15.Group Data Processing Agreement
Contracting entity: FIFTEEN NETWORK LTD (trading as 15.Group), Company Number 16147355
Registered office: 12 Hatherley Road, Sidcup, Kent, England, DA14 4DT
Data protection contact: info@15.group
This Data Processing Agreement (“DPA”) forms part of the agreement between FIFTEEN NETWORK LTD (“15.Group”) and the business customer identified in the applicable Order Form (“Customer”) where 15.Group processes Personal Data on behalf of the Customer in connection with the Services.
1. Parties and Scope
1.1 15.Group is FIFTEEN NETWORK LTD, Company Number 16147355, whose registered office is 12 Hatherley Road, Sidcup, Kent, England, DA14 4DT.
1.2 The Customer is the business or organisation identified in the applicable Order Form or other agreement for the Services.
1.3 This DPA applies where 15.Group processes Personal Data on behalf of the Customer. It forms part of the agreement governing the relevant Services.
1.4 The Services may include NEXUSS, ZEYL AI (formerly known as Project NEXX), Bridge and other 15.Group B2B software expressly identified in an Order Form. After this first reference, ZEYL AI (formerly known as Project NEXX) is referred to as ZEYL AI.
1.5 NEXMEE consumer services and NEMOSS hardware are outside the scope of this DPA unless expressly incorporated into an applicable agreement.
2. Definitions
“Applicable Data Protection Law” means the UK GDPR, the Data Protection Act 2018, applicable amendments including the Data (Use and Access) Act 2025, and other applicable UK data protection legislation.
“Controller”, “Processor”, “Personal Data”, “Personal Data Breach”, “Processing”, “Data Subject” and “Supervisory Authority” have the meanings given under Applicable Data Protection Law.
“Customer Data” means information submitted to, stored in, transmitted through or otherwise processed by the Services on behalf of the Customer.
“Services” means the software, SaaS, hosted, on-premise, AI-enabled and related services supplied under the applicable agreement.
“Sub-processor” means another processor engaged by 15.Group to process Personal Data on behalf of the Customer.
3. Roles of the Parties
3.1 The Customer acts as Controller and 15.Group acts as Processor where 15.Group processes Personal Data on the Customer’s behalf.
3.2 The Customer determines the purposes and essential means of that Processing. 15.Group will process Personal Data only on documented instructions from the Customer, unless UK law requires otherwise. Where legally permitted, 15.Group will inform the Customer of such legal requirement before Processing.
3.3 If 15.Group processes Personal Data for its own independent purposes, it may act as a separate Controller for that Processing and the processor provisions of this DPA will not apply to that independent Processing.
3.4 Nothing in this DPA relieves either party of its direct obligations under Applicable Data Protection Law.
4. Documented Instructions
4.1 The Customer instructs 15.Group to process Personal Data as reasonably necessary to provide, host, operate, secure, support, configure and integrate the Services and to perform authorised AI processing, workflows and actions configured or requested by the Customer.
4.2 The applicable agreement, Order Form, Customer administrator configuration, support request and other written instruction capable of being retained may constitute documented instructions.
4.3 15.Group will notify the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law.
5. Customer Responsibilities
The Customer will:
- The Customer will ensure its instructions comply with Applicable Data Protection Law.
- The Customer is responsible for establishing an appropriate lawful basis and providing required privacy information to Data Subjects.
- The Customer will ensure Personal Data supplied to 15.Group has been collected and disclosed lawfully.
- The Customer is responsible for configuring appropriate permissions, approvals and governance controls.
- The Customer is responsible for determining whether the Services are appropriate for the nature and sensitivity of the Personal Data it elects to process.
6. Details of Processing
The subject matter, duration, nature and purpose of Processing, categories of Personal Data, categories of Data Subjects, and the Customer’s rights and obligations are set out in Schedule 1. The applicable Order Form and Customer configuration may supplement Schedule 1.
7. Confidentiality
15.Group will ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations, receive access only where reasonably necessary for their duties, and process Personal Data only in accordance with this DPA and documented instructions.
