Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between NEXIEL LIMITED (“Processor,” “Nexiel”) and the Client, and governs Nexiel's processing of personal data on the Client's behalf, as required by Article 28(3) of the GDPR wherever the Client is a controller subject to the GDPR.

1. Subject matter, duration, nature, and purpose of processing

Subject matter: Nexiel's provision of identity verification, sanctions/PEP screening, age verification, and credential issuance Services to the Client, as described in the Terms of Service.

Duration: for as long as the Client has an active account, plus any further period Nexiel is required to retain data under “Deletion or return of data” below.

Nature and purpose: receiving personal data the Client submits or authorizes through the Services' APIs, verifying it against sanctions/PEP source data or an EUDI wallet presentation, producing a screening classification or verification result, and returning that result to the Client, all strictly to perform the Services the Client has requested.

2. Types of personal data and categories of data subjects

Types of personal data, depending on which Service the Client uses: name, date of birth, nationality, document number, address, wallet-disclosed identity claims, an age-over-18 boolean, and, where the Client uses Nexiel Screen's KYB customer due diligence capability, beneficial-owner and director details (name, date of birth, nationality, ownership percentage, and basis of control).

Categories of data subjects: the Client's own end users or customers that the Client submits for a check, and, for KYB customer due diligence, the beneficial owners and directors of the Client's own customers.

3. Processing only on instructions

Nexiel will process personal data only on the Client's documented instructions, including instructions given through the Client's own use of the Services' APIs and dashboard, and as necessary to comply with a legal obligation Nexiel is itself subject to, in which case Nexiel will inform the Client of that legal requirement before processing unless the law prohibits doing so. Nexiel will inform the Client if it believes an instruction infringes the GDPR or another applicable data protection law.

4. Confidentiality of personnel

Nexiel ensures that any person it authorizes to process personal data under this DPA is under an appropriate obligation of confidentiality, whether contractual or statutory.

5. Security of processing

Nexiel implements the technical and organizational measures required by GDPR Art. 32, appropriate to the risk:

• Encrypted evidence packs for AML-relevant Screen and Verify decisions, delivered once to a key the Client controls, with Nexiel never holding the private key.
• Immediate deletion of raw end-user identity PII beyond the single verification transaction it was collected for.
• A hash-chained, cryptographically verifiable audit trail for every screening decision.
• Short-lived, rotatable API credentials rather than permanent secrets.

Full technical detail is in the Privacy Policy.

6. Sub-processors

The Client gives Nexiel general written authorization to engage the sub-processors listed below, each engaged only for the purpose stated, under a written agreement imposing data protection obligations equivalent to this DPA. Nexiel will inform the Client of any intended addition or replacement of a sub-processor with a reasonable opportunity to object on legitimate data protection grounds before the change takes effect.

7. Assisting with data subject rights

Taking into account the nature of the processing, Nexiel will assist the Client, through appropriate technical and organizational measures, to respond to a data subject's request to exercise their GDPR rights, insofar as this is possible given how briefly Nexiel itself retains the underlying data (see “How long we keep it” in the Privacy Policy).

8. Assisting with Articles 32 to 36

Taking into account the nature of processing and the information available to Nexiel, Nexiel will assist the Client in meeting its own obligations under GDPR Arts. 32 (security), 33 and 34 (personal data breach notification), 35 (data protection impact assessment), and 36 (prior consultation with a supervisory authority), including by notifying the Client without undue delay after becoming aware of a personal data breach affecting data processed under this DPA.

9. Deletion or return of data

At the Client's choice, and at the end of the provision of the relevant Service, Nexiel will delete or return all personal data processed on the Client's behalf, and delete existing copies, unless EU or member state law requires Nexiel to continue storing it (for example, the statutory AML retention period described in the Privacy Policy). In practice, for most personal data this obligation is already satisfied on an ongoing basis: Nexiel Verify's end-user identity PII is deleted immediately after the single transaction it was collected for, well before the end of the Client relationship.

10. Audit information

Nexiel will make available to the Client all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to an audit, including an inspection, conducted by the Client or an auditor the Client mandates, on reasonable notice and no more than once per year absent a genuine, specific compliance concern.

11. International transfers

Where a sub-processor listed above is located outside the EEA, Nexiel relies on an appropriate GDPR transfer mechanism, such as the EU Standard Contractual Clauses or an applicable adequacy decision, as noted in the table above.

12. Liability

Each party's liability under this DPA is subject to the limitation of liability set out in the Terms of Service.

13. Term

This DPA takes effect on the date the Client first submits personal data through the Services, and continues for as long as Nexiel processes personal data on the Client's behalf.

Contact

Registered company number and office address are shown once this page finishes loading.

For a question about this DPA, or to send your own required DPA template, contact dpo [at] nexiel [dot] ie.

Effective date: 29 August 2026. See also the Terms of Service, privacy policy, and legal disclaimer.