.S. state privacy laws. To the extent that the CCPA or a similar U.S. state privacy law applies, Customer is a "business" and Nex is a "service provider" or "processor", and Section 17.2 applies.

2.5 Description of processing. The subject matter, nature, purpose and duration of the processing, the categories of Personal Data and the categories of Data Subjects are described in Annex 1. Customer acknowledges that Annex 1 is an accurate description of the processing and that Customer, as Controller, determines the actual Personal Data submitted through its use and configuration of the Services.

2.6 Order of precedence. In the event of conflict: (a) the SCCs and the UK Addendum, where they apply, prevail over this DPA and the Terms, solely with respect to the Restricted Transfers they govern; (b) this DPA prevails over the Terms solely with respect to the processing of Customer Personal Data; and (c) in all other respects, including liability, governing law and dispute resolution, the Terms prevail.

2.7 No change to commercial terms. Nothing in this DPA confers any right or imposes any obligation on Nex to provide any service, functionality or level of support beyond what is set out in the Terms, the Documentation and any Order Form, or relieves Customer of its payment obligations.

3. Customer Obligations, Instructions and Lawful Basis

3.1 Compliance with Data Protection Laws. Customer is responsible for its own compliance with Data Protection Laws in respect of Customer Personal Data and its use of the Services, including the lawfulness of every processing operation it instructs Nex to carry out.

3.2 Lawful basis, notices and consents. Customer represents, warrants and undertakes that: (a) it has, and will maintain, a valid lawful basis under Data Protection Laws for each processing activity performed through the Services, including, where relevant, compliance with a legal obligation under AML/CFT Laws, legitimate interests, substantial public interest or explicit consent; (b) it has provided, and will provide, all notices to Data Subjects required by Data Protection Laws, including notices describing the use of service providers such as Nex, automated processing, profiling, screening against sanctions, PEP and adverse media sources, and biometric processing; (c) it has obtained, recorded and will maintain all consents, releases and authorizations required by Data Protection Laws, including any written release required for Biometric Data; and (d) the processing of Customer Personal Data in accordance with Customer's instructions will not cause Nex to breach any Data Protection Law.

3.3 Documented instructions. The Terms, this DPA, any Order Form, Customer's configuration of the Services and the processing initiated by Customer and its Authorized Users through the Services constitute Customer's complete and final documented instructions to Nex. Customer may issue additional written instructions only where they are consistent with the Terms and the functionality of the Services. Nex is not obliged to follow any instruction that would require it to change the Services, to process Personal Data outside the standard functionality, or to incur additional cost, unless the Parties agree in writing, which may be subject to additional Fees.

3.4 Unlawful instructions. Nex will inform Customer if, in Nex's opinion, an instruction infringes Data Protection Laws, provided that Nex is under no obligation to perform legal analysis of Customer's instructions or to monitor Customer's compliance. Nex may suspend the performance of the relevant instruction until Customer confirms, modifies or withdraws it, without liability.

3.5 Data minimization and accuracy. Customer is solely responsible for ensuring that Customer Personal Data is adequate, relevant, limited to what is necessary, accurate and kept up to date, and for configuring the Services, including the checks enabled, fields collected and retention periods, accordingly.

3.6 Sensitive data. Customer must not submit special categories of Personal Data, Personal Data relating to criminal convictions and offenses, Biometric Data, government identification numbers or Personal Data of children except to the extent required for the purpose of the relevant Service and permitted by Data Protection Laws, and subject to Section 14.

3.7 Security of Customer's environment. Customer is responsible for the security of its own systems, devices, credentials, API keys, Customer Integrations and any Customer Personal Data exported from, downloaded from or transmitted outside the Services, and for configuring the security features of the Services, including access controls, roles, multi-factor authentication and single sign-on.

3.8 Data Subject communications. Customer is responsible for all communications with Data Subjects regarding the processing of their Personal Data, including responding to complaints, requests and inquiries, and for any decision it makes about a Data Subject.

4. Nex Processing Obligations

4.1 Processing on instructions. Nex will process Customer Personal Data only on Customer's documented instructions under Section 3.3, including with regard to Restricted Transfers, unless processing is required by applicable law to which Nex is subject. In that case, Nex will inform Customer of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest.

4.2 Purpose limitation. Nex will not process Customer Personal Data for any purpose other than: (a) providing, maintaining, securing and supporting the Services for Customer, and improving the Services to the extent permitted by Data Protection Laws and subject to Section 15.2; (b) preventing, detecting and investigating fraud, abuse, security incidents and violations of the Terms; (c) complying with applicable law; and (d) creating Aggregated Data in accordance with Section 8.9 of the Terms, which, once created, is not Personal Data.

