Data Processing Agreement (DPA)

1. Definitions

• “Client Personal Data” means personal data Nebs-Creative processes on behalf of the Client under the Agreement.
• “Data Protection Laws” means the UK GDPR, Data Protection Act 2018 and, where applicable to the processing, EU GDPR, applicable US state privacy laws and other applicable privacy/data-protection laws, as amended or replaced.
• “EU SCCs” means the European Commission standard contractual clauses approved by Implementing Decision (EU) 2021/914.
• “Restricted Transfer” means a transfer that applicable Data Protection Laws would prohibit without an appropriate safeguard.
• “Sub-processor” means a third party or affiliate engaged by Nebs-Creative to process Client Personal Data.
• “Transfer Mechanism” means the UK International Data Transfer Agreement, UK Addendum to the EU SCCs, EU SCCs or another mechanism recognised by applicable Data Protection Laws.
• “Working Day” means Sunday to Thursday, excluding Bangladesh public holidays and any notified studio closure.

Controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given by the UK GDPR or the equivalent applicable legal terms.

2. Roles and scope

The Client is controller and Nebs-Creative is processor for Client Personal Data. If the Client is itself a processor for another controller, Nebs-Creative acts as sub-processor and the Client confirms it is authorised to give the instructions in this DPA. Annex 1 describes the processing. Each party remains an independent controller for ordinary business-contact data it processes for relationship administration.

3. Client responsibilities

• Ensure a lawful basis exists and required notices/consents have been provided for the processing.
• Provide only personal data reasonably needed for the services and use sample, anonymised or pseudonymised data where possible.
• Tell Nebs-Creative in writing before providing special-category, criminal-offence or children’s data.
• Ensure instructions given to Nebs-Creative comply with applicable Data Protection Laws.

4. Nebs-Creative obligations

• Process Client Personal Data only on documented client instructions, including instructions concerning international transfers, unless law requires otherwise.
• Inform the Client if an instruction appears to infringe applicable Data Protection Laws, to the extent legally permitted.
• Ensure authorised personnel are subject to confidentiality obligations.
• Maintain appropriate technical and organisational measures, including the measures described in Annex 2 once verified.
• Provide reasonable assistance with data-subject rights, security obligations, breaches, DPIAs and regulator consultation, taking account of the nature of the processing and information available.
• Make reasonable compliance information available and permit audits under clause 9.
• Not sell Client Personal Data or use it for Nebs-Creative’s own purposes, including training Nebs-Creative AI models.

5. Sub-processors

The Client gives general authorisation for the use of Sub-processors. Current Sub-processors must be listed in Annex 3. Nebs-Creative will provide at least 14 days’ notice of an intended addition or replacement. The Client may object on reasonable data-protection grounds. If the objection cannot reasonably be resolved, the Client may terminate the affected services and receive a refund of prepaid fees for services not performed. Nebs-Creative will impose substantially equivalent data-protection obligations on each Sub-processor and remains responsible to the Client for the Sub-processor’s performance of those obligations as provided by applicable law and the Agreement.

6. International transfers

The Client acknowledges that the Nebs-Creative team works from Bangladesh and that approved Sub-processors may process Client Personal Data in the locations stated in Annex 3. Each Restricted Transfer must be supported by a valid Transfer Mechanism or other lawful basis and, where required, an appropriate transfer risk assessment or equivalent assessment.

For UK Restricted Transfers made by Nebs-Creative to a recipient such as the Bangladesh studio entity or a Sub-processor, Nebs-Creative will use the applicable UK International Data Transfer Agreement, UK Addendum with the relevant EU SCC module, or another valid mechanism. For EEA transfers where the EU SCCs are required, the applicable controller-to-processor or processor-to-processor module will apply as appropriate. If mandatory transfer terms conflict with this DPA, the mandatory transfer terms prevail.

7. Personal data breaches

Nebs-Creative will notify the Client without undue delay and, under the current standard DPA, in any event within 48 hours after becoming aware of a personal-data breach affecting Client Personal Data. The notification will provide available information about the nature, scope, likely consequences and mitigation, with further information supplied as it becomes available. Nebs-Creative will take reasonable steps to contain and remediate the incident and cooperate with the Client. Unless law requires otherwise, Nebs-Creative will not notify a regulator or data subject on the Client’s behalf without the Client’s instruction.

8. Data-subject requests

If Nebs-Creative receives a request relating to Client Personal Data, it will forward the request to the Client within 5 Working Days and will not substantively respond except as authorised by the Client or required by law.

9. Audits and compliance information

Nebs-Creative will respond to reasonable compliance questionnaires normally once per year, with additional information following a relevant breach or regulator request where appropriate. If reasonable written information is insufficient to demonstrate compliance, the Client or an independent non-competitor auditor bound by confidentiality may conduct an audit under the notice, frequency, working-hour and non-disruption restrictions stated in the governing DPA. Each party bears its own audit costs unless the Agreement or applicable law requires otherwise.

10. Return and deletion

When the relevant services end, or earlier on written instruction, Nebs-Creative will at the Client’s choice return or delete Client Personal Data within 30 days and delete existing copies unless applicable law requires retention. Data remaining in routine backups is protected by this DPA until overwritten in the normal backup cycle. Written confirmation of deletion will be provided on request.

11. US state privacy terms

To the extent an applicable US state privacy law treats Nebs-Creative as a service provider, contractor or processor for Client Personal Data, Nebs-Creative will not sell or share that data as defined by the applicable law, retain/use/disclose it outside the permitted service relationship, or combine it with other personal data except as law permits. Nebs-Creative will provide the level of privacy protection required of its role and inform the Client if it can no longer meet those obligations. The Client may take reasonable steps required by applicable law to stop and remediate unauthorised use.

12. Liability, precedence and law

Liability under this DPA is subject to the liability terms in the Agreement to the extent Data Protection Laws permit. The DPA continues for as long as Nebs-Creative processes Client Personal Data and prevails over conflicting agreement terms on personal-data matters. The standard DPA is governed by the law of England and Wales, except where mandatory transfer clauses require another governing law or forum.

Annex 1 - Details of processing

Annex 2 - Technical and organisational measures

• MFA on accounts used to access Client Personal Data where the service supports it.
• Project-based access controls; access removal at project end; periodic access reviews.
• Individual user accounts; shared secrets kept in an approved encrypted password manager.
• Full-disk encryption, screen lock, supported operating systems, automatic security updates and anti-malware on devices used for client work, as required by internal policy.
• Client Personal Data stored only in approved tools; no removable media or personal-account storage unless specifically approved.
• Data minimisation and use of sample/anonymised/pseudonymised data where possible.
• Restricted-link/file sharing and encryption in transit; storage-provider encryption at rest where applicable.
• No Client Personal Data in AI tools except an approved tool with required safeguards/settings and client agreement.
• Team confidentiality/IP agreements and security/data-protection training.
• Prompt internal incident reporting and incident logging.
• Provider backup/recovery capabilities for approved cloud services.
• Return/deletion of Client Personal Data under the DPA retention rules.

Annex 3 - Sub-processors

Signature block (optional where a signed DPA is requested)