Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is incorporated into the Master Services Agreement between NEBULONS AI and the Customer and applies where NEBULONS AI processes Personal Data on behalf of the Customer in the course of providing the Services. In such cases the Customer acts as the data controller and NEBULONS AI acts as the data processor. This DPA is drafted to satisfy the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and, where applicable, Turkey's Personal Data Protection Law No. 6698 (KVKK).

NEBULONS AI will process Personal Data only on the documented instructions of the Customer and only for the specific purpose the Customer has requested, such as preparing a dataset, executing a fine-tuning run, or serving a deployed model. NEBULONS AI does not determine the purposes or means of processing and does not process Personal Data for its own account. NEBULONS AI informs the Customer without undue delay if it believes an instruction infringes applicable data protection law.

NEBULONS AI applies a zero-retention architecture to processing performed under this DPA. Personal Data submitted for an instructed operation exists only for the technical duration of that operation and is permanently deleted from active systems immediately upon completion. Residual copies existing in encrypted backups are permanently destroyed no later than thirty (30) days after the operation, when backups next rotate. NEBULONS AI does not maintain any long-term archive of Customer Personal Data and does not use it for analytics, profiling, logging of content, model improvement, or any purpose other than the Customer's instruction.

NEBULONS AI ensures that all persons authorised to process Personal Data are bound by strict confidentiality undertakings, receive regular data protection training, and access Personal Data only on a need-to-know basis under least-privilege controls. Technical measures include encryption in transit and at rest, network segmentation, audit logging of administrative access, and hardened, access-controlled infrastructure, as detailed in the Information Security Policy.

The Customer authorises NEBULONS AI to engage the sub-processors disclosed under the Sub-processor Policy, including the cloud infrastructure provider that hosts the Services. NEBULONS AI imposes data protection obligations on every sub-processor that are materially equivalent to those in this DPA, remains fully liable to the Customer for the performance of its sub-processors, and will notify the Customer of any intended addition or replacement of a sub-processor in time for the Customer to raise a reasonable objection.

Taking into account the nature of the processing, NEBULONS AI assists the Customer in fulfilling its obligations to respond to data subject requests to access, rectify, erase, restrict, or port their Personal Data, insofar as such data remains within NEBULONS AI systems. Because of the zero-retention architecture, in the majority of cases no Personal Data remains available to fulfil such requests after the instructed operation has completed, and NEBULONS AI will confirm this status promptly upon request.

NEBULONS AI assists the Customer in ensuring compliance with obligations relating to the security of processing and personal data breaches, as described in the Data Breach Incident Response Policy. NEBULONS AI notifies the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting Customer Personal Data.

Any transfers of Personal Data to a third country are safeguarded by appropriate measures such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, in cooperation with the Customer. Subject to the Customer's audit rights under the Master Services Agreement, NEBULONS AI makes available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of its independent security attestations.

On termination of the Services, or at any time upon the Customer's instruction, NEBULONS AI permanently deletes all Personal Data within its systems within the timelines set out in this DPA and, at the Customer's election, provides a written certification of deletion. The Customer may request the return of any data that the Customer has asked to persist beyond an operation only where such persistence has been explicitly configured and documented by the Customer.