Data Processing Agreement

This Data Processing Agreement (the “DPA”) sets out the terms on which Nexora processes personal data on behalf of a merchant, in accordance with Article 28 of Regulation (EU) 2016/679 (“GDPR”).

1. Definitions

“Personal Data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given by the GDPR.

“Merchant Data” means the Personal Data of End Customers, and of users of the Merchant’s websites, that Nexora processes on the Merchant’s behalf through the Platform.

“Sub-processor” means any processor engaged by Nexora to process Merchant Data.

“Standard Contractual Clauses” means the clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

2. Roles of the parties

2.1 For Merchant Data, the Merchant is the controller and Nexora is the processor. Where the Merchant itself acts as a processor for a third party, Nexora acts as its sub-processor and the Merchant warrants that it is authorised to engage Nexora.

2.2 Nexora acts as a separate controller for the data of the Merchant, its representatives and beneficial owners, and for the processing it carries out for platform security, fraud prevention across the Platform, invoicing and compliance with its legal obligations. That processing is described in the Privacy Policy and is outside the scope of this DPA.

2.3 The Payment Service Provider acts as a separate controller, or as the Merchant’s own service provider, for the payment services it provides directly to the Merchant under its own terms.

3. Details of the processing

Subject-matter	Provision of the Services: payment pages, API, Funnels, Shield, subscriptions and support.
Duration	The term of the Merchant Agreement, then the retention periods in section 11.
Nature and purpose	Hosting, transmission, display, logging, fraud screening, handling of refunds and disputes, support, and transmission to the Payment Service Provider, the Networks and the other Nexora Entities as needed to perform the Merchant Agreement.
Categories of data	Identification and contact data; order and Transaction data; technical identifiers (IP address, device, logs); any data the Merchant chooses to collect through the Platform.
Special categories	Not intended to be processed. The Merchant must not submit them unless strictly necessary and lawful.
Data subjects	End Customers and, where applicable, users of the Merchant’s websites.

4. Merchant’s instructions

4.1 Nexora processes Merchant Data only on the Merchant’s documented instructions, including for transfers outside the European Economic Area, unless Union or Member State law requires otherwise. In that case Nexora informs the Merchant before processing, unless the law forbids it.

4.2 The Merchant’s instructions consist of the Merchant Agreement, this DPA, the configuration of the Merchant Account and the actions carried out through the dashboard or the API.

4.3 Nexora informs the Merchant without delay if, in its opinion, an instruction infringes the GDPR or other data protection law. Nexora may suspend the instruction until the Merchant confirms or changes it.

5. Merchant’s obligations

The Merchant warrants that it has a legal basis for each processing activity, that it has informed End Customers as Articles 13 and 14 GDPR require, including about the use of Nexora and the Payment Service Provider, and that its instructions are lawful. It remains the point of contact for End Customers.

6. Confidentiality

Nexora ensures that the persons authorised to process Merchant Data are bound by a contractual or statutory duty of confidentiality and receive access only to the extent needed for their duties.

7. Security

7.1 Nexora implements the technical and organisational measures listed in Annex 1, which are appropriate to the risk within the meaning of Article 32 GDPR. Nexora may update them, provided the overall level of protection is not reduced.

7.2 The Merchant remains responsible for the security of its own systems, websites and credentials, and for PCI DSS compliance at the level applicable to its integration.

8. Sub-processors

8.1 The Merchant gives Nexora a general authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex 2.

8.2 Nexora informs the Merchant of any planned addition or replacement of a Sub-processor at least thirty (30) days in advance, by email or in the dashboard. This period may be shortened where the change is required urgently for security or continuity reasons, or is imposed by a Payment Service Provider, a Network or an authority.

8.3 The Merchant may object in writing on reasonable grounds relating to data protection within that period. The parties then seek a solution in good faith. Failing a solution, the Merchant may terminate the Merchant Agreement at no cost before the change takes effect.

8.4 Nexora imposes on each Sub-processor, by contract, data protection obligations equivalent to those of this DPA, and remains liable to the Merchant for the Sub-processor’s performance.

9. International transfers

9.1 Merchant Data is hosted in the European Union.

9.2 Where the processing involves a transfer to a country outside the European Economic Area that does not benefit from an adequacy decision, the transfer is made subject to appropriate safeguards within the meaning of Article 46 GDPR, in particular the Standard Contractual Clauses (Module Three, processor to processor, or the module applicable to the situation), with additional measures where necessary.

9.3 Where the Merchant is itself established outside the European Economic Area, the Standard Contractual Clauses (Module Four, processor to controller) apply to transfers of Merchant Data from Nexora to the Merchant and are incorporated by reference, with French law as governing law and the French courts as forum.

10. Assistance and personal data breaches

10.1 Data subject requests. Taking into account the nature of the processing, Nexora assists the Merchant by appropriate technical and organisational measures in answering requests from data subjects. Where Nexora receives a request directly, it forwards it to the Merchant without undue delay and does not answer it itself, unless the Merchant so instructs or the law requires it.

10.2 Compliance. Nexora provides reasonable assistance with data protection impact assessments and prior consultations of the supervisory authority that relate to the Services, having regard to the information available to it.

10.3 Personal data breach. Nexora notifies the Merchant without undue delay after becoming aware of a personal data breach affecting Merchant Data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information may be provided in stages. Nexora takes reasonable measures to contain and remedy the breach.

10.4 The Merchant is responsible for notifying the supervisory authority and the data subjects where the law requires it.

11. Deletion or return

11.1 At the end of the Services, and at the Merchant’s choice expressed within thirty (30) days, Nexora returns the Merchant Data available in the Platform in a commonly used format, or deletes it.

11.2 Failing instructions, Nexora deletes or anonymises Merchant Data at the end of the applicable retention periods, namely those set by Articles 5.6, 9.6, 19 and 20.6 of the Merchant Agreement.

11.3 Nexora may retain Merchant Data where Union or Member State law requires it, and the data it holds as a separate controller under section 2.2, in each case under the same confidentiality and security commitments.

12. Audits

12.1 Nexora makes available to the Merchant the information reasonably necessary to demonstrate compliance with Article 28 GDPR.

12.2 Where that information is not sufficient, the Merchant may carry out an audit, itself or through an independent auditor bound by confidentiality and not a competitor of Nexora, not more than once per year except after a confirmed personal data breach or at the request of a supervisory authority. The audit is subject to thirty (30) days’ written notice, takes place during business hours, is limited to the processing of Merchant Data and must not compromise the security of the Platform or the data of other customers.

12.3 Each party bears its own costs, unless the audit reveals a material breach attributable to Nexora.

13. Liability

Each party’s liability under this DPA is subject to the limits and exclusions of the Merchant Agreement, in particular its Articles 16 and 17. Nothing in this DPA limits the rights of data subjects or the liability of a party towards them under Article 82 GDPR.

14. Term, law and jurisdiction

This DPA takes effect with the Merchant Agreement and remains in force for as long as Nexora processes Merchant Data. It is governed by French law and subject to the jurisdiction clause of the Merchant Agreement, without prejudice to the provisions of the Standard Contractual Clauses where they apply.

Annex 1. Technical and organisational measures

Area	Measures
Encryption	Encryption in transit (TLS) of all exchanges with the Platform. Encryption at rest of recoverable secrets such as API keys and webhook signing secrets (AES-256).
Authentication	Passwords stored with a salted, memory-hard hashing algorithm (Argon2id). API secret keys verified against a hash, with any administrative reveal logged. Session cookies inaccessible to scripts.
Access control	Logical separation of each merchant’s data, with cross-account access rejected at application level. Staff access limited to what their duties require.
Environment separation	Strictly separate test and production environments and credentials.
Payment data	Card numbers and security codes are entered in components controlled by the Payment Service Provider and never reach Nexora’s servers.
Integrity	Protection of forms against cross-site request forgery. Outgoing webhooks signed (HMAC-SHA256) with a timestamp. Idempotency keys on creation requests.
Logging	Application and security logs, and an audit log of sensitive administrative actions.
Hosting	Hosting in the European Union with a provider that maintains its own physical and network security measures.
Incidents	Detection, handling and notification of security incidents under section 10.

Annex 2. Sub-processors

Sub-processor	Purpose	Location
OVH SAS	Hosting of the Platform and its databases	European Union
Nexora Financial Technologies Limited	Operation, support and administration of the Services	Ireland
Nexora Financial Technologies, LLC	Operation, support and administration of the Services	United States, under the Standard Contractual Clauses

The Payment Service Provider designated in Schedule 2 of the Merchant Agreement (Stripe, through the entity applicable to the Merchant’s country) receives Merchant Data to provide payment services directly to the Merchant, under the agreement the Merchant has entered into with it.

Questions about this DPA: [email protected].