Data Processing Agreement

This agreement is between you (the Controller) and SP Business and Investment Group Ltd, which operates Nucle.OS (the Processor).

SP Business and Investment Group Ltd is a company registered in England and Wales under number 14790177, with its registered office at 86–90 Paul Street, London, EC2A 4NE.

It applies whenever we process personal data on your behalf, and it overrides anything inconsistent in our Terms of Service. No signature is required - using the product accepts it. If your organisation needs a countersigned copy on your own paper, email us.

Subject matter. Providing the Nucle.OS platform to you.

Duration. For as long as your workspace exists, plus the short period described under Deletion below.

Nature and purpose. Hosting, storing, organising, transmitting and displaying the data you put into the product, so the product works. We process only on your documented instructions - your use of the features is that instruction.

Categories of data subject: your staff and collaborators; your clients and their staff; your prospects; anyone whose details you record in the product.

Types of personal data: names, business email addresses, telephone numbers, job titles, employer, postal addresses, correspondence and meeting content, files you upload, time and billing records, and any other personal data you choose to enter into free-text fields.

Nucle.OS is not designed for special category data, criminal offence data, or payment card numbers, and you should not put them in it. If you need to, speak to us first.

We will:

• Process personal data only on your documented instructions, including for transfers, unless required otherwise by law - in which case we will tell you first unless the law forbids it.
• Tell you immediately if, in our opinion, an instruction from you breaks data protection law.
• Ensure that anyone authorised to process the data is under a duty of confidentiality.
• Implement appropriate technical and organisational security measures (see Security below).
• Not engage another processor without the notice described under Subprocessors, impose on each one data protection obligations no less protective than these, and remain liable to you for their performance.
• Help you respond to data subject requests, taking into account the nature of the processing.
• Help you with your obligations around security, breach notification and impact assessments.
• Delete or return personal data at the end of the agreement, as you choose.
• Make available the information needed to demonstrate compliance, and allow for and contribute to audits.

You give us general authorisation to use the subprocessors listed below. We will give you at least 30 days’ notice by email before adding or replacing one, and you may object on reasonable data protection grounds - in which case we will work with you to find a solution, or you may terminate.

An AI app that you or your users connect to Nucle.OS (such as Claude or ChatGPT, through our connector) is not our subprocessor. What it reads is disclosed on your instruction, to a recipient you chose, under your own agreement with its provider.

The AI assistant can run two ways, and the processing differs. On the included allowance, it runs on our own Anthropic account and Anthropic acts as our sub-processor for those requests. Where a workspace instead adds its own API key, the prompts for that provider are sent under your own contract with it, not ours, and that use stays governed by your agreement with the provider.

Your database and files are held in the European Union, and the application runs there too (Dublin). Pages are delivered through a global network, and several subprocessors are US-based.

Where personal data leaves the UK or EEA we rely on the UK–US Data Bridge for US sub-processors certified to it, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with appropriate supplementary measures. Data is encrypted in transit and at rest.

Where you are subject to the EU GDPR, this agreement applies to that processing too, references to the UK GDPR include the EU GDPR, and transfers from you to us rely on the European Commission’s adequacy decision for the United Kingdom. Onward transfers outside the UK and EEA use the EU Standard Contractual Clauses (processor to processor).

Concretely, and verifiable:

• Row-level security is enforced on every table in the database, so one workspace cannot read another’s records even if the application layer were bypassed.
• Credentials for connected third-party accounts are encrypted with AES-256-GCM before storage.
• Data is encrypted in transit (TLS) and at rest.
• Role-based access control within each workspace, with a per-action audit log.
• Rate limiting and account lockout on authentication to resist brute-force attempts.
• Production access is restricted to personnel who require it.

We hold no formal certification such as SOC 2 or ISO 27001 at this time, and we will not imply otherwise.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and within 72 hours of becoming aware, with the nature of the breach, the likely consequences, the measures taken, and a contact point.

Reporting to a supervisory authority and to affected individuals is your responsibility as controller. We will give you what you need to do it.

If a data subject contacts us directly about data we hold on your behalf, we will not respond substantively - we will refer them to you and let you know promptly.

We will help you fulfil requests for access, rectification, erasure, restriction, portability and objection, using the product’s export and deletion features and, where those do not reach, by hand.

You can delete individual records at any time; deleted items sit in Trash for 15 days and are then permanently removed, including the underlying files.

Email synced from a connected mailbox is deleted automatically 12 months after it was received, with any downloaded attachments. Disconnecting the mailbox removes all of it at once.

A workspace that stays paused (an ended trial or a cancelled subscription) for 12 months is deleted, after we email its owners and admins at least 30 days before.

Deleting your workspace removes its data from the service immediately, including stored files. Backup copies are deleted on a schedule: database backups within 8 days, and off-site backup copies of files within 30 days.

On termination you may export your data first. Tell us if you want certified deletion confirmation and we will provide it.

On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will provide the information reasonably necessary to demonstrate compliance with this agreement and contribute to an audit you or your appointed auditor conduct - subject to confidentiality and to not compromising other customers’ security.

Liability under this agreement is subject to the limits in our Terms of Service. Where this agreement and those terms conflict on the processing of personal data, this agreement prevails.