4.3 No sale; no unrelated use. Nex will not sell, rent, lease or trade Customer Personal Data, will not use it for advertising or marketing, and will not use it to build or enrich any profile of a Data Subject for use outside the Services provided to Customer.

4.4 No cross-customer combination. Nex will not combine Customer Personal Data with Personal Data processed for other customers, except: (a) where Customer enables a feature that requires it and that is described in the Documentation; (b) for security, fraud-prevention and abuse-prevention purposes; or (c) in the form of Aggregated Data.

4.5 Nex Data distinguished. Customer acknowledges that Nex Data, including sanctions, watchlist, PEP and adverse media records, is compiled by Nex as an independent Controller from public and licensed sources, is not Customer Personal Data, and is governed by Section 16, even when it is displayed alongside Customer Personal Data within the Services.

4.6 Records of processing. Nex will maintain records of its processing activities carried out on behalf of Customer to the extent required by Article 30(2) of the GDPR or equivalent Data Protection Laws, and will make them available to a Supervisory Authority on request.

4.7 Data protection officer and contact. Nex has designated a privacy contact who may be reached at privacy@nex.systems. Where Data Protection Laws require Nex to appoint a data protection officer or a representative in a particular jurisdiction, Nex will do so and publish the relevant contact details at nex.systems/legal.

4.8 Changes in law. If a change in Data Protection Laws, or a decision of a court or Supervisory Authority, makes it unlawful or impracticable for Nex to continue processing Customer Personal Data in accordance with this DPA, Nex may modify this DPA and the Services to the extent reasonably necessary to comply, by notice to Customer.

5. Personnel and Confidentiality

5.1 Authorized personnel. Nex will ensure that its personnel and contractors who are authorized to process Customer Personal Data: (a) are bound by written confidentiality obligations or are under an appropriate statutory obligation of confidentiality; (b) access Customer Personal Data only to the extent necessary to perform the Services, provide support, maintain security or comply with law; and (c) receive appropriate training on data protection and information security.

5.2 Access controls. Nex limits access to production systems containing Customer Personal Data to personnel with a need to know, using role-based access, authentication controls and logging, as further described in Annex 2.

5.3 Support access. Where Customer or an Authorized User requests support, grants support access or shares Customer Personal Data with Nex's support personnel (including through tickets, screenshots or screen-sharing), Customer authorizes Nex to access and process the Customer Personal Data concerned for the purpose of resolving the request. Customer should share only the minimum Personal Data necessary.

5.4 Confidentiality of Customer Personal Data. Nex will treat Customer Personal Data as Customer's Confidential Information in accordance with Section 12 of the Terms, subject to the exceptions for compelled disclosure set out in Section 12.5 of the Terms and Section 8.11 of the Terms.

5.5 Continuing obligations. The obligations in this Section 5 continue after the end of the relevant individual's engagement with Nex and for as long as Nex retains Customer Personal Data.

6. Security of Processing

6.1 Security Measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Nex will implement and maintain the Security Measures described in Annex 2, which are designed to protect Customer Personal Data against Personal Data Breaches and to ensure a level of security appropriate to the risk.

6.2 Customer assessment. Customer has reviewed the Security Measures and the information in the Trust Centre and agrees that, for the Services it has selected and the Customer Personal Data it intends to process, the Security Measures provide an appropriate level of security, taking into account the risks presented by the processing. Customer is responsible for assessing whether the Services meet any additional security requirement that applies to Customer under its sector regulation.

6.3 Updates. The Security Measures are subject to technical progress and development. Nex may update or modify the Security Measures from time to time, provided that any update does not result in a material reduction of the overall level of security of the Services. The current Security Measures are described in Annex 2 and the Trust Centre.

6.4 Infrastructure providers. Nex hosts the Services on cloud infrastructure provided by established providers that maintain independently audited security programs, including ISO/IEC 27001 certification and SOC 2 reports. Physical and environmental security of data centers is the responsibility of those providers under their own controls. Nex is responsible for the security of the application, configuration, access management and data handling that it controls.

6.5 Shared responsibility. Security is a shared responsibility. Customer is responsible for the matters set out in Section 3.7, for enabling and properly configuring the security features made available in the Services, and for protecting the confidentiality of credentials. Nex is not responsible for any Personal Data Breach caused by Customer, its Authorized Users, its Customer Integrations or its failure to use available security features.

6.6 No absolute security. Customer acknowledges that no security measures can guarantee absolute protection against all threats, and that the implementation of the Security Measures constitutes Nex's full obligation with regard to security under this DPA.

7. Sub-processors

7.1 General authorization. Customer grants Nex a general written authorization to engage Sub-processors to process Customer Personal Data, including Nex's Affiliates and the Sub-processors listed, as at the effective date of this DPA, on Nex's sub-processor list, which is made available to Customer on request at privacy@nex.systems (the "Sub-processor List") (Annex 3).

7.2 Sub-processor obligations. When engaging a Sub-processor, Nex will: (a) carry out appropriate due diligence on the Sub-processor's ability to provide the level of protection required by this DPA; (b) impose on the Sub-processor, by written contract, data protection obligations that are no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the nature of the services provided by the Sub-processor; and (c) remain responsible to Customer for the performance of the Sub-processor's obligations, subject to Section 18. Customer acknowledges that certain Sub-processors, such as major cloud infrastructure providers, offer standard non-negotiable terms, and that Nex's obligation is satisfied where those terms provide substantially equivalent protection.

7.3 Notice of new Sub-processors. Nex will update the Sub-processor List before authorizing any new Sub-processor to process Customer Personal Data, and will notify Customers who have asked to receive such notifications by writing to privacy@nex.systems at least fifteen (15) days in advance. Customer is responsible for requesting such notifications, and agrees that notice given to Customers who have requested it, together with the availability of the updated Sub-processor List on request, constitutes notice of intended changes for the purposes of Article 28(2) of the GDPR and Clause 9 of the SCCs. Nex may engage a new Sub-processor on shorter notice, or without prior notice, where necessary to address an emergency, a security risk or the unavailability of an existing Sub-processor, in which case Nex will notify Customer promptly afterwards.

7.4 Objection. Customer may object to a new Sub-processor on reasonable, documented grounds relating to data protection by written notice to privacy@nex.systems within fifteen (15) days of the notice. If Customer does not object within that period, the new Sub-processor is deemed approved. If Customer objects, the Parties will discuss Customer's concerns in good faith. Nex may, at its discretion: (a) recommend a configuration change or alternative that avoids processing by the Sub-processor; or (b) confirm the engagement.

7.5 Exclusive remedy. If Nex confirms the engagement of a Sub-processor to which Customer has reasonably objected and no alternative under Section 7.4 is available, Customer may, as its sole and exclusive remedy, terminate the Order Form for the affected Service only, by written notice given within thirty (30) days of Nex's confirmation. Nex will refund any prepaid Fees for the affected Service covering the period after termination. No other compensation, penalty or damages are payable.

7.6 Copies of sub-processor terms. Where the SCCs require, Nex will provide Customer, on request, with a summary of the data protection terms of a Sub-processor agreement. Commercial information and terms unrelated to data protection may be removed, and the summary is Nex's Confidential Information.

8. International Data Transfers

8.1 Locations of processing. Customer acknowledges that Nex, its Affiliates and its Sub-processors may process Customer Personal Data in the United States and in any other country in which they or their hosting providers operate, subject to this Section 8 and to any hosting region that Customer selects in the Services or that is expressly committed in an Order Form.

8.2 EEA transfers. To the extent that Customer's use of the Services involves a Restricted Transfer of Customer Personal Data subject to the GDPR from Customer to Nex, the SCCs are incorporated into this DPA by reference and apply as follows: (a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor; (b) Customer is the "data exporter" and Nex is the "data importer"; and (c) the optional selections and annexes are completed as set out in Annex 4 and Annexes 1 to 3.

8.3 UK transfers. To the extent that a Restricted Transfer is subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated into this DPA by reference, with Tables 1 to 3 completed by the information in this DPA and Annexes 1 to 4, and with neither Party entitled to end the UK Addendum under its Section 19, except as provided in Annex 4.

8.4 Swiss transfers. To the extent that a Restricted Transfer is subject to the Swiss Federal Act on Data Protection, the SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner, including that references to the GDPR are read as references to the Swiss law, that the Swiss Commissioner is the competent supervisory authority for such transfers, that the term "Member State" in Clause 18(c) does not exclude Data Subjects habitually resident in Switzerland from bringing claims in Switzerland, and that the SCCs also protect data of legal entities to the extent required by Swiss law until that requirement ceases to apply.

8.5 Other jurisdictions. Where the Data Protection Laws of any other jurisdiction require a specific transfer mechanism, registration, notification, approval or data localization measure for a Restricted Transfer, Customer is responsible for identifying that requirement and notifying Nex in writing. Nex will, on request, cooperate in good faith to put in place any standard contractual clauses or equivalent mechanism published by the competent authority, to the extent consistent with the Services and Nex's obligations to other customers. Customer is responsible for any registration, notification or approval that the law places on the data exporter.

