Data Processing Agreement (DPA)

NUEROFY DATA PROCESSING AGREEMENT

Effective Date: 08.10.26

This Data Processing Agreement (“DPA”) forms part of the agreement between First Health and Safety Ltd, trading as Nuerofy.com (“Nuerofy”, “Processor”) and the Customer (“Controller”) and applies where Nuerofy processes Personal Data on behalf of the Customer.

This DPA is incorporated into the Nuerofy Subscription Order Form and the Nuerofy Platform Terms and Conditions. Capitalised terms not defined here have the meanings given in the Platform Terms and Conditions.

1. Definitions

The terms “Controller”, “Processor”, “Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given to them under the UK GDPR.

“Applicable Data Protection Law” means all laws relating to privacy and data protection applicable to the processing of Personal Data, including the UK GDPR and the Data Protection Act 2018.

“Customer Personal Data” means Personal Data processed by Nuerofy on behalf of the Customer through the Platform.

“Sub-processor” means any third party engaged by Nuerofy to process Customer Personal Data in connection with the Services.

2. Roles of the Parties

The Customer acts as the Controller of Customer Personal Data.

Nuerofy acts as the Processor of Customer Personal Data.

The parties acknowledge that the Customer determines the purposes and means of processing Customer Personal Data.

3. Scope of Processing

Nuerofy shall process Customer Personal Data solely for the purpose of:

– providing the Platform and Services;
– hosting and storing Customer Data;
– delivering learning, compliance and training functionality;
– providing onboarding, training, support and maintenance services;
– delivering AI-powered Platform functionality, including course generation, translation, voiceover, video generation, assessments and reporting;
– performing reporting and analytics requested by the Customer.

Categories of Data Subjects may include employees, workers, contractors, temporary staff, learners, administrators, customers of the Customer and other individuals whose data is uploaded by the Customer.

Categories of Personal Data may include names, email addresses, telephone numbers, job titles, learning records, assessment results, training completion records, login activity, user account information and any other Personal Data uploaded by the Customer.

Special Category Data: the Customer should avoid uploading Special Category Data unless necessary and lawful. Where Special Category Data is processed, the Customer remains responsible for ensuring a lawful basis exists.

4. Processor Obligations

Nuerofy shall:

– process Personal Data only on documented instructions from the Customer, which include the Platform Terms and Conditions, the Subscription Order Form and the Customer’s use of the Platform;
– ensure personnel authorised to process Personal Data are subject to confidentiality obligations;
– implement appropriate technical and organisational measures to protect Personal Data;
– assist the Customer in complying with its obligations under Applicable Data Protection Law;
– notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data;
– maintain records of processing activities where required by law;
– inform the Customer if, in Nuerofy’s opinion, an instruction infringes Applicable Data Protection Law.

5. Security Measures

Nuerofy shall implement technical and organisational measures appropriate to the risks associated with processing Personal Data.

Such measures include:

– access controls;
– password protection;
– multi-factor authentication where available;
– encryption in transit;
– secure hosting infrastructure;
– backup procedures;
– monitoring and logging;
– vulnerability management;
– staff confidentiality obligations.

Nuerofy may update security measures from time to time provided such changes do not materially reduce the level of protection provided.

6. Sub-processors

The Customer authorises Nuerofy to engage Sub-processors to provide elements of the Services, including providers of cloud hosting, database services, AI services, video and voice generation services, email delivery, analytics and customer support.

Nuerofy shall:

– ensure appropriate contractual protections are in place with each Sub-processor;
– remain responsible for the acts and omissions of its Sub-processors in relation to Customer Personal Data.

The current list of approved Sub-processors is set out in Annex B and published at www.nuerofy.com/sub-processors. Nuerofy will give the Customer at least thirty (30) days’ notice of any new or replacement Sub-processor by updating that page. The Customer may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected part of the Services in accordance with the Platform Terms and Conditions.

7. AI Processing Services

Where the Customer uses AI-powered functionality within the Platform, Customer Content and Customer Personal Data may be processed by the AI service providers listed in Annex B acting as authorised Sub-processors.

Nuerofy shall take reasonable steps to ensure that such providers are subject to appropriate contractual, technical and organisational safeguards designed to protect Customer Data, and that Customer Content submitted through the Platform is not used by those providers to train their models.

