Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between your business ("you", "the customer") and nexo. It governs how nexo processes personal data on your behalf when you use the service. Where this DPA and the Terms of Service differ on a data-protection matter, this DPA prevails.

It applies under Regulation (EU) 2016/679 (the "GDPR"), the Spanish Organic Law 3/2018 (the "LOPDGDD"), and any other data-protection law that applies to the processing ("Data Protection Law").

The short version

• You are the controller. We are your processor. For your clients' and contacts' personal data, you decide the what and the why; we process it only to run nexo for you, on your instructions.
• We don't use your data for ourselves beyond running the service. We don't sell it, we don't use it for advertising, and we don't use it to train AI models. We only ever use aggregated, de-identified information about how nexo is used to keep the service running and improve it.
• AI features send only what's needed to our AI providers, who process it for us and not for themselves.
• Where we control storage, your data stays in the EU (apart from the backup copies in Annex 3), is isolated per workspace, and is encrypted in transit and at rest.
• We use a short list of sub-processors (Annex 3). We stay responsible for them, and we tell you before the list changes.
• If there's a data breach, we tell you quickly so you can meet your own obligations.
• When you leave, we help you get your data out and then delete it — 30 days after your subscription ends — except the few records the law makes us keep.

This summary is for convenience. The full terms below are what apply.

1. Who the parties are

• You — the business that creates the nexo workspace — are the controller of the personal data you and your users put into, or bring into, nexo about your clients, prospects, counterparties and their representatives ("Client Personal Data").
• nexo — operated by Jklausen Holding S.L., NIF B56431364, registered office Calle Don Quijote 4, 29639 Benalmádena (Málaga), Spain — is the processor of that data. Contact us at hola@gonexo.io.

(Where nexo decides the purposes and means of processing in its own right — for example your users' account data — nexo is the controller, and our Privacy Policy governs that, not this DPA.)

2. Our roles

2.1 You as controller. You determine the purposes and means of processing Client Personal Data. You are responsible for having a lawful basis for it and for your duties toward the data subjects.

2.2 nexo as processor. We process Client Personal Data only on your documented instructions. Your instructions are: these Terms and this DPA, the way the service is configured, and the way you and your users use it. If we must process for another reason because the law requires it, we'll tell you first, unless the law prevents us.

2.3 If we think an instruction breaks the law, we'll tell you. We're not obliged to carry out an instruction that we believe infringes Data Protection Law.

2.4 Our own, limited purposes. We act as an independent controller only to: (a) keep nexo secure and running; (b) understand how nexo is used so we can run and improve it, using only aggregated, de-identified information; and (c) meet our own legal obligations. We are responsible for our own lawful basis for these. We will not use identifiable Client Personal Data to train AI models, and we will not sell it or use it for advertising. This matches what we promise in the Terms.

3. What we process, and why

The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1.

4. Your responsibilities as controller

4.1 Lawful basis and notices. You confirm that you have a valid lawful basis for the personal data you put into nexo, and that you have given your clients and contacts any privacy notices and obtained any consents the law requires.

4.2 Connected services. When you connect Google (Gmail / Workspace), Microsoft (Outlook / Microsoft 365), WhatsApp Business, or a portal feed such as an MLS network, and bring in messages, attachments and documents, you are the controller of that imported data. You are responsible for: (a) having a lawful basis to import and keep it, including data about third parties who did not give it to you directly; (b) any notice or consent you owe those third parties; (c) complying with the connected provider's own terms and with your confidentiality duties; and (d) how you use the import filters and settings nexo gives you.

4.3 Accuracy. You are responsible for the accuracy and lawfulness of the data you put in, and for correcting or deleting it as needed.

4.4 No special-category data. You must not put special-category data into nexo (clause 5.2).

5. Sensitive data in property transactions

5.1 What nexo is designed for. nexo is built to handle ordinary personal data and the following sensitive-but-not-special data that comes up in property deals:

• Identity documents and identifiers — passport, DNI, NIE, residence documents (handling DNI and NIE numbers is subject to specific LOPDGDD rules);
• Financial and transactional data — proof of funds, bank details, mortgage and lending documents, tax identifiers, contracts (reserva, arras, escritura), invoices;
• Anti-money-laundering (AML) / KYC records you are legally required to collect under Spanish Law 10/2010, with the retention that law requires.

5.2 Special-category data is not supported. Data under Article 9 GDPR (such as health, racial or ethnic origin, religious belief, or biometric data used to identify someone) is not a category nexo is designed for. You must not upload or import it. Identity documents under 5.1 are treated as sensitive and given heightened handling, but are not, by themselves, Article 9 data.

5.3 Heightened handling. Sensitive data under 5.1 is subject to the measures in Annex 2, including access controls, per-workspace isolation, and encryption in transit and at rest.

6. What we do as processor

We will:

• 6.1 process Client Personal Data only on your documented instructions (clause 2.2);
• 6.2 make sure the people we authorise to process it are bound by confidentiality;
• 6.3 put in place appropriate technical and organisational security measures (Article 32 GDPR — Annex 2);
• 6.4 respect the conditions on sub-processors (clause 8);
• 6.5 help you respond to data-subject requests (clause 10);
• 6.6 help you with security, breach notification, data-protection impact assessments and prior consultation (Articles 32–36), taking into account the nature of the processing and the information available to us;
• 6.7 delete or return Client Personal Data at the end of the service, at your choice (clause 13); and
• 6.8 make available the information needed to show we comply, and allow for and contribute to audits (clause 12).

7. Security

We implement and maintain the technical and organisational measures described in Annex 2, appropriate to the risk, to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

8. Sub-processors

8.1 Your authorisation. You give us general authorisation to engage the sub-processors listed in Annex 3 to help provide the service.

8.2 Our responsibility. We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible to you for what they do.

8.3 Changes. Before we add or change a sub-processor that handles Client Personal Data, we'll give you at least 30 days' notice (by email or in nexo, and on the list in our Privacy Policy), so you can object on reasonable data-protection grounds. If we can't resolve a reasonable objection, you may terminate the affected part of the service.

9. International transfers

Where Client Personal Data is transferred outside the EEA — for example to a sub-processor with operations in the United States — we put an appropriate transfer mechanism in place, such as the EU Standard Contractual Clauses and/or an adequacy decision, together with any supplementary measures needed after Schrems II. Where a sub-processor offers EU data residency, we configure it (see Annex 3), except for the backup copies Cloudflare keeps in the United States, listed there.

10. Data-subject requests

Taking into account the nature of the processing, we'll help you — by appropriate technical and organisational measures, as far as possible — to meet your duty to respond to data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). If a data subject contacts us directly about data we process for you, we'll forward the request to you and won't respond ourselves except on your instruction or where the law requires it.

11. Personal-data breaches

If we become aware of a personal-data breach affecting Client Personal Data, we'll notify you without undue delay, and in any event within 48 hours of becoming aware. The notice will describe, as far as we can, the nature of the breach, the likely consequences, the data and data subjects affected, and the measures taken or proposed. We'll help you meet your own notification duties to the AEPD and to data subjects.

12. Audits

We'll make available the information needed to show we comply with this DPA, and allow for and contribute to audits, including inspections, by you or an auditor you appoint — subject to reasonable notice, frequency, confidentiality and cost terms, and without compromising other customers' security or data. We may meet audit requests by providing third-party certifications or reports where we have them.

13. Returning and deleting your data

When your subscription ends, or if you ask us, we'll — at your choice — return and/or delete Client Personal Data and delete existing copies. In practice: your data stays available for you to export for 30 days after your subscription ends, and then we delete it. We keep some records for longer only where the law requires it — in particular AML/KYC records you must retain under Spanish Law 10/2010. What we retain, and for how long, is explained on our data-deletion page. Any data kept for our own limited purposes (clause 2.4) is only ever aggregated or de-identified.

14. AI features and your data

14.1 To deliver AI features you use — such as drafting replies, translating, summarising, matching and writing descriptions — we send only the content needed to the AI providers listed in our Privacy Policy (and Annex 3). They process it for us, under our instructions, to deliver the feature — not for their own purposes, and they don't use it to train their models. We do this as your processor, on your instruction, under clause 8.

14.2 We don't train models on your data. We do not use identifiable Client Personal Data to train our own models or anyone else's. Improving nexo uses only aggregated, de-identified information (clause 2.4).

14.3 No cross-customer sharing. We don't disclose one customer's data to another. Any future listing-sharing features are off by default, apply only to your own listings if you switch them on, and never share your clients' personal data between agencies.

15. Who is responsible for what

15.1 Each party is responsible for its own role: you for your controller duties (including a lawful basis for what you put in and import under clause 4.2), and nexo for its processor duties under this DPA and its own-controller duties under clause 2.4.

15.2 You will indemnify us against claims that arise from your breach of your controller duties, including importing data without a lawful basis.

15.3 The liability cap and exclusions in the Terms of Service apply to this DPA. Nothing here limits either party's statutory liability to data subjects or regulators that cannot be limited by contract; GDPR roles are decided by the actual processing, not only by this DPA.

16. General

• Precedence. This DPA forms part of the Terms and prevails over them on data-protection matters; a founding-agency agreement or order form prevails on its own specific points.
• Changes. We may update this DPA as nexo and the law change; for material changes we give at least 30 days' notice, as under the Terms.
• Language. This DPA is available in English and Spanish. If the two differ, the English version prevails.
• Law and courts. This DPA is governed by Spanish law. The courts of Málaga, Spain, have jurisdiction.
• Contact. nexo · Jklausen Holding S.L. · Calle Don Quijote 4, 29639 Benalmádena (Málaga), Spain · hola@gonexo.io.

Annex 1 — Details of the processing

• Subject matter: providing the nexo CRM and the modules you activate.
• Duration: the subscription term, plus the export window and any legally required retention.
• Nature and purpose: storing, organising, retrieving, displaying, classifying, enriching, matching, translating, and supporting communication for property transactions.
• Categories of data subjects: your clients and prospects (buyers, sellers, landlords, tenants), their representatives, counterparties, lawyers, agency contacts, and your users.
• Types of personal data: contact and identity data; identity documents (passport / DNI / NIE); financial and transactional data (proof of funds, mortgage documents, contracts, invoices); AML / KYC records; communications content and metadata imported from connected services. Special-category data is not a designed-for category (clause 5.2).

Annex 2 — Security measures (Article 32 GDPR)

• Logical isolation of each workspace's data (per-tenant separation).
• Encryption in transit (TLS) and at rest.
• Access controls and least-privilege access; named logins for users; confidentiality obligations for staff.
• Signature verification on inbound webhooks and malware scanning of imported files.
• Logging and audit trails, including document provenance (source channel, sender, timestamp).
• Regular backups, resilience, and breach-detection processes.

Annex 3 — Sub-processors

The current, authoritative list is maintained in our Privacy Policy; this annex must be kept consistent with it.

Note on analytics / observability: PostHog and Grafana process data for nexo's own purposes under clause 2.4 (running, securing and improving the service), not on your instructions; they are listed here for transparency. They should be configured to avoid ingesting identifiable Client Personal Data wherever possible.

Note on connected services: Google (Gmail / Workspace), Microsoft (Outlook / Microsoft 365), Meta (WhatsApp Business) and MLS networks are services you choose and connect, so they are not nexo's sub-processors and are not listed above. Where nexo only acts on your instruction to access them, they act as your processors, and your own agreement with each of them governs that access.