Data Processing Agreement

This page summarises, in plain English, how Nexlyr Solutions Ltd processes personal data on behalf of customers of Nexlyr AI. A signed Data Processing Agreement covering these terms is available to business customers on request from contact@nexlyrai.uk. This summary is a draft pending solicitor review and does not replace the signed instrument.

Roles

For the material you upload and the decks you create, you (or your company) are the data controller and Nexlyr Solutions Ltd is the processor: we process that content only to provide the service you asked for, on your instructions, and for no other purpose. For your account details and billing we act as a controller in our own right, as described in the privacy policy.

What we process and why

The documents and text you provide are read to build your deck, then the uploaded files are deleted. Your decks, workspaces and anything you deliberately retain stay in your account until you delete them. We never use your content to train AI models, and our AI providers are bound by the same restriction under our agreements with them.

Confidentiality and security

Access to production data is restricted to the operator of the service and protected by the measures described on the security page, which forms the technical and organisational measures annex of the signed agreement.

Subprocessors

We use the providers listed on the subprocessors page, each under data processing terms with the UK and EU approved transfer safeguards. Signed-DPA customers can request advance notice of changes to that list and may object on reasonable data protection grounds.

International transfers

Storage is in the UK; some processing happens in the US and EU as set out on the data residency page, under the standard contractual clauses and the UK addendum.

Assistance, deletion and return

We assist with data subject requests that reach us and refer them to you where you are the controller. You can export your decks at any time (PowerPoint and web formats) and delete your account and its data yourself from the account page; on termination of a company agreement we delete the company's data on written instruction, subject to the retention detail in the privacy policy.

Breach notification

If we become aware of a personal data breach affecting your data we will notify you without undue delay with the information reasonably needed for your own reporting obligations.