Data Processing Agreement
Data processing agreement for business clients
Last updated: March 13, 2026
1. Preamble
This DPA supplements the Terms and Conditions of the Nexus AI service, pursuant to Art. 28 GDPR and the CCPA.
2. Subject of Processing
- WhatsApp Business messages
- End user phone numbers
- Conversation content
- Conversation metadata
3. Purpose and Duration
Processing is carried out exclusively for the Nexus AI service and for the duration of the contract.
4. Obligations of the Processor (Bigei SRL)
- Process data only on documented Client instructions
- Ensure personnel confidentiality
- Implement appropriate measures (Art. 32 GDPR)
- Not engage sub-processors without authorization
- Assist with data subject requests
- Delete data at service end
- Demonstrate compliance
5. Sub-Processors
Currently authorized sub-processors:
| Sub-Processor |
Purpose |
Location |
| Meta Platforms |
WhatsApp Business API |
USA (DPF) |
| LLM Provider |
AI processing |
USA/EU (SCC) |
| Microsoft Azure |
Hosting |
EU |
6. International Transfers
Transfers are based on SCC, EU-US Data Privacy Framework, or adequacy decisions.
7. Security Measures
- TLS 1.3 and AES-256 encryption
- RBAC access control
- Monitoring and logging
- Encrypted backups
- Documented incident response
8. Data Breach
Client notification within 48 hours of discovery (Art. 33 GDPR).
9. CCPA — Service Provider
Bigei SRL acts as a "Service Provider" under the CCPA.
10. DPO Contact
For data protection matters: privacy@usenexus.im