Article 28 Compliance & Mandatory Processor Obligations
OPERATIVE STATUTORY DPA CONTRACT: This Data Processing Agreement ("DPA") governs all processing of personal data conducted by NexGen Business Hub CIC on behalf of the Customer. This DPA is incorporated into the Master SaaS Terms of Service and satisfies the statutory mandates of Article 28 of the UK General Data Protection Regulation (UK GDPR).
Legal Framework and Processor Role
Customer as Data Controller: The Customer acts as the Data Controller in respect of personal data submitted to the Platform.
Company as Data Processor: NexGen Business Hub CIC acts as the Data Processor, processing personal data solely on behalf of and in accordance with the documented instructions of the Data Controller.
MANDATORY PROCESSOR OBLIGATIONS (ART. 28)
1. Process ONLY on documented instructions from the Controller.
2. Enforce strict confidentiality obligations across all authorized personnel.
3. Assist the Controller with data subject rights requests.
4. Support security, incident handling, and DPIA compliance requirements.
Enforceable Processor Obligations
Pursuant to Article 28(3) of the UK GDPR, NexGen Business Hub CIC legally binds itself to:
Documented Processing Instructions: Process personal data strictly on documented legal instructions from the Controller—including regarding cross-border data transfers—unless required to process by applicable UK law to which the Processor is subject;
Personnel Confidentiality: Ensure that all employees, contractors, and authorized personnel handling personal data have executed binding confidentiality obligations or are under an appropriate statutory duty of confidentiality;
Assistance with Rights Requests: Implement appropriate technical and organizational measures to assist the Controller in fulfilling its statutory obligation to respond to data subject rights requests under Chapter III of the UK GDPR; and
Security, Breach & DPIA Assistance: Assist the Controller in ensuring compliance with security obligations (Art. 32), data breach notifications (Arts. 33–34), Data Protection Impact Assessments (Art. 35), and prior ICO consultations (Art. 36).
Technical & Organisational Security Measures (TOMs) & Breach Notification
OPERATIVE INFRASTRUCTURE CONTROLS: Protecting Controller personal data requires mandatory technical safeguards, identity governance, and strict incident response timelines.
Technical and Organisational Security Measures (TOMs)
The Processor enforces and maintains the following technical security controls:
TECHNICAL SECURITY SAFEGUARDS (TOMs)
ENCRYPTION AT REST | AES-256 standard encryption across all databases.
ENCRYPTION IN TRANSIT | TLS 1.3 cryptographic protocols for API & Web traffic.
ACCESS CONTROLS | Strict Role-Based Access Control (RBAC) mechanisms.
IDENTITY VERIFICATION | Mandatory Multi-Factor Authentication (MFA) on accounts.
Cryptographic Standards:
Encryption at Rest: All database volumes, cloud storage buckets, and backup archives are encrypted using AES-256 standards.
Encryption in Transit: Web application traffic and external API integrations are secured using TLS 1.3 transport-layer encryption.
Access Control Protocols: Administrative access is restricted via Role-Based Access Control (RBAC) and enforced through mandatory Multi-Factor Authentication (MFA).
Operational Resilience: Regular vulnerability scanning, automated security patch cycles, and daily encrypted data backups maintain ongoing resilience.
48-Hour Data Breach Notification SLA
Notification Mandate: The Processor shall notify the Controller without undue delay, and in any event no later than forty-eight (48) hours, after becoming aware of a confirmed personal data breach impacting Controller data.
Notification Details: The breach notification delivered to the Controller shall include:
A description of the nature of the breach, including affected data categories and estimated numbers of data subjects;
Contact details for the compliance officer managing the incident;
Likely consequences and potential risks to data subjects; and
Remediation measures taken or planned by the Processor to mitigate adverse impacts.
Approved Sub-Processor Directory & Governance Mechanics
SUB-PROCESSOR AUTHORIZATION: Pursuant to Article 28(2) of the UK GDPR, the Controller provides general written authorization for the Processor to engage the sub-processors listed in the directory below.
