Legal · Data Processing Agreement

Data Processing Agreement.

The template every enterprise scope attaches by reference. A countersigned version is signed per engagement; this page is the published baseline. A countersigned copy from legal@nexxorex.com.

Last updated · November 2026Governing law · Bangladesh

Roles

You, the customer, are the data controller. You decide the purposes of processing and the lawful basis.
Nexxorex is the data processor. We process the personal data you make available to the engine, only for the purposes written in the signed scope and this DPA.
Sub-processors are listed in the scope. Each is bound by a written agreement at least as protective of the data subject as this DPA.

What we process

Caller phone numbers and voice recordings during a conversation.
Message text, images and attachments the caller sends on chat channels.
Identifiers the engine resolves against your core system (customer number, policy number, order number).
Metadata produced by the engine during a call (timestamps, intent classification, outcome).
No special categories of data (health, biometric, political opinion, religious belief) are processed unless the scope explicitly provides a lawful basis.

Purpose and legal basis

The engine processes data only to perform the service described in the scope and to generate the audit record that the service produces as a by-product.
The lawful basis is the contract between you and the data subject (where the subject is your customer), or your legitimate interest in operating the service, as declared in the scope.

Confidentiality and access

Every person on our side with access to your data is bound by a written confidentiality obligation that survives termination.
Access is role-based and least-privileged. The audit log records every production-data access by our staff.
Deployment in your own data centre, where the scope requires it, means Nexxorex staff have no routine access to the production data at all.

Sub-processors

The scope lists the sub-processors used for your deployment, with the processing each one performs. Material changes to the list are notified in writing with at least 30 days of advance notice; you may object in that window.
If an objection cannot be resolved by proposing an alternative sub-processor, you may terminate the affected part of the engagement with pro-rated refund of pre-paid fees for the undelivered scope.

Security

Encryption in transit (TLS 1.2+) and at rest (AES-256). Secrets held in a secrets manager, never in source control.
Append-only audit log at the database level, not in application code, so a developer cannot erase a record of what the engine did.
Separate production, staging and development environments. Production data never flows to staging or development.
Annual penetration test by an independent third party, with findings written into a remediation ticket queue that you may audit.

Data subject requests

Access, correction, deletion and export requests reach you directly, because you are the controller. We assist you with technical measures inside five business days of your written forwarding.
Deletion from the primary store is immediate on your written instruction. Deletion from backups follows the backup rotation schedule written in the scope and is complete within the stated window.

Breach notification

A security incident that compromises or risks compromising your data is notified in writing within 72 hours of our confirmation of it, with the facts we know at that point and the facts we are still establishing.
A root-cause report follows inside ten business days, with the remediation already in place and the preventive measures scheduled.

Return and deletion on termination

On termination, your data is exported to you in a documented format within fifteen business days of your written request.
After the export is acknowledged, our copies are deleted inside thirty days, including from backups once the backup rotation reaches them. A written certificate of deletion is issued on request.

Governing law and jurisdiction

This DPA is governed by the laws of Bangladesh, including the Information & Communication Technology Act 2006, the Digital Security Act 2018, and the Personal Data Protection Act 2023 once it takes effect.
Disputes are resolved in the courts of Dhaka.