Nova Data & AI Limited - Data Processing Agreement

Version 1.0. Effective 17 October 2026.

This Data Processing Agreement ("DPA") forms part of the agreement between Nova Data & AI Limited and Customer for the Service, whether accepted online under the Nova Terms of Service or signed as an order form (the "Agreement"). It applies automatically when Customer accepts the Agreement, and no separate signature is required.

Parties

Provider: Nova Data & AI Limited, a company registered in England and Wales with company number 16288380, whose registered office is at 3rd Floor Old Stock Exchange, St Nicholas Street, Bristol, BS1 1TG, United Kingdom. ICO registration number ZB889430.

Customer: The customer named in the Agreement.

Provider Privacy Contact: [email protected]

Provider Security Contact: [email protected]

1. Roles of the parties

1.1 Provider as Processor. Where Customer is a Controller of Customer Personal Data, Provider is a Processor that Processes Customer Personal Data on Customer's behalf.

1.2 Provider as Subprocessor. Where Customer is a Processor of Customer Personal Data, Provider is a Subprocessor of that data.

2. Processing

2.1 Processing details. Annex I describes the subject matter, nature, purpose and duration of the Processing, and the categories of Personal Data and Data Subjects.

2.2 Customer's instructions. Customer instructs Provider to Process Customer Personal Data:

(a) to provide and maintain the Service;

(b) as further specified through Customer's use of the Service, including the data sources, systems and accounts Customer connects and the access scope Customer grants;

(c) as documented in the Agreement; and

(d) as documented in any other written instructions Customer gives and Provider acknowledges.

Provider will follow these instructions unless Applicable Laws prohibit doing so. Provider will immediately tell Customer if it cannot follow an instruction, or if, in its opinion, an instruction infringes Applicable Data Protection Laws. Customer will give only instructions that comply with Applicable Laws.

2.3 Customer controls the scope. Customer decides which data sources, systems and accounts to connect to the Service, what access to grant, and what to upload. Each connection Customer makes is an instruction under Section 2.2 to Process the Customer Personal Data available through it, to provide the Service. Customer may remove a connection or narrow its scope at any time.

2.4 Processing by Provider. Provider will Process Customer Personal Data only in line with this DPA and Customer's instructions, unless Applicable Laws require otherwise, in which case Provider will inform Customer of that legal requirement before Processing, unless the law prohibits this. If Provider adds or changes products, features or functionality, it may update the details in Annex I to reflect those changes by notifying Customer.

2.5 Customer's obligations. Customer has complied, and will continue to comply, with all Applicable Data Protection Laws in providing Customer Personal Data to the Service, including giving any required notices, obtaining any required consents and having a lawful basis for each connection it makes. Where Customer is itself a Processor, Customer will comply with its own Controller's requirements, including those on Subprocessors.

2.6 Prohibited data. Customer will not submit Special Category Data, health data, payment card or bank account numbers, government identification numbers, or personal data relating to criminal convictions and offences, to the Service unless Provider agrees in writing. Any such data Customer submits remains Customer Personal Data protected by this DPA. Customer is responsible for submitting it, and Provider may delete it from the Service after notifying Customer. This Section does not apply to data that the Service accesses or retrieves from a connected system as Customer directs. Provider does not itself delete or change data in a connected system. Any such action is taken through the Service as directed by Customer, its Users or the agents they configure, within the permissions Customer grants.

3. AI and model training

3.1 Provider will not use Customer Content or Customer Personal Data to train, retrain or fine-tune artificial intelligence or machine learning models, and will not allow its Subprocessors to do so.

3.2 Provider may use Usage Data, and feedback that Users choose to give, to operate, improve and develop its products and services. Any Customer Personal Data included with feedback remains Customer Personal Data and is not used for these purposes. Provider may also use information about how the Service is used structurally, but only where it contains no Customer Content, is aggregated across customers, and does not identify Customer, any User or any individual.

3.3 Provider will never sell or share Customer Content, Usage Data or feedback with any third party for that third party to train its own models.

4. Subprocessors

4.1 Approved Subprocessors. Customer gives Provider general written authorisation to engage Subprocessors, subject to this Section 4. Customer approves the Subprocessors listed in Annex III. Provider makes the current list available to Customer on request to the Provider Privacy Contact.