Pre-Approved Sub-Processor Directory
Sub-Processor Name
Processing Purpose & Activity
Infrastructure Location
Transfer Instruments & Guarantees
Amazon Web Services (AWS)
Cloud Application Hosting & Database Storage
UK / London Region (eu-west-2)
Sovereign UK Data Residency; ISO 27001 / SOC 2 Certified
Stripe
Subscription Billing & Payment Gateway
UK / International
UK Adequacy Rules / Approved Transfer Safeguards
OpenAI OpCo, LLC
Algorithmic AI Processing via API
United States (US)
Secured via UK IDTA; Zero Model Retraining Guarantee
Anthropic PBC
Algorithmic AI Processing via API
United States (US)
Secured via UK IDTA; Zero Model Retraining Guarantee
Sub-Processor Change Mechanics
Advance Modification Notice: The Processor shall provide the Controller with at least thirty (30) days' advance notice prior to adding or replacing any sub-processor within the directory.
Right to Object: The Controller maintains the right to object to the appointment of a new sub-processor on reasonable data protection grounds by delivering written notice to the Processor within fourteen (14) days of receiving notification.
Resolution Protocols: Upon receipt of a valid objection, the Processor shall endeavor to recommend an alternative operational configuration that avoids utilizing the objected sub-processor. If no commercially reasonable alternative exists, either party may terminate the affected platform services without contractual penalty.
Audit Rights, Data Return/Erasure, & Schedule 1 Processing Details
AUDIT PROCEDURES AND DATA TERMINATION: Clear verification rights and formal data scrubbing workflows govern contract expiration and termination.
Verification and Audit Mechanics
Compliance Certification: To demonstrate compliance with Article 28, the Processor shall, upon written request, provide the Controller with independent audit summaries, SOC 2 assessment reports, or ISO certifications.
On-Site Audits: Physical facility inspections or direct security audits are reserved strictly for confirmed material security breach events or where mandated by the ICO. On-site audits require at least thirty (30) business days' prior written notice and must occur during regular business hours without disrupting ongoing operations.
Post-Termination Data Erasure Protocol
Within thirty (30) days following termination or expiration of the SaaS Agreement, NexGen Business Hub CIC shall:
Permanently erase or securely return to the Controller all personal data processed under this DPA; and
Scrub existing backup copies, except where retention is required by applicable law of the United Kingdom (such as statutory financial retention mandates under the CAICE Act 2004 or HMRC tax rules).
Schedule 1: Processing Details
This Schedule specifies the operational details of processing personal data as required by UK GDPR Article 28(3):
1. Subject Matter of Processing: The delivery of B2B SaaS platform capabilities, business advice functionality, cloud utility tools, and professional consulting services to the Data Controller by NexGen Business Hub CIC.
2. Duration of Processing: The term of the active SaaS Agreement, plus the thirty (30) day post-termination window required to complete secure data erasure, subject to statutory legal retention requirements under UK law.
3. Nature and Purpose of Processing: Hosting, storing, compute execution, transmission, algorithmic processing via encrypted APIs, analytics telemetry, and deletion of personal data to deliver core software functions to the Data Controller.
4. Categories of Personal Data:
Account credentials and user identification (full name, business email address, job title).
Invoicing metadata, corporate business addresses, and transaction histories.
Operational business inputs, administrative notes, uploaded files, and prompt queries.
Platform system telemetry (IP addresses, browser user-agent strings, system diagnostic logs).
5. Categories of Data Subjects: Employees, directors, contractors, administrative staff, end-users, and business partners associated with the Data Controller.
Formal Statutory Execution Confirmation
This policy portfolio constitutes the entire legal governance framework binding NexGen Business Hub CIC and the Customer across Master SaaS Terms, Privacy Standards, Cookie Usage, and Data Processing Obligations.
Corporate Legal Identity: NexGen Business Hub CIC
Statutory Framework: Companies Act 2006 | Companies (Audit, Investigations and Community Enterprise) Act 2004 | Community Interest Company Regulations 2005
Regulatory Oversight: Registered in England and Wales; Regulated by the Office of the Regulator of Community Interest Companies (Form CIC34 Public Record Alignment).
Operative Effect: Binding upon account registration, portal login, or commercial subscription execution.