Nexos Data Processing Addendum

Version 2026-07-18

This Data Processing Addendum ("DPA") supplements the Nexos Terms of Service (or the separate written agreement governing the Customer's use of the Service — together, the "Agreement") between the customer identified in the applicable order form or account ("Customer") and LUKA BJELICA PR FIDERAIT ZRENJANIN, Pariske komune 28, 23000 Zrenjanin, Republic of Serbia, PIB 115208742 ("Nexos").

This DPA takes effect when it is incorporated into the Agreement by an order form, an Enterprise agreement, or another written or electronic agreement between Customer and Nexos that references it. It reflects the parties' agreement on the processing of Customer Personal Data.

1. Definitions

• "Customer Personal Data" means personal data contained in Customer Content (as defined in the Terms) that Nexos processes on Customer's behalf.
• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, including (where applicable) the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, Serbia's Law on Personal Data Protection ("ZZPL"), and applicable US state privacy laws.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Nexos.
• "Subprocessor" means a third party engaged by Nexos to process Customer Personal Data on Customer's behalf.
• Terms such as "controller", "processor", "data subject", and "processing" have the meanings given in the GDPR.

2. Roles and scope of processing

• As between the parties, Customer is the controller (or a processor acting on behalf of its own controllers) and Nexos is a processor of Customer Personal Data.
• Nexos will process Customer Personal Data only on Customer's documented instructions, including as set out in the Agreement, this DPA, and Customer's use and configuration of the Service — unless required to do otherwise by law, in which case Nexos will inform Customer unless the law prohibits it.
• The subject matter, duration, nature and purpose of processing, and the categories of data subjects and personal data are described in Annex A.
• Customer is responsible for the accuracy and lawfulness of Customer Personal Data and for having a valid legal basis to submit it to the Service.

3. Shared responsibility — where data is processed

The Service schedules workloads onto compute nodes. What Nexos processes depends on how Customer configures its projects:

3.1 Private nodes (customer-operated hardware)

When a project is configured to run exclusively on private nodes — servers that Customer owns and operates — the following are processed on Customer's own hardware and never stored on Nexos infrastructure: source-code checkouts and git mirrors, build caches, built container images, running application containers, and application databases and their contents (including any personal data inside them). Customer is responsible for the physical security, disk handling, and disposal of that hardware.

3.2 What Nexos processes in every configuration

Even when all workloads run on private nodes, Nexos processes on its control plane:

• Account and workspace data — users, emails, team membership, roles, and audit logs.
• Configuration, including secrets — environment variables and connected-repository credentials, encrypted at rest with AES-256-GCM and decrypted transiently in control-plane memory when a deployment is dispatched to Customer's node.
• Deployment metadata — repository names, branch names, commit identifiers and messages, changed-file paths, and platform configuration files.
• Build logs — output of Customer's builds, stored to power the dashboard. Customer controls what its build tooling writes to the log.
• Traffic in transit — preview-URL HTTPS traffic terminates at the Nexos-operated edge before being forwarded to Customer's node over an encrypted tunnel; the same applies to custom domains routed through the platform.

3.3 Optional features that widen the scope

The following features are off unless Customer uses them, and each expands what Nexos stores or relays:

• Database seeds and backups — if uploaded, seed scripts and database dumps are stored (AES-256-GCM encrypted) on the Nexos control plane. Customers who do not want database contents to reach Nexos infrastructure should not upload seeds or backups.
• External TCP endpoints (*.tcp.nexos.rs) — if created, database and service wire traffic is relayed through Nexos infrastructure for the lifetime of the endpoint.

4. Confidentiality

Nexos ensures that persons it authorizes to process Customer Personal Data are bound by contractual or statutory obligations of confidentiality.

5. Security

Nexos implements and maintains the technical and organizational measures described in Annex B. Nexos may update those measures from time to time, provided the updates do not materially reduce the overall security of the Service.