Nuerofy does not use Customer Content submitted through the Platform to train AI models owned by Nuerofy unless expressly agreed with the Customer.

8. International Transfers

Customer Personal Data is hosted in the United Kingdom.

Certain Sub-processors, including AI service providers, may process Customer Personal Data outside the United Kingdom. Nuerofy shall not permit such transfers unless appropriate safeguards are in place, including UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism under Applicable Data Protection Law.

9. Data Subject Rights

Taking into account the nature of the processing, Nuerofy shall provide reasonable assistance to enable the Customer to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

The Customer remains responsible for responding to Data Subject requests. Where Nuerofy receives a request directly, it will refer the Data Subject to the Customer where it is able to identify them.

10. Personal Data Breaches

In the event of a Personal Data Breach affecting Customer Personal Data, Nuerofy shall:

– notify the Customer without undue delay after becoming aware of the breach;
– provide available information regarding the nature of the breach, the categories and approximate number of Data Subjects and records affected, and the measures taken;
– take reasonable steps to mitigate the effects of the breach;
– cooperate with the Customer in relation to any investigation or notification obligations.

11. Audits and Information

Upon reasonable written request, Nuerofy shall provide information reasonably necessary to demonstrate compliance with this DPA.

Any audit request must be reasonable in scope, be made no more than once in any twelve (12) month period unless required by a Supervisory Authority or following a Personal Data Breach, be conducted during normal business hours, avoid disruption to Nuerofy’s business operations, and not require disclosure of confidential information relating to other customers.

Existing certifications, policies and compliance documentation may be provided in place of on-site audits where appropriate.

12. Deletion and Return of Data

Upon termination of the Services, Nuerofy shall:

– make Customer Data available for export through the Platform for thirty (30) days; and
– delete Customer Personal Data following that period and the expiry of any applicable retention period, unless retention is required by law.

Backup systems may retain archived copies for a limited period in accordance with standard backup procedures, after which they are overwritten or deleted.

13. Liability

Liability under this DPA is subject to the limitations and exclusions contained in the Nuerofy Platform Terms and Conditions.

14. Order of Precedence

In the event of any conflict between this DPA and the Platform Terms and Conditions, this DPA prevails solely in relation to data protection matters.

15. Governing Law

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising from this DPA.

Annex A: Processing Details

Subject matter: provision of the Nuerofy learning, training, compliance and AI-powered platform.

Duration: for the duration of the Customer’s subscription and any applicable data retention period.

Nature of processing: collection, storage, hosting, organisation, retrieval, transmission, analysis, reporting and deletion of Personal Data.

Purpose of processing: provision of learning management, training delivery, compliance management, AI-assisted content creation, reporting, onboarding, support and related Platform functionality.

Categories of Data Subjects: employees, learners, contractors, temporary workers, administrators and Customer representatives.

Categories of Personal Data: names, contact details, job titles, user account data, training records, assessment records, compliance records and Platform usage information.

Special Category Data: only where uploaded or processed by the Customer and permitted under Applicable Data Protection Law.

Annex B: Approved Sub-processors

As at the Effective Date, approved Sub-processors are:

Provider: ANS Group Ltd
Purpose: Cloud hosting and infrastructure services
Location: United Kingdom

Provider: OpenAI
Purpose: Artificial intelligence services and content generation
Location: United States

Provider: Anthropic
Purpose: Artificial intelligence services and content generation
Location: United States

Provider: Pinecone Systems Inc.
Purpose: Vector database and AI retrieval services
Location: United States

Provider: [Synthesia Ltd / video and voice provider to be confirmed]
Purpose: AI avatar video, voiceover and translation services
Location: [to be confirmed]

Provider: Mailjet
Purpose: Transactional and platform email delivery
Location: European Union

Provider: Stripe
Purpose: Payment processing and subscription billing
Location: United States / European Union

Provider: Google Analytics
Purpose: Website analytics and usage monitoring
Location: United States

Nuerofy may update or replace Sub-processors from time to time in accordance with clause 6. The latest list is published at www.nuerofy.com/sub-processors.

Contact

If you have any questions about this DPA, please contact:

First Health and Safety Ltd trading as Nuerofy.com
Unit 1, Ryelands Business Centre, Ryelands Lane, Elmley Lovett, WR9 0PT
Company registration number: 06460846
Telephone: 01527 280 007
Email: Sales@nuerofy.com