Data Processing Agreement
Last updated:27th September 2026
This Data Processing Agreement (DPA) forms part of the Terms of Service between NEXXAA LIMITED (company number 16762606) (Nexxaa, the Processor) and the customer (the Controller). It applies where Nexxaa processes personal data on the Controller’s behalf in providing DWT Direct and the OpCheck platform (the Service). Terms such as personal data, processing, controller, processor and personal data breach have the meanings given in the UK GDPR and the Data Protection Act 2018 (together, Data Protection Law).
1. Roles
1.1 For personal data in Customer Data, the Controller is the controller and Nexxaa is the processor.
1.2 Nexxaa is a separate controller for account, billing and relationship data about the Controller’s staff (for example, names and contact details of account users). That processing is described in our Privacy Policy.
2. Details of processing
| Subject matter and purpose | Providing the Service: recording waste movements and related operational compliance records, validating them, submitting them to the UK Digital Waste Tracking service on the Controller’s instruction, storing responses, and providing fleet, driver and licence compliance functions where subscribed. |
|---|---|
| Duration | The term of the subscription plus the 30-day export period in the Terms of Service, then deletion unless the law requires retention. |
| Nature of processing | Collection, recording, storage, organisation, retrieval, validation, transmission to the Digital Waste Tracking service, and deletion. |
| Categories of data subjects | Controller’s staff and drivers; employees and contacts of waste producers, carriers, brokers and receiving sites named in records. |
| Types of personal data | Names, business contact details, job roles, signatures where captured, vehicle registration numbers linked to individuals, and, for Licence and Driver modules, driving licence details and entitlements. |
| Special category data | None expected. The Controller must not enter special category or criminal offence data except where a Service feature is designed for it and the Controller has a lawful basis. |
3. Nexxaa’s obligations
Nexxaa will:
- process personal data only on the Controller’s documented instructions, which are the Terms of Service, this DPA and the Controller’s use of the Service, unless required by law (in which case Nexxaa will tell the Controller first, unless the law prohibits it). Nexxaa will tell the Controller if it believes an instruction breaches Data Protection Law;
- make sure everyone authorised to process the personal data is bound by confidentiality;
- apply the technical and organisational measures in Annex A;
- engage sub-processors only in accordance with section 4;
- help the Controller, taking into account the nature of the processing, respond to requests from individuals exercising their data protection rights;
- help the Controller meet its obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the information available to Nexxaa;
- at the end of the Service, delete or return the personal data at the Controller’s choice, and delete existing copies unless the law requires storage;
- make available information needed to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, by the Controller or an auditor it appoints, on reasonable notice of at least 30 days, no more than once a year (unless following a personal data breach or regulator request), and subject to confidentiality.
4. Sub-processors
4.1 The Controller gives general authorisation for Nexxaa to use the sub-processors listed in Annex B.
4.2 Nexxaa will give at least 30 days’ notice by email before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected Service and receive a refund of prepaid fees for the unused period.
4.3 Nexxaa will impose data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable for their performance.
5. Personal data breaches
5.1 Nexxaa will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will include the information then available about the nature of the breach, the likely consequences and the measures taken or proposed. Nexxaa will provide further information as it becomes available.
6. International transfers
6.1 Nexxaa will not transfer personal data outside the UK, or allow a sub-processor to do so, unless the transfer is to a country covered by UK adequacy regulations or is protected by an appropriate safeguard under Data Protection Law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. Controller’s obligations
7.1 The Controller is responsible for having a lawful basis for the processing, for providing any required privacy information to individuals, and for the accuracy of Customer Data.
8. Liability and precedence
8.1 Liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not permit this. If this DPA conflicts with the Terms of Service on data protection matters, this DPA takes priority.
Annex A: Security measures
- Encryption of data in transit using TLS.
- Customer data logically separated by account, with access restricted to authorised users of that account.
- Role-based access for Nexxaa staff, limited to what is needed to provide support and operate the Service.
- Multi-factor authentication on admin and hosting acccounts
- Daily backups kept for 7 days
- Validation of records before submission to the Digital Waste Tracking service.
- A documented process for responding to security incidents and personal data breaches.