8. Security
8.1 Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of Processing, and the risks to Data Subjects, 15.Group will implement appropriate technical and organisational measures designed to provide a level of security appropriate to the risk.
8.2 Measures may include access controls, authentication, encryption, network and infrastructure security, logging and monitoring, backup and recovery, vulnerability management, incident management, resilience, personnel controls and periodic testing and review, as appropriate to the relevant Service.
8.3 Schedule 2 describes the general categories of technical and organisational measures. Exact controls may vary according to Service and deployment architecture.
9. Customer-Controlled Security
Where security depends upon Customer-controlled systems, the Customer is responsible for appropriate security of those systems, including accounts, permissions, end-user devices, networks, firewalls, identity providers, Customer-managed keys, on-premise infrastructure, integrations and administrator configuration. 15.Group is not responsible under this DPA for a security failure caused solely by systems or infrastructure outside its control.
10. Sub-processors
10.1 The Customer grants 15.Group general written authorisation to engage Sub-processors to assist in providing the Services.
10.2 Approved Customer Sub-processors currently verified for the covered production environment are listed in Schedule 3.
10.3 15.Group will provide reasonable prior written notice of an intended addition or replacement of a Sub-processor that will process Customer Personal Data. The Customer may object on reasonable data-protection grounds within the notice period stated in that notice. The parties will work in good faith to resolve a valid objection.
10.4 15.Group will impose written data-protection obligations on each Sub-processor that provide an equivalent level of protection required by Article 28 for the relevant Processing.
10.5 15.Group remains responsible to the Customer for the performance of its Sub-processors’ applicable data-protection obligations.
11. International Transfers
11.1 15.Group will not make a restricted transfer of Personal Data unless the transfer is permitted under Applicable Data Protection Law.
11.2 Where required, 15.Group will use an appropriate transfer mechanism, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another lawful mechanism then available.
11.3 Where required by law, 15.Group will carry out or support an appropriate transfer risk assessment or equivalent assessment.
11.4 Schedule 3 records the primary processing locations known for the approved Customer Sub-processors listed there. Supplier support or ancillary processing may be subject to additional lawful transfer safeguards where applicable.
12. Data Subject Rights
Taking into account the nature of the Processing, 15.Group will provide reasonable assistance through appropriate technical and organisational measures to enable the Customer to respond to requests from Data Subjects exercising their rights. Where 15.Group receives a request relating solely to Personal Data processed on behalf of the Customer, 15.Group will normally refer it to the Customer unless legally required to respond directly.
13. Personal Data Breaches
13.1 15.Group will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on the Customer’s behalf.
13.2 15.Group will provide information reasonably available to it to assist the Customer with its applicable breach obligations. Information may be supplied in phases where it is not immediately available.
13.3 15.Group will take reasonable steps to investigate, contain and remediate the incident within areas under its control.
13.4 Where the Customer acts as Controller, the Customer remains responsible for determining whether notification to the ICO, another Supervisory Authority or affected Data Subjects is required.
14. DPIAs and Regulatory Assistance
Taking into account the nature of Processing and the information available to it, 15.Group will provide reasonable assistance to the Customer with security obligations, Personal Data Breach obligations, Data Protection Impact Assessments and prior consultation with a Supervisory Authority where required by Applicable Data Protection Law.
15. Artificial Intelligence Processing
15.1 Where Customer Personal Data is processed using ZEYL AI or other AI-enabled Services, that Processing remains subject to this DPA.
15.2 AI Processing may include analysis, classification, summarisation, content generation, recommendations, workflow generation, retrieval, contextual assistance, approval-based actions and autonomous actions expressly enabled by the Customer.
15.3 The Customer is responsible for configuring appropriate permissions, human oversight and governance for its use of AI-enabled functionality.
16. AI Model Training
16.1 Unless expressly agreed by the Customer in writing, 15.Group will not use Customer Personal Data to train general-purpose or shared AI models for the benefit of other customers.
16.2 This restriction does not prevent Processing necessary to provide AI functionality requested by the Customer, maintain security, diagnose technical problems, provide support or otherwise perform documented instructions.
