Data Processing Agreement

_{Version 2.0 · Effective from 28 October 2026 for agreements signed on or after that date}

This DPA forms part of the Agreement between Nextail Labs, S.L.U. ("Nextail", the processor) and the customer (the controller) under the Nextail Terms and Conditions, and meets the requirements of Article 28 GDPR. It prevails over the other contract documents on the processing of personal data. It is updated during a Service Term only to follow changes in Data Protection Legislation or standard clauses adopted by a competent authority, with thirty (30) days' notice (T&Cs clause 9).

1. Details of the processing

Most Customer Data (sales, stock, product and store data) is not personal data and is covered by the T&Cs rather than this DPA.

2. Processor obligations

Nextail will:

1. Process personal data only on Customer's documented instructions, which are the Agreement and Customer's use of the Services, unless Applicable Laws require otherwise, in which case Nextail informs Customer first unless the law prohibits it.
2. Ensure that everyone authorised to process the personal data is bound by confidentiality.
3. Implement the technical and organisational measures in section 3.
4. Engage sub-processors only in accordance with section 4.
5. Assist Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations on security, breach notification, impact assessments and prior consultation. Assistance beyond the standard functionality of the Services is charged at Nextail's then-current rates.
6. Notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach, with the information Customer reasonably needs to meet its own notification obligations.
7. Delete or return personal data at the end of the Agreement in accordance with section 8.
8. Make available the information needed to demonstrate compliance with this DPA, and allow audits under section 6.

3. Security measures

Nextail maintains appropriate technical and organisational measures, which include: encryption of data in transit and at rest; role-based access control and multi-factor authentication for Nextail staff; logical separation of customer environments; regular backups with tested restoration; logging and monitoring of access; vulnerability management and patching; and staff security training. Nextail may update these measures, provided that the overall level of security is not reduced.

4. Sub-processors

Customer gives general authorisation for Nextail to engage the sub-processors in the list below. Nextail will notify Customer by email at least thirty (30) days before adding or replacing a sub-processor. Customer may object within that period on reasonable data protection grounds. If the parties cannot resolve the objection within a further thirty (30) days, Customer may terminate the affected Services by written notice, and Nextail will refund any prepaid Fees covering the period after termination. Nextail imposes data protection obligations on each sub-processor that are substantially similar to this DPA, and remains liable to Customer for their performance.

5. International transfers

Nextail will not transfer personal data outside the European Economic Area unless an adequacy decision applies or appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses. For customers in the United Kingdom, the UK International Data Transfer Addendum applies where required.

6. Audits

Nextail will answer Customer's reasonable security questionnaires once per Contract Year. Where that is not enough to demonstrate compliance, or a supervisory authority requires it, Customer may carry out an audit at its own cost, once per Contract Year, with at least thirty (30) days' notice, during business hours, through an independent auditor bound by confidentiality, and without access to other customers' data.

7. Liability

Each party's liability under this DPA is subject to the limitations of liability in the T&Cs, except where Data Protection Legislation does not allow them.

8. Return and deletion

On termination or expiry, Customer may request an export of Customer Data within thirty (30) days (T&Cs clause 3.4). After that period, Nextail deletes the personal data and any copies within 90 days, including from backups on their normal rotation, unless Applicable Laws require retention.

Sub-processor list

Last updated 28 October 2026

Previous versions