8.6 Onward transfers. Nex will ensure that any onward transfer of Customer Personal Data by Nex to a Sub-processor that constitutes a Restricted Transfer is subject to an appropriate transfer mechanism under Data Protection Laws, such as the SCCs (Module Three) or an adequacy decision.

8.7 Transfer impact assessments. On request, Nex will provide reasonable information about the processing, the Security Measures and its approach to government access requests to assist Customer in carrying out any transfer impact assessment required by Data Protection Laws. Customer is responsible for conducting and documenting its own assessment.

8.8 Government access requests. Nex will handle any legally binding request from a public authority for access to Customer Personal Data in accordance with Section 8.11 of the Terms. Where permitted, Nex will challenge requests that it reasonably considers unlawful, overbroad or inconsistent with applicable law, and will disclose only the minimum information required.

8.9 Alternative mechanisms. If the SCCs, the UK Addendum or any other transfer mechanism is invalidated, amended or replaced, Nex may adopt an alternative lawful transfer mechanism, and this DPA will be deemed amended accordingly on notice to Customer.

9. Data Subject Requests

9.1 Self-service tools. The Services provide Customer with functionality to search, access, export, correct, restrict and delete Customer Personal Data, subject to Customer's retention settings and legal holds. Customer must use these tools to respond to requests from Data Subjects to exercise their rights under Data Protection Laws, including rights of access, rectification, erasure, restriction, portability and objection, and rights in relation to automated decision-making ("Data Subject Requests").

9.2 Requests received by Nex. If Nex receives a Data Subject Request relating to Customer Personal Data and can identify Customer from the request, Nex will, to the extent legally permitted, redirect the Data Subject to Customer or forward the request to Customer without undue delay, and will not respond to the request except to confirm that it has been forwarded, unless Customer instructs otherwise in writing or applicable law requires a response.

9.3 Assistance. Taking into account the nature of the processing, Nex will provide Customer with reasonable assistance, by appropriate technical and organizational measures, insofar as possible, to fulfil Customer's obligation to respond to Data Subject Requests, to the extent that Customer cannot reasonably respond using the self-service tools. Nex may charge Customer for such assistance at its then-current professional services rates where the assistance requires more than minimal effort or where the volume of requests is unusually high.

9.4 Customer decisions. Customer is solely responsible for deciding whether and how to respond to each Data Subject Request, for verifying the identity of the requester, and for determining whether any exemption applies, including exemptions relating to the prevention or detection of crime, anti-money laundering obligations, tipping-off prohibitions and legal holds. Nothing in this DPA requires Nex to disclose to a Data Subject that Customer has screened, monitored, investigated or reported that Data Subject.

9.5 Requests concerning Nex Data. Requests from individuals concerning Nex Data, such as requests to correct or remove a sanctions, PEP or adverse media record, are handled by Nex as an independent Controller in accordance with Section 16 and Section S2.10 of the Terms.

10. Assistance, Data Protection Impact Assessments and Regulator Cooperation

10.1 Information for DPIAs. Taking into account the nature of the processing and the information available to Nex, Nex will provide Customer with reasonable assistance in carrying out any Data Protection Impact Assessment, and any prior consultation with a Supervisory Authority, that Data Protection Laws require Customer to perform in relation to its use of the Services. Nex will satisfy this obligation primarily by making available the Documentation, the Trust Centre, the description of processing in Annex 1, the Security Measures in Annex 2 and its responses to standard security and privacy questionnaires.

10.2 Additional assistance. Assistance requested by Customer beyond the materials described in Section 10.1, including bespoke questionnaires, workshops, meetings, written opinions or document reviews, is subject to Nex's prior agreement and may be charged at Nex's then-current professional services rates.

10.3 Regulator inquiries. If a Supervisory Authority or other regulator with jurisdiction over Customer makes an inquiry concerning the processing of Customer Personal Data by Nex, Nex will provide reasonable cooperation to Customer, at Customer's cost, in responding to the inquiry, limited to information concerning the Services that Nex can provide without breaching its obligations to other customers, compromising the security of the Services or disclosing its trade secrets or Confidential Information. Where a Supervisory Authority contacts Nex directly about Customer Personal Data, Nex will, where legally permitted, notify Customer and coordinate its response with Customer.

10.4 No legal advice. Any assistance provided by Nex under this DPA is technical and factual in nature. Nex does not provide legal advice and does not assess whether Customer's processing is lawful or whether a Data Protection Impact Assessment is required.

11. Personal Data Breach Notification

11.1 Notification. Nex will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data in Nex's or its Sub-processors' possession or control, and will aim to do so within seventy-two (72) hours of becoming aware of it. "Becoming aware" means the point at which Nex has a reasonable degree of certainty that a security incident has occurred that has led to Customer Personal Data being compromised.

11.2 Content of notification. Nex's notification will, to the extent known at the time, describe: (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and records concerned; (b) the likely consequences of the Personal Data Breach; (c) the measures taken or proposed by Nex to address it and to mitigate its possible adverse effects; and (d) a contact point for further information. Where information is not available at the time of the initial notification, Nex may provide it in phases without undue further delay.

11.3 Delivery. Nex will send notifications to the account administrator and any security contact designated by Customer in the Services. Customer is responsible for keeping these contacts accurate and current. Notification may also be given through in-product messages or the status page.

11.4 Remediation. Nex will take reasonable steps, within its control, to contain, investigate and remediate the Personal Data Breach and to prevent a recurrence, and will provide reasonable cooperation to Customer in its own investigation.

11.5 Customer obligations. Customer is solely responsible for determining whether, and when, to notify any Supervisory Authority, regulator, Data Subject or other third party of a Personal Data Breach, and for making any such notification. Customer must consult Nex before making any public statement or third-party notification that refers to Nex, and must not do so without Nex's prior written consent, except to the extent required by law.

11.6 No admission. Nex's notification of, or response to, a Personal Data Breach is not an acknowledgment by Nex of any fault or liability.

11.7 Exclusions. This Section 11 does not apply to unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including pings, port scans, denial-of-service attacks, unsuccessful log-in attempts and other network attacks on firewalls or networked systems, or to incidents caused by Customer, its Authorized Users or its Customer Integrations, which Customer must manage under its own policies. Nex will reasonably assist Customer with any such Customer-caused incident at Customer's cost.

11.8 Costs. Except to the extent that a Personal Data Breach was caused by Nex's breach of this DPA, each Party bears its own costs of responding to the Personal Data Breach. Any liability of Nex arising from a Personal Data Breach is subject to Section 18.

12. Audits and Information Rights

12.1 Information first. Nex will make available to Customer, on written request and subject to Section 12.6, the information reasonably necessary to demonstrate Nex's compliance with Article 28 of the GDPR and this DPA, consisting of: (a) the Security Measures and the Trust Centre; (b) Nex's responses to a reasonable written security and privacy questionnaire, no more than once in any twelve (12) month period; (c) summaries of Nex's relevant policies; and (d) any third-party certifications, attestations or audit reports that Nex obtains from time to time, including the certifications and reports of its infrastructure providers where these are available to Customer. Customer agrees that this information satisfies its audit rights under this DPA and the SCCs, except as set out in Section 12.2.

12.2 On-site audits. Customer, or an independent auditor appointed by Customer, may conduct an audit of Nex's processing of Customer Personal Data, including an inspection of relevant facilities operated by Nex, only where: (a) the information provided under Section 12.1 is not sufficient to demonstrate Nex's compliance with this DPA, and Customer explains why in writing; (b) a Supervisory Authority or regulator with jurisdiction over Customer expressly requires it; or (c) Nex has notified Customer of a Personal Data Breach affecting Customer Personal Data, in which case the audit is limited to that breach.

12.3 Audit conditions. Any audit under Section 12.2 must: (a) be requested by at least thirty (30) days' prior written notice, with a proposed scope, duration and start date; (b) take place no more than once in any twelve (12) month period, except where required under Section 12.2(b) or (c); (c) be conducted during Nex's normal business hours, remotely where reasonably possible, and in a manner that does not unreasonably disrupt Nex's operations; (d) be limited to Nex's systems, records and personnel that process Customer Personal Data; (e) be carried out by Customer or by an independent auditor that is not a competitor of Nex, that is bound by written confidentiality obligations acceptable to Nex, and that has been approved by Nex (approval not to be unreasonably withheld); and (f) comply with Nex's security, confidentiality and site policies.

12.4 No access to other customers or third-party facilities. No audit will give Customer or its auditor access to data or information of any other customer, to Nex's trade secrets, source code, models or pricing, or to any information whose disclosure would breach Nex's legal or contractual obligations. Audits of Sub-processors and of infrastructure providers' facilities are satisfied by the reports and certifications those providers make available.

12.5 Costs. Customer bears all costs of any audit, including the fees of its auditor, and will reimburse Nex for the time spent by its personnel and any third-party costs at Nex's then-current professional services rates, except where the audit reveals a material breach by Nex of this DPA, in which case each Party bears its own costs.