16.3 Any third-party AI provider that processes Customer Personal Data on behalf of 15.Group must be treated in accordance with the Sub-processor and international-transfer requirements of this DPA.
17. Data Minimisation and Retention
17.1 15.Group will process Personal Data only to the extent reasonably necessary to perform the Services and documented instructions.
17.2 The Customer is responsible for determining what Personal Data its users submit to the Services and should avoid submitting data unnecessary for the relevant purpose.
17.3 Personal Data will be retained for the duration reasonably necessary to provide the Services and fulfil documented instructions, subject to agreed retention settings, backup cycles, security requirements and applicable law.
18. Return and Deletion
18.1 On expiry or termination of the relevant Services, and at the Customer’s choice, 15.Group will delete or return Personal Data processed on the Customer’s behalf and delete existing copies unless Applicable Data Protection Law requires continued storage.
18.2 Where immediate deletion from backup systems is not technically practicable, Personal Data may remain in protected backups until deletion through the normal backup lifecycle, provided it is placed beyond ordinary use and remains protected.
19. Audits and Compliance Information
19.1 15.Group will make available information reasonably necessary to demonstrate compliance with its obligations under Article 28 of the UK GDPR.
19.2 Where reasonably necessary, 15.Group will permit and contribute to audits or inspections conducted by the Customer or an appropriately qualified independent auditor appointed by the Customer.
19.3 Except where urgent regulatory circumstances require otherwise, audits must be on reasonable prior notice, during normal business hours, limited to relevant systems and records, avoid unreasonable disruption, protect other customers’ confidentiality and comply with reasonable security requirements.
19.4 Independent audit reports, certifications or equivalent evidence may be used to satisfy reasonable audit requirements before an on-site inspection is considered where appropriate.
20. Records
15.Group will maintain records of Processing activities where required by Applicable Data Protection Law. The Customer will provide information reasonably required for 15.Group to maintain accurate records relating to the Customer’s Processing.
21. Government and Regulatory Requests
Where legally permitted, 15.Group will notify the Customer if it receives a legally binding request from a public authority requiring disclosure of Personal Data processed on the Customer’s behalf. 15.Group will disclose only the Personal Data it is legally required to disclose.
22. Liability
Liability arising under this DPA is subject to the exclusions and limitations of liability in the applicable Software / SaaS Terms & Conditions or other governing agreement, except to the extent liability cannot lawfully be excluded or limited. Nothing in this DPA relieves either party of liability imposed directly upon it by Applicable Data Protection Law.
23. Term
This DPA takes effect when 15.Group begins Processing Personal Data on behalf of the Customer and continues for as long as such Processing continues. Provisions intended by their nature to survive termination, including confidentiality and obligations concerning retained Personal Data, continue for as long as applicable.
24. Order of Precedence
If this DPA conflicts with general provisions of the governing agreement concerning Processing of Personal Data, this DPA takes precedence for that Processing. An Order Form may supplement Processing details but may not reduce protections required by Applicable Data Protection Law. Mandatory provisions of an applicable international transfer mechanism prevail to the extent necessary for the relevant transfer.
25. Changes in Data Protection Law
The parties will cooperate in good faith to make amendments reasonably necessary to maintain compliance following a material change in Applicable Data Protection Law or applicable regulatory requirements.
26. Governing Law and Jurisdiction
This DPA and any non-contractual obligations arising from it are governed by the laws of England and Wales. Subject to mandatory regulatory jurisdiction under Applicable Data Protection Law, the courts of England and Wales have exclusive jurisdiction.
27. Contact
Data-protection enquiries concerning this DPA may be sent to FIFTEEN NETWORK LTD at its registered office or to info@15.group.
Schedule 1 – Details of Processing
Subject Matter: Processing of Personal Data in connection with the provision, hosting, operation, support, configuration, integration and use of 15.Group business software and related Services.
Duration: For the duration of the applicable Services and any limited period afterwards required for return, deletion, backup lifecycle, security, dispute resolution or compliance with applicable law.
Nature of Processing: Collection, recording, organisation, structuring, storage, retrieval, consultation, analysis, classification, transmