NexCert

Data Processing Agreement

Effective 16 October 2026 · Version 1.1

1. Parties and status

This Data Processing Agreement ("DPA") is entered into between:

• NexCert Ltd, a company registered in England and Wales (company number 17520827) whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ ("NexCert"), the "Processor"; and
• The Customer named in the NexCert order or account (the "Controller").

This DPA is a contract required by Article 28 of the UK General Data Protection Regulation (retained in UK law by the Data Protection Act 2018) and forms part of the Terms of Service between the parties. Terms defined in the Terms of Service have the same meaning here unless expressly stated otherwise.

2. Definitions

• Applicable Data Protection Law — the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any successor legislation.
• Controller / Processor / Sub-processor / Data Subject / Personal Data / Processing / Personal Data Breach — as defined in the UK GDPR.
• Customer Personal Data — the personal data the Customer or its Users process through the Service, described in Schedule 1.
• Instructions — the documented instructions given by the Controller to the Processor through this DPA, the Terms of Service, the Service configuration, and support requests raised through official channels.
• Sub-processor — any third party engaged by the Processor to process Customer Personal Data.

3. When this DPA applies

This DPA applies whenever the Processor processes Customer Personal Data on behalf of the Controller in the course of providing the Service. It takes effect on the earlier of (a) the Customer's acceptance of the Terms of Service and (b) any actual processing of Customer Personal Data by the Processor for the Customer. It remains in force for as long as the Processor holds Customer Personal Data.

If there is any conflict between this DPA and the Terms of Service on data-protection matters, this DPA prevails.

4. Roles

The parties acknowledge that in respect of Customer Personal Data:

• the Controller determines the purposes and means of processing;
• the Processor processes only on the Controller's Instructions.

Separately, the Processor is a Controller for the personal data of the Customer's own personnel that it collects to operate the account relationship (name, work email, login records, billing contact). That processing is described in the Privacy Policy and falls outside this DPA.

5. Processor obligations (UK GDPR Art. 28(3))

The Processor shall:

1. Process only on documented instructions. Process Customer Personal Data only on the Controller's documented Instructions, including with regard to international transfers, unless UK or EU law requires otherwise (in which case the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits such notice).
2. Confidentiality. Ensure that persons authorised to process Customer Personal Data are bound by written confidentiality obligations or a statutory duty of confidence.
3. Security. Implement and maintain appropriate technical and organisational measures under Article 32 UK GDPR, as set out in Schedule 2. Review and update those measures as the state of the art evolves.
4. Sub-processors. Only engage Sub-processors under section 6 below and on data-protection terms substantially equivalent to those in this DPA.
5. Data-subject rights. Assist the Controller by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects to exercise their rights under Chapter III UK GDPR — access, rectification, erasure, restriction, portability, objection.
6. Security incidents, DPIAs, prior consultation. Assist the Controller in complying with its obligations under Articles 32–36 UK GDPR (security of processing, breach notification, data-protection impact assessments and prior consultation with the ICO), taking into account the nature of processing and the information available to the Processor.
7. End of processing. At the Controller's choice, return or delete all Customer Personal Data at the end of the provision of Services, and delete existing copies, unless UK law requires storage — see section 11.
8. Audit and information. Make available to the Controller all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits — see section 12.

The Processor will inform the Controller if, in its opinion, an Instruction infringes Applicable Data Protection Law.

6. Sub-processors

The Controller grants the Processor general authorisation to engage Sub-processors, subject to the conditions below.

1. The current list of Sub-processors is set out in Schedule 3. That schedule may be updated from time to time and the current version is always available at nexcert.uk/dpa.html#schedule-3.
2. Before adding or replacing a Sub-processor the Processor will give the Controller at least 30 days' notice by email to the account's billing address and by updating this DPA page.
3. The Controller may object to the change on reasonable data-protection grounds within that 30-day window. If the parties cannot agree a resolution, the Controller may terminate the affected part of the Service on written notice, with a pro-rata refund of Fees paid in advance for that part after the effective date of termination.
4. The Processor imposes data-protection obligations on each Sub-processor substantially equivalent to those in this DPA, and remains fully liable to the Controller for the Sub-processor's performance.

7. International transfers

Where the Processor or a Sub-processor transfers Customer Personal Data outside the United Kingdom, the transfer will be made under one of the safeguards recognised in Article 46 UK GDPR — in practice, the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses with the UK Addendum, or an ICO-recognised adequacy decision. The Processor will make copies of the applicable transfer mechanism available to the Controller on request.

8. Personal Data Breach

The Processor will notify the Controller without undue delay and no later than 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. That notification will describe:

• the nature of the breach, including where possible the categories and approximate number of Data Subjects and records concerned;
• the name and contact details of the Processor's contact point for more information;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its adverse effects.

Where the required information cannot be provided at the same time, it will be provided in phases without further undue delay. The Processor will cooperate with the Controller and take reasonable steps to assist with any investigation, notification to Data Subjects, or notification to the ICO.

9. Data-subject requests

If the Processor receives a request from a Data Subject to exercise a UK GDPR right in respect of Customer Personal Data, it will (a) not respond directly except to acknowledge receipt and refer the Data Subject to the Controller where appropriate, and (b) promptly forward the request to the Controller. The Processor will assist the Controller by appropriate technical and organisational measures to respond to such requests within the statutory time limits.

10. Assistance and cooperation

The Processor will provide the Controller with reasonable assistance — taking into account the nature of processing and the information available to the Processor — to enable the Controller to:

• respond to Data-Subject rights requests;
• meet its own security and breach-notification obligations under Articles 32–34 UK GDPR;
• carry out Data-Protection Impact Assessments and, where necessary, prior consultation with the ICO under Articles 35–36 UK GDPR.

Where assistance under this section goes materially beyond what the Service ordinarily provides, the Processor may charge its reasonable time and costs, agreed with the Controller in advance.

11. Return or deletion at end of processing

On termination or expiry of the Service, the Controller may request within 30 days that Customer Personal Data be returned in a common machine-readable format or be deleted. In the absence of such request the Processor will delete Customer Personal Data within 90 days of termination, save for:

• copies retained to comply with UK statutory record-keeping obligations (accounting records: 6 years; gas-cert records: 2 years per GSIUR 1998; electrical-cert records: until superseded by the next inspection or as required by the relevant scheme), which will be kept only for as long as legally required and then deleted;
• copies kept in encrypted disaster-recovery backups, which will be cycled out in the ordinary course of backup rotation and not restored to production.

12. Audits and information

On the Controller's reasonable written request (not more than once in any 12-month period, except where required by a supervisory authority or triggered by a Personal Data Breach), the Processor will:

• make available to the Controller current information relating to its security posture (policies, sub-processor list, penetration-test summaries where available, and any third-party assurance reports the Processor holds);
• respond to a reasonable, scoped security questionnaire from the Controller;
• permit and contribute to audits conducted by the Controller or an independent auditor mandated by the Controller, subject to reasonable notice (at least 30 days), a mutually agreed scope, confidentiality obligations, and the Controller's payment of the Processor's reasonable time and costs.

Access to production systems containing other customers' data will not be granted. Audits will be conducted during normal working hours and in a manner that does not unreasonably interfere with the Processor's operations.

13. Liability

The parties' liability under this DPA is subject to the exclusions and limitations set out in the Terms of Service, save that nothing in this DPA excludes or limits any liability that cannot be excluded or limited under Applicable Data Protection Law — including any statutory right of a Data Subject to seek compensation from either party under Article 82 UK GDPR.

14. Order of precedence

In case of conflict between documents governing the parties' relationship, the order of precedence is:

1. any signed Enterprise contract or order form that expressly amends this DPA;
2. this DPA;
3. the Terms of Service;
4. the Privacy Policy.

15. Term

This DPA takes effect as set out in section 3 and remains in force for as long as the Processor holds Customer Personal Data. Obligations that by their nature survive termination — including confidentiality, audit cooperation, and liability — continue after this DPA ends.

16. Governing law

This DPA is governed by the law of England and Wales and disputes are subject to the exclusive jurisdiction of the courts of England and Wales, matching section 20 of the Terms of Service.

The Processor implements the following measures. The list is current as of the effective date and evolves as the state of the art evolves; the Processor will maintain measures at least equivalent to those below.

Access control and authentication

• Multi-tenant architecture with per-tenant data isolation enforced at the database query layer.
• Role-based access control (owner / admin / QS / engineer / signoff) inside each tenant.
• Passwords stored using the Argon2 / bcrypt family of one-way password hashes; refresh tokens stored as one-way SHA-256 hashes.
• Support for WebAuthn / passkeys for stronger authentication where enabled.
• Session tokens rotated on password change; step-up authentication for sensitive operations.

Encryption

• HTTPS with TLS 1.2 or higher for all traffic between the Controller and the Service (edge terminated at Cloudflare, re-terminated at the origin).
• Encryption at rest for database volumes and object storage on the underlying hosting infrastructure.
• Field-level encryption for specifically identified sensitive fields (e.g. billing tokens, integration secrets).

Network and edge

• Cloudflare Web Application Firewall in front of the origin.
• Rate-limiting on public and authenticated endpoints.
• Cloudflare Access for administrative interfaces (Zero Trust identity gate).

Application security

• Input validation and schema-driven cert payloads.
• Parameterised database queries (no string-concatenated SQL).
• CORS restricted to known application origins.
• Security-lens code review (Warden) on every non-trivial change before deploy — see the Processor's build-and-deploy discipline documentation.
• Dependency vulnerability scanning as part of the release pipeline.

Audit and integrity

• Every certificate carries a full audit trail (creation, edit, submission, approval, sign-off), timestamped and attributed to the acting user.
• Signed certificates are version-locked and immutable; superseding versions are stored as new versions, not overwrites.
• Owner-role impersonation events on other tenants are logged separately for tenant-side visibility.

Backups and business continuity

• Automated daily database backups retained for at least 30 days.
• Backups encrypted at rest.
• Documented restore procedure with periodic recovery testing.

Personnel

• Access to production systems restricted to named personnel on a need-to-know basis.
• All personnel with access to Customer Personal Data are subject to written confidentiality obligations.

Data-breach response

• Documented incident-response playbook, including 72-hour notification requirement under section 8.
• Post-incident review with corrective actions tracked.

The current list of Sub-processors engaged by the Processor is:

Schedule 3 last updated: 4 October 2026. Changes are notified per section 6.