12.6 Confidentiality of results. All information provided or obtained under this Section 12, including audit reports and findings, is Nex's Confidential Information. Customer will provide Nex with a copy of any audit report free of charge and will not disclose it to any third party other than its regulators and professional advisers under equivalent confidentiality obligations.

12.7 Findings. If an audit identifies a material non-compliance with this DPA, Nex will promptly take reasonable steps to remediate it. This is Customer's sole remedy for audit findings, without prejudice to Section 18.

13. Retention, Return and Deletion

13.1 Customer-configured retention. Customer determines the retention periods for Customer Personal Data through the settings made available in each Service, within the ranges the Services support, and is solely responsible for ensuring that those periods comply with AML/CFT Laws, Data Protection Laws and biometric privacy laws. Nex will delete Customer Personal Data in accordance with Customer's configured retention periods, subject to Sections 13.4 and 13.5.

13.2 Deletion by Customer. Customer may delete Customer Personal Data at any time during the Subscription Term using the functionality of the Services, subject to any legal hold, erasure restriction or approval workflow that Customer has configured.

13.3 End of the Services. Upon termination or expiry of the Terms, Customer may export Customer Personal Data during the Retrieval Period in accordance with Section 16.5 of the Terms. After the Retrieval Period, Nex will delete Customer Personal Data from its active production systems within ninety (90) days, unless applicable law requires its retention. This Section 13.3 constitutes Customer's instruction to delete, and Customer's choice between return and deletion under the SCCs is exercised by exporting the data during the Retrieval Period.

13.4 Backups. Customer Personal Data contained in encrypted backups will be deleted or overwritten in the ordinary course of Nex's backup rotation, which Nex aims to complete within ninety (90) days after deletion from production systems. Until then, backups remain protected by the Security Measures and are not actively processed, except to restore the Services.

13.5 Legal retention. Nex may retain Customer Personal Data to the extent and for as long as required by applicable law, or where necessary for the establishment, exercise or defense of legal claims, in each case subject to the confidentiality and security obligations of this DPA and only for the purposes that prevent its deletion.

13.6 Certification. On Customer's written request made within thirty (30) days after the end of the period in Section 13.3, Nex will provide written confirmation that Customer Personal Data has been deleted from active production systems, subject to Sections 13.4 and 13.5.

13.7 Aggregated Data and logs. Aggregated Data, which does not identify any Data Subject, is not subject to deletion under this Section 13. Security and audit logs that contain limited Personal Data may be retained for the period required for security, fraud-prevention and legal purposes.

14. Biometric, Special-Category and Criminal-Offense Data

14.1 Biometric Data. Where Customer uses face comparison, live presence or any other biometric functionality of Nex eKYC: (a) Customer is the Controller of the Biometric Data and determines the purpose of its collection; (b) Customer must comply with Schedule 1 of the Terms, including the notice, consent, written release, public retention policy and alternative-method requirements in Section S1.3 of the Terms; (c) Nex processes Biometric Data only to perform the checks Customer requests, to secure the Services and to comply with law, and in accordance with Section S1.4 of the Terms; and (d) Nex does not sell, lease, trade or otherwise profit from Biometric Data, and does not use it to train generally available models.

14.2 Biometric retention and destruction. Nex permanently destroys Biometric Data at the end of the retention period configured by Customer and, in any event, within the period required by applicable biometric privacy law. Customer must configure retention settings that comply with those laws, and acknowledges that AML/CFT record-keeping requirements may require Customer to retain verification records, but not necessarily biometric templates, for longer periods.

14.3 Special categories of data. The Services may incidentally process special categories of Personal Data, for example where an identity document shows a Data Subject's ethnicity or religion, where a face image may reveal health or ethnic characteristics, or where PEP status reveals political opinions. Customer is responsible for ensuring that it has an applicable condition under Article 9 of the GDPR, or equivalent Data Protection Laws, for any such processing.

14.4 Criminal-offense data. Screening results, adverse media and investigation records may relate to alleged or proven criminal offenses. Customer is responsible for ensuring that it is authorized to process such data under Article 10 of the GDPR, or equivalent Data Protection Laws, including any authorization under its national law for anti-money laundering, counter-terrorist financing and fraud-prevention purposes.

14.5 Children's data. The Services are not designed to process Personal Data of children except to apply minimum-age rules. Customer must comply with Section S1.10 of the Terms and must not knowingly submit Personal Data of children except where permitted by Data Protection Laws and with any required parental or guardian consent.

14.6 Government identifiers. Where identity documents contain national identification numbers, passport numbers, tax identifiers or similar identifiers, Customer is responsible for ensuring that their collection and retention comply with any specific restrictions under Data Protection Laws, including restrictions on the use of national identifiers.

15. AI and Machine-Learning Processing

15.1 Processing by AI Features. Where Customer uses Elodie or other AI Features, Customer Personal Data may be processed by machine-learning models operated by Nex or by third-party model providers engaged as Sub-processors and listed on the Sub-processor List. Such processing is carried out solely to generate AI Output for Customer within the Services and in accordance with Schedule 4 of the Terms.

15.2 No training on Customer Personal Data. Nex will not use Customer Personal Data, or AI Output derived from it, to train, fine-tune or improve any model made available to other customers, except with Customer's prior written opt-in, and will not permit its third-party model providers to do so. This does not prevent Nex from using Aggregated Data in accordance with the Terms.

15.3 Retention by model providers. Nex engages third-party model providers on terms that limit their retention of inputs and outputs to the period necessary to provide the service and to detect abuse, and that prohibit their use of such data for training. Where a model provider offers zero-retention or regional processing options for the Services, Nex will apply them where reasonably practicable.

15.4 Automated decision-making. The AI Features and machine-learning components of the Services are designed to support human review and do not themselves make decisions that produce legal or similarly significant effects on Data Subjects. Customer is solely responsible for ensuring that any decision it makes about a Data Subject involves meaningful human review where required by Article 22 of the GDPR or equivalent Data Protection Laws, and for providing any information about the logic involved that those laws require. Nex will make reasonable information about the functioning of its models available in the Documentation to assist Customer.

15.5 Region of processing. Where the Services allow Customer to select the region in which AI processing takes place, Customer is responsible for selecting a region that is consistent with its obligations under Section 8.

15.6 Accuracy and bias. Nex takes reasonable measures to test its models for accuracy and bias. Customer acknowledges that AI Output may nonetheless be inaccurate or biased, and that Section 13.9 and Section S4.12 of the Terms apply.

16. Nex as Independent Controller

16.1 Controller processing. Nex acts as an independent Controller, and not as Customer's Processor, when it processes: (a) Nex Data, including sanctions, watchlist, enforcement, PEP and adverse media records compiled from public and licensed sources; (b) Usage Data and Aggregated Data; (c) account, contact, billing and relationship data of Customer and its Authorized Users; (d) Personal Data processed for Nex's own security, fraud-prevention, abuse-prevention, legal, compliance, sanctions-screening and accounting purposes; and (e) Personal Data processed through Nex's websites, free tools and marketing activities.

16.2 Governing terms. Nex's processing as an independent Controller is described in the Privacy Notice and is governed by Data Protection Laws, and not by Sections 3 to 15 of this DPA. Each Party is independently responsible for its own compliance as a Controller.

16.3 Nex Data and legitimate interests. Nex compiles and makes available Nex Data in reliance on its legitimate interests, and on the substantial public interest in preventing and detecting money laundering, terrorist financing, sanctions evasion, fraud and other financial crime, to the extent permitted by Data Protection Laws. Nex maintains processes for handling requests from individuals regarding Nex Data, as described in Section S2.10 of the Terms.

16.4 Authorized User data. Customer will inform its Authorized Users of Nex's processing of their account and usage data as described in the Privacy Notice, to the extent required by Data Protection Laws.

17. Jurisdiction-Specific Terms

17.1 EEA and UK. For processing subject to the GDPR or the UK GDPR, the Parties agree that this DPA, together with the Terms, contains the terms required by Article 28(3) of the GDPR and the UK GDPR. Where any such term is not expressly set out, it is deemed incorporated to the minimum extent required, without extending Nex's obligations beyond those required by law.

17.2 United States. To the extent that the CCPA or a similar U.S. state privacy law applies to Customer Personal Data: (a) Nex will process Customer Personal Data only for the business purposes set out in the Terms and this DPA; (b) Nex will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than those business purposes, or combine it with personal information received from others except as permitted by law; (c) Nex will comply with the obligations applicable to service providers and processors under those laws and will notify Customer if it determines that it can no longer meet them; (d) Customer may, on written notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, in accordance with Section 12; and (e) any de-identified data will be maintained in de-identified form and Nex will not attempt to re-identify it. Nex certifies that it understands and will comply with these restrictions.

17.3 Other jurisdictions. Where Customer is subject to the Data Protection Laws of any other jurisdiction, including laws that use the terms "operator", "data handler", "data processor" or "responsible party" (for example, South Africa's Protection of Personal Information Act, Nigeria's Data Protection Act 2023 or Kenya's Data Protection Act 2019), the provisions of this DPA apply to Nex in its capacity as processor or operator, and Customer in its capacity as controller or responsible party, with the necessary changes in terminology. Customer must notify Nex in writing of any mandatory requirement of such laws that is not reflected in this DPA, and the Parties will cooperate in good faith to address it, provided that Nex is not required to change the Services or assume additional liability.

17.4 Registration and local requirements. Customer is responsible for any registration with, notification to or approval from a Supervisory Authority that applies to Customer as Controller, and for any local-language notices or requirements that apply to its processing.

18. Liability, Term and General Provisions

18.1 Limitation of liability. Each Party's liability, taken together in the aggregate, arising out of or relating to this DPA, the SCCs, the UK Addendum and any other transfer mechanism incorporated into this DPA, whether in contract, tort or under any other theory of liability, is subject to Section 15 of the Terms (including the exclusions, the aggregate cap, the claims procedure in Section 15.10 and the exclusion of regulatory fines in Section 15.11), and any reference in Section 15 of the Terms to the liability of a Party means the aggregate liability of that Party and its Affiliates under the Terms and all data processing agreements together. Nothing in this Section 18.1 limits any liability of a Party to Data Subjects under the third-party beneficiary provisions of the SCCs to the extent such limitation is prohibited by the SCCs.

18.2 Customer indemnity. Section 14.4 of the Terms applies to any claim, fine or loss arising from Customer's breach of this DPA or of Data Protection Laws, including any failure to provide notices or obtain consents or written releases.

18.3 Term. This DPA remains in effect for as long as Nex processes Customer Personal Data, and terminates automatically when Nex has deleted all Customer Personal Data in accordance with Section 13. Provisions that by their nature are intended to survive, including Sections 11, 13, 16 and 18, survive termination.

18.4 Governing law and disputes. This DPA is governed by the law and dispute resolution provisions of Section 17 of the Terms, except that, where the SCCs apply, the governing law and forum for disputes arising under the SCCs are those specified in Annex 4, to the extent required by the SCCs.

18.5 Updates to this DPA. Nex may update this DPA by publishing a revised version at nex.systems/legal in accordance with Section 2.7 of the Terms, provided that an update does not materially reduce the overall protection of Customer Personal Data, except where required by Data Protection Laws, a court or a Supervisory Authority, or to reflect a new or replacement transfer mechanism.

18.6 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions continue in full force, and the invalid provision will be replaced by a valid provision that comes closest to the Parties' intention and to the requirements of Data Protection Laws.

18.7 Contact. Questions and notices concerning this DPA may be sent to privacy@nex.systems, with a copy of formal legal notices to legal@nex.systems and to Nex's registered address.

Annex 1: Description of Processing

A. List of parties

Activities relevant to the transfer: the use of the Services by the data exporter and their provision by the data importer under the Terms. Each Party's acceptance of the Terms (or signature of an Order Form) constitutes its signature of this DPA, the SCCs and these Annexes, dated as of the effective date of the Terms.

B. Description of processing

C. Categories of Personal Data by Service

D. Special categories and sensitive data

Biometric Data (Nex eKYC face comparison and liveness); data incidentally revealing racial or ethnic origin, religion or health (from identity documents or images); political opinions (PEP status); data relating to alleged or proven criminal offenses (screening, adverse media and investigations); government identification numbers. Safeguards: the Security Measures in Annex 2, encryption of sensitive fields, role-based access, configurable retention and Section 14.

E. Sub-processor processing

Sub-processors process Customer Personal Data for hosting, storage, processing, AI model inference, communications and support, as listed on the Sub-processor List, for the duration of the Services.

Annex 2: Technical and Organizational Measures

Nex's information security program is aligned with ISO/IEC 27001. The measures below describe the controls in place at the date of this DPA at a summary level and may be updated in accordance with Section 6.3. Further details of specific controls, including authentication, encryption, backup and monitoring arrangements, are available to customers on request at privacy@nex.systems, subject to confidentiality, and form part of Nex's Confidential Information.

Annex 3: Sub-processors

The current list of Sub-processors, including their names, the services they provide, the Services they support and their processing locations, is made available to Customer on request at privacy@nex.systems and forms part of this Annex 3. Customers may ask to receive notifications of changes by writing to the same address, in accordance with Section 7.3.

Annex 4: Standard Contractual Clauses Selections

For the UK Addendum, Table 1 is completed with the parties in Annex 1, Part A; Table 2 with the selections above; Table 3 with Annexes 1 to 3 of this DPA; and in Table 4, neither Party may end the UK Addendum under its Section 19, except that Nex may do so where it adopts an alternative transfer mechanism under Section 8.9 of this DPA.

End of Nex Systems Data Processing Agreement.