4.2 Changes. Provider will tell Customer in writing at least 10 business days before adding or replacing a Subprocessor. Customer may object within 10 business days of receiving that notice, otherwise it is deemed to accept the change. Provider will not engage the new Subprocessor before that objection period ends. If Customer objects, the parties will work together in good faith to resolve the objection. If they cannot, Customer may terminate the affected part of the Service and receive a prorated refund of any prepaid fees for it.

4.3 Subprocessor terms. Provider will have a written agreement with each Subprocessor that limits its access to and use of Customer Personal Data to what is needed to perform the subcontracted work, and imposes data protection obligations no less protective than this DPA.

4.4 Liability for Subprocessors. Provider remains fully liable for its Subprocessors' Processing of Customer Personal Data, and will tell Customer of any Subprocessor's failure to meet a material data protection obligation.

4.5 Customer-connected services. Where Customer chooses a third-party service, contracts with it directly, and connects it to the Service or supplies its own credentials or API key for it, that service acts for Customer and is not Provider's Subprocessor. Customer is responsible for its own agreement with that service. Provider remains responsible for its own Processing of Customer Personal Data when exchanging data with that service.

5. International transfers

5.1 Authorisation. Customer agrees that Provider may transfer Customer Personal Data outside the United Kingdom or the EEA where needed to provide the Service, provided the transfer complies with Applicable Data Protection Laws.

5.2 Provider's onward transfers. Where Provider transfers Customer Personal Data from the United Kingdom or the EEA to a country without an applicable adequacy decision or adequacy regulations, Provider will rely on a lawful transfer mechanism, such as the EEA SCCs, the UK International Data Transfer Agreement, the UK Addendum to the EEA SCCs, or a recipient's certification under an approved framework, together with any supplementary measures required.

5.3 Transfers from the EEA. Where the GDPR applies to a transfer of Customer Personal Data from Customer in the EEA to Provider, and no adequacy decision covers the transfer, the parties are deemed to have entered into the EEA SCCs, completed as follows:

(a) Module Two applies where Customer is a Controller, and Module Three where Customer is a Processor;

(b) the optional docking clause in Clause 7 does not apply;

(c) in Clause 9, Option 2 applies, with 10 business days' prior notice of Subprocessor changes;

(d) the optional wording in Clause 11 does not apply;

(e) in Clauses 17 and 18, the EEA SCCs are governed by the laws of, and disputes resolved in the courts of, Ireland; and

(f) Annexes I, II and III of this DPA complete the corresponding Annexes of the EEA SCCs.

5.4 Swiss transfers. Where Swiss data protection law applies to a transfer, references to the GDPR in the EEA SCCs are read as references to the Swiss Federal Act on Data Protection, and the competent supervisory authority includes the Swiss Federal Data Protection and Information Commissioner.

6. Security

6.1 Security measures. Provider will implement and maintain the technical and organisational measures in Annex II, appropriate to the risk of the Processing. Provider may update these measures, provided the overall level of protection does not decrease.

6.2 Confidentiality of personnel. Provider will ensure that anyone it authorises to Process Customer Personal Data is under an obligation of confidentiality.

6.3 Security Incidents. On becoming aware of a Security Incident, Provider will:

(a) notify Customer without undue delay, and in any case within 48 hours;

(b) provide timely information about the Security Incident as it becomes known or as Customer reasonably requests, including, where known, its nature, the categories and approximate number of Data Subjects and records concerned, its likely consequences, and the measures taken or proposed; and

(c) promptly take reasonable steps to contain and investigate it.

Notifying or responding to a Security Incident is not an admission of fault or liability.

7. Audits and information

7.1 Information. Provider will make available to Customer all information reasonably necessary to demonstrate its compliance with this DPA, and will allow for and contribute to audits, including inspections, by Customer or an auditor Customer appoints. Provider may withhold information where disclosure would harm its intellectual property, confidentiality obligations to others, or obligations under Applicable Laws, provided it gives the information needed to demonstrate compliance in another form, such as a redacted copy, a summary or controlled access.

