Data Processing Agreement (DPA)

1. Parties

Data Processor (Processor): Quantum Nexus Ventures FZCO, a free zone company incorporated in Dubai (United Arab Emirates), holder of the Nexus Legal trademark and the nexusquantum.legal domain (hereinafter, «Nexus» or «the Processor»).

Data Controller (Controller): the entity or legal person that contracts Nexus's services by accepting the Terms of Service and this DPA (hereinafter, «the Client» or «the Controller»).

2. Subject matter

This agreement governs the conditions under which Nexus, in its capacity as Processor, will process personal data on behalf of the Client, within the framework of providing the «Nexus Legal» service (AI-assisted legal analysis, public API v1, MCP server, productivity add-ins and related services).

3. Nature, purpose and duration of the processing

• Nature: automated analysis of legal documents submitted by the Client through the platform or API.
• Purpose: generation of reports, drafting of legal briefs, case-law searches, scenario simulation and other contracted services.
• Duration: for as long as the Client maintains an active account with a credit balance or a current subscription. Account cancellation entails the end of the processing (except for mandatory legal retention, see §11).
• Categories of personal data: those the Client decides to upload to the platform. Typically identifying data of the parties (name, DNI/NIE, address), economic data in contracts, professional data. Exceptionally, special category data (health, criminal records) depending on the legal matter.
• Categories of data subjects: natural persons mentioned in the documents submitted by the Client (the firm's end clients, counterparties, witnesses, etc.).

4. Instructions of the Controller

Nexus will process personal data solely in accordance with the Client's documented instructions. These instructions are those arising from: (a) the Terms of Service, (b) this DPA, (c) the technical documentation of the API v1, and (d) the individual requests that the Client makes through the platform.

Nexus will notify the Client without delay if it considers that a Client instruction infringes the RGPD or any other data protection provision.

5. Nexus's obligations as Processor (Art. 28.3 RGPD)

1. Confidentiality: Nexus guarantees that the persons authorized to process data are bound by an explicit duty of confidentiality by contract or by law.
2. Security measures (Art. 32): Nexus applies the technical and organizational measures detailed in §6 below.
3. Sub-processors: Nexus may engage sub-processors in accordance with §7.
4. Assistance to the Controller: Nexus will assist the Client in responding to requests to exercise the rights of data subjects (access, rectification, erasure, objection, portability, restriction) when it receives notification from the Client.
5. Breach notification: Nexus will notify the Client of any security breach without undue delay, in any case within a maximum of 24 hours from detection.
6. Audit: Nexus will make available to the Client, once a year and with 30 days' prior notice, the information necessary to demonstrate compliance with the obligations of Art. 28. The Client may carry out its own audits or through a designated third party, bearing the costs except in the case of a proven serious breach.
7. Return and erasure: upon termination of the provision of services, Nexus will return or erase the personal data (at the Client's choice), except for mandatory legal retention.

6. Technical and organizational measures (Art. 32 RGPD)

• Zero Retention by default: documents submitted to the platform are processed in RAM memory and are NOT persisted to a database except by express decision of the Client (association with a case file with retention_policy «standard» or higher).
• Hosting on EU soil: Railway infrastructure europe-west4-drams3a (Netherlands). Data in transit → TLS 1.3. Data at rest (where applicable) → AES-256.
• PII Gatekeeper: before sending text to LLMs, Nexus automatically anonymizes DNIs, NIEs, IBANs, account numbers, emails and phone numbers. The LLM does not process direct personal identifiers.
• Access control: authentication via API key (SHA-256), minimal scopes per function, usage logs per endpoint (`api_usage_stats`).
• Key encryption: API keys are stored as a SHA-256 hash; never in plaintext.
• Logs and audit: append-only log of events (`output_review_events`, `admin_audit_log`).
• Backups: Supabase snapshots with encryption at rest, 7-day retention.
• Vulnerabilities: continuous review of dependencies (npm audit in CI), critical patches in < 48 h, annual external audit.
• Continuity: stateless backend architecture (horizontally scalable), Supabase Pro failover available under contract.

7. Authorized sub-processors

The Client generally authorizes the following sub-processors, all with RGPD-compliant contractual clauses:

Nexus undertakes to notify the Client of any change of sub-processors with 30 days' prior notice. The Client may object on justified grounds.

8. International transfers

When transfers occur outside the European Economic Area (typically to LLM sub-processors in the United States), Nexus ensures that they are carried out under the European Commission's Standard Contractual Clauses (SCC) (Decision 2021/914). 🔴 To be precise: the 2021 UK adequacy decision covers flows from the EU to the United Kingdom; it does NOT cover transfers leaving the United Kingdom for third countries. For data subject to the UK GDPR the instrument is the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, both approved by the ICO.

For clients requiring strict processing in the EU without transfer to the USA, Nexus offers, under an enterprise contract, an «EU-only LLM» mode that limits routing to providers with EU datacenters (DeepSeek-EU, Mistral, etc.). Additional fee depending on volume.

9. Liability and indemnification

Each party shall be liable to the other for the damages arising from its breach of the RGPD, under the terms of Art. 82 RGPD. Nexus's liability towards the Client shall be limited to the amounts actually paid by the Client in the 12 months prior to the event giving rise to the damage, except in cases of willful misconduct or proven gross negligence.

10. Assistance with impact assessments (DPIA) and prior consultation

Nexus will provide the Client with the reasonably necessary assistance to carry out DPIAs (Art. 35) or prior consultations with the supervisory authority (Art. 36) in relation to the contracted services.

11. Retention, return and erasure

Upon termination of the contract, the Client may choose between:

1. Export all data associated with their account (analysis_outputs, evidence, deadlines, firm_memory, etc.) in structured JSON format, via /api/account/dsr/export (always available).
2. Request the total and irreversible erasure of their data at /api/account (DELETE), or in writing to legal@nexusquantum.legal.

Retention exceptions: legally required records (consent_log with a minimum retention of 3 years post-revocation, invoicing minimum 6 years in accordance with Spanish regulations). These records are kept in anonymized format except where the law requires otherwise.

12. Term and amendments

This DPA enters into force on the date of signature by both parties and remains in effect throughout the provision of services. Amendments to this DPA require the written agreement of both parties, except for changes arising from amendments to the RGPD or from guidelines of the European Data Protection Board, which will apply automatically upon prior notification to the Client.

13. Governing law and jurisdiction

This DPA is governed by Spanish law and, where applicable, by the RGPD and the LOPDGDD. The parties submit to the Courts and Tribunals of Madrid, unless consumer protection rules establish otherwise.

14. Signatures