6. Subprocessors

• Customer generally authorizes Nexos to engage the Subprocessors listed in Annex C.
• Nexos will give Customer at least 30 days' notice before adding or replacing a Subprocessor (by email to the workspace owner or by updating the list published on our security page with a dated change note).
• Customer may object on reasonable data-protection grounds within the notice period. The parties will work in good faith to resolve the objection; if it cannot be resolved, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
• Nexos imposes data-protection obligations on Subprocessors that are no less protective than this DPA and remains liable for their performance.

7. Security Incident notification

Nexos will notify Customer of a Security Incident without undue delay, and in any case within 72 hours of becoming aware of it. The notification will describe, to the extent known: the nature of the incident, the categories and approximate volume of data and data subjects concerned, the likely consequences, and the measures taken or proposed. Nexos will provide timely updates as the investigation progresses. Notification is not an acknowledgement of fault or liability.

8. Assistance

• If Nexos receives a request from a data subject relating to Customer Personal Data, it will redirect the requester to Customer and, taking into account the nature of the processing, assist Customer in fulfilling its obligation to respond.
• Nexos will provide reasonable assistance with Customer's obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of the processing and the information available to Nexos.

9. Audits and reviews

• Nexos will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to reasonable written security questionnaires (no more than once per 12 months) and the documentation published on the security page.
• Where that information is insufficient under Data Protection Laws, Customer may conduct (itself or through an independent auditor bound by confidentiality) an audit of Nexos's processing of Customer Personal Data: no more than once per 12 months, on at least 30 days' written notice, during business hours, without disrupting the Service, and at Customer's expense. Vendor-security reviews required for Customer's own compliance programs (for example SOC 2 vendor management) are handled under this section.

10. Deletion and return

Upon termination of the Agreement, Nexos will delete Customer Personal Data within 30 days (and from backups within 90 days), unless retention is required by law. Before termination, Customer can export configuration and data through the Service. Data on Customer's private nodes is under Customer's own control at all times and is unaffected by this section.

11. International transfers

Nexos's control plane is hosted in the European Union (see Annex C) and Nexos is established in Serbia. Where a transfer of Customer Personal Data requires safeguards under Data Protection Laws, the parties rely on adequacy decisions where available or incorporate the European Commission's Standard Contractual Clauses (controller-to-processor, Module Two, or processor-to-processor, Module Three, as applicable) into this DPA by reference, with Customer as data exporter and Nexos as data importer; Serbia's standard contractual clauses under the ZZPL apply to transfers governed by Serbian law.

12. Liability and precedence

• Each party's liability under this DPA is subject to the limitations of liability in the Agreement.
• In case of conflict, this DPA prevails over the Agreement and the Privacy Policy with respect to the processing of Customer Personal Data; executed Standard Contractual Clauses prevail over this DPA.
• This DPA is governed by the same law and jurisdiction as the Agreement.

Annex A — Details of processing

Annex B — Technical and organizational measures

• Encryption in transit: TLS for all external endpoints; WireGuard tunnels for node-to-node and control-plane-to-node traffic.
• Encryption at rest: AES-256-GCM for environment variables, secrets, repository access tokens, and uploaded database seeds/backups; the master key is held in the host environment, separate from the database.
• Credential protection: bcrypt password hashing; API keys stored hashed, with optional granular scopes, workspace pinning, and per-project pinning.
• Access control: role-based access control with per-member granular permissions; tenant isolation enforced on every API route; platform-administration actions restricted to super admins and recorded in an append-only audit log.
• Workload isolation: containerized workloads with cgroup-enforced CPU and memory limits; per-environment database namespacing.
• Operational security: daily backups of the control-plane database; infrastructure access restricted to authorized personnel with multi-factor authentication; deployment from a single audited repository.
• Shared-responsibility model for private nodes as described in Section 3.

Annex C — Subprocessors

Paddle.com Market Ltd (payments, merchant of record) processes payment data as an independent controller and is therefore not a Subprocessor; it is listed in the Privacy Policy for transparency.

Contact

LUKA BJELICA PR FIDERAIT ZRENJANIN
Pariske komune 28, 23000 Zrenjanin, Republic of Serbia
PIB: 115208742
legal@nexos.rs