7.2 How audits are carried out. Customer will first exercise its audit rights by asking Provider for any security certifications or reports it holds and by sending security questionnaires to the Provider Security Contact. Questionnaires are limited to once a year, unless a Security Incident has occurred or a supervisory authority requires more. Where the information provided does not reasonably demonstrate Provider's compliance with this DPA, or a supervisory authority requires it, Customer may carry out an inspection. Inspections must be arranged in advance, on reasonable notice, during business hours, at Customer's cost, and under confidentiality. The limits and arrangements in this Section 7 will not be used to prevent or unreasonably delay information, audits or inspections required by Applicable Data Protection Laws.

7.3 Records. Provider will keep records of its compliance with this DPA for 3 years after it ends.

8. Cooperation

8.1 Requests from others. If Provider receives a request about Customer Personal Data from a Data Subject, regulator, court or anyone else, Provider will notify Customer, unless the law prohibits it, and will not respond without Customer's consent unless legally required to. Provider will follow Customer's reasonable instructions on the request and will help Customer meet its obligations to respond to Data Subject requests.

8.2 Compliance assistance. Taking into account the nature of the Processing and the information available to it, Provider will assist Customer in meeting its obligations relating to security of Processing, notification of personal data breaches to supervisory authorities and Data Subjects, and data protection impact assessments.

8.3 Impact assessments. Where required by Applicable Data Protection Laws, Provider will reasonably assist Customer with data protection impact assessments, transfer impact assessments and prior consultations with supervisory authorities, taking into account the nature of the Processing and the information available to Provider.

9. Deletion

9.1 During the Agreement. Customer may delete Customer Personal Data using the Service. Where the Service does not allow Customer to delete it directly, Provider will delete it within 30 days of Customer's written request to the Provider Privacy Contact.

9.2 At the end of the Agreement. The Agreement ends when all of Customer's subscriptions and any trial have expired or been terminated. Before the Agreement ends, Customer may retrieve Customer Personal Data using the functionality of the Service. On Customer's written request made before the Agreement ends or within 30 days after it ends, Provider will also return Customer Personal Data that Customer did not retrieve before its access to the Service ended, in a commonly used format, to the extent reasonably practicable. This obligation applies to Customer Personal Data only. Provider completes a timely return request before deleting the data concerned. Within 60 days after the Agreement ends, Provider will delete Customer Personal Data. Copies in backups will be deleted within 30 days after that. Provider may keep Customer Personal Data where Applicable Laws require, and will continue to protect it and not Process it further.

9.3 Default and Subprocessors. If Customer does not request return, Provider deletes Customer Personal Data under Section 9.2. Provider requires its Subprocessors to delete Customer Personal Data in line with this Section.

9.4 Certification. On request, Provider will confirm deletion in writing.

10. Liability

10.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, to the extent permitted by Applicable Data Protection Laws.

10.2 Only the Customer entity that is a party to the Agreement may bring claims under this DPA.

10.3 Nothing in this DPA limits either party's liability to an individual for their data protection rights, or any liability under the EEA SCCs or UK transfer terms that cannot be limited.

11. Order of precedence

If documents conflict, they take priority in this order: (1) the EEA SCCs or UK transfer terms, where they apply; (2) this DPA, for the Processing of Customer Personal Data and the use of Customer Content; and (3) the rest of the Agreement.

12. Term and governing law

12.1 This DPA starts when Customer accepts the Agreement and continues until Provider no longer Processes Customer Personal Data.

12.2 This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where Section 5 requires otherwise.

13. Definitions

"Applicable Data Protection Laws" means the Applicable Laws governing the Processing of Personal Data, including the UK GDPR, the Data Protection Act 2018, the GDPR and the Swiss Federal Act on Data Protection, as they apply.

"Applicable Laws" means the laws, regulations, court orders and other binding requirements that apply to a party.

"business day" means a day other than a Saturday, Sunday or public holiday in England.

"Controller", "Processor", "Data Subject", "Personal Data" and "Processing" have the meanings given in Applicable Data Protection Laws.

"Customer Content" means data, information and materials submitted to the Service by or for Customer or its Users, or made available to the Service through connections Customer makes, and content generated by the Service for Customer. It does not include Usage Data or feedback that Users choose to give, except that any Customer Content or Personal Data included with feedback remains Customer Content.

"Customer Personal Data" means Personal Data within Customer Content that Provider Processes on Customer's behalf.

"EEA" means the member states of the European Union, Iceland, Liechtenstein and Norway.

"EEA SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

"GDPR" means Regulation (EU) 2016/679.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

"Service" means the Nova platform and related services described in the Agreement.

"Special Category Data" has the meaning given in Article 9 of the GDPR and UK GDPR.

"Subprocessor" means a third party Provider engages to Process Customer Personal Data.

"UK GDPR" means the GDPR as it forms part of the law of the United Kingdom.

"Usage Data" means data about the provision, use and performance of the Service, excluding Customer Content.

"User" means an individual who uses the Service on Customer's behalf.

Annex I: Description of the Processing

A. List of parties

Data exporter: Customer, as identified in the Agreement. Contact: the account owner's email address. Activities: use of the Service. Role: Controller, or Processor where Customer Processes Personal Data for its own clients.

Data importer: Nova Data & AI Limited, 3rd Floor Old Stock Exchange, St Nicholas Street, Bristol, BS1 1TG, United Kingdom. Contact: [email protected]. Activities: providing the Service. Role: Processor, or Subprocessor.

B. Description of the Processing

Categories of Data Subjects:

• Customer's Users.

• Customer's employees, contractors, customers, suppliers and other contacts whose Personal Data is in Customer Content.

Categories of Personal Data: The Service Processes the Personal Data Customer chooses to make available to it. This includes:

• content Customer creates or uploads, such as prompts, skills, files, documents, conversations, pipelines and their outputs; and

• Personal Data held in any system Customer connects, within the access Customer grants. Depending on the connection, this may include business records, customer and contact records, communications such as emails and messages, calendar entries, documents, financial and transaction records, and company and credit information.

Account, billing and contact details of Users are Processed by Provider as a Controller under its Privacy Notice and are not Customer Personal Data.

Special Category Data: None intended to be submitted to the Service, unless agreed in writing under Section 2.6. Systems Customer connects may contain Special Category Data, which the Service accesses or retrieves only as Customer directs and protects using the measures in Annex II.

Frequency of transfer: Continuous, while Customer uses the Service.

Nature and purpose of the Processing: Storing, retrieving, querying, transforming, summarising and analysing Customer Personal Data, including with AI models, to provide the Service as Customer directs.

Duration of the Processing: The term of the Agreement, then until deletion under Section 9.

C. Competent supervisory authority

For transfers subject to the UK GDPR: the Information Commissioner's Office. For transfers subject to the GDPR: the authority determined under Clause 13 of the EEA SCCs.

Annex II: Technical and organisational measures

Tenant separation: Each customer's data is held in a logically separate tenant. Access controls are applied to every request so that Users can only reach their own organisation's data, content that has been shared with them, and content made publicly available through the Service. Provider tests this separation regularly.

Encryption: Customer Personal Data is encrypted in transit over public networks and at rest. Credentials and access tokens for connected services are additionally encrypted using industry-standard encryption.

Network security: Production systems are not reachable from the internet except through the Service's public endpoints. Administrative access is restricted to a private, encrypted network.

Authentication and access: Users sign in with their own credentials. API and integration access uses scoped credentials that Customer can revoke at any time. Customer controls User roles, product access, and the permissions granted to AI agents and integrations.

Least privilege: Access to connected data sources is limited to what each feature needs, and is read-only wherever possible.

Secrets management: Application secrets are held in a dedicated secrets management system, not in source code.

Logging and monitoring: Security-relevant account and administrative events are logged. Integration logs exclude the content of customer records.

AI providers: Customer Content sent to AI providers is used to provide the Service, may be retained for a limited period for security and abuse monitoring, and is not used to train their models.

Backups: Backups are held in the European Union and kept for no more than 30 days.

Incident response: Investigation of Security Incidents begins promptly. Customer is notified without undue delay and within 48 hours of Provider becoming aware, with further information provided as it becomes available.

Personnel: Access to production data is limited to staff who need it, under confidentiality obligations.

Further detail on these measures is available to Customer on request, under confidentiality.

Annex III: Approved Subprocessors

The current list of Subprocessors, with each Subprocessor's location and purpose, is available to Customer on request to the Provider Privacy Contact. Customer approves the Subprocessors on that list as at the date it accepts the Agreement, and any later changes made under Section 4.2.