Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service and applies where Nexthome Labs processes personal data on your behalf as a processor — for example, mailbox content in ProperInbox, recipient data in Nextsend events, or end-user data inside your NexHost deployments. You are the controller of that data.

• Subject matter: personal data contained in Customer Content processed via the Services.
• Nature and purpose: hosting, storage, transmission, and delivery required to provide the Services, plus related security, backup, and support operations.
• Duration: the term of your account, plus the retention periods in our Privacy Policy.
• Categories of data subjects: your users, customers, employees, and email recipients.
• Categories of data: identifiers, contact details, email content and metadata, technical logs, and any other data you choose to submit.

• Process personal data only on your documented instructions, including these Terms.
• Ensure persons with access are bound by confidentiality.
• Implement the technical and organizational measures described on our Security page.
• Assist you with data subject requests, impact assessments, and breach notifications.
• Notify you without undue delay after becoming aware of a personal data breach.
• Delete or return personal data at the end of the service term, at your choice, subject to legal retention duties.
• Make available information reasonably necessary to demonstrate compliance and allow audits as described below.

You authorize the subprocessors listed on our Compliance page. We will notify you of intended changes and give you the opportunity to object; if we cannot accommodate a reasonable objection, you may terminate the affected Services. We remain fully liable for subprocessors' performance.

Where personal data is transferred outside the EEA/UK, we rely on an adequacy decision or the EU Standard Contractual Clauses (and the UK addendum where applicable), which are incorporated into this DPA by reference, with you as data exporter and Nexthome Labs as data importer.

We make our Security and Compliance documentation available to demonstrate compliance. Where further audit is required by law, you may conduct one remote audit per year at your expense, on reasonable notice, scoped to avoid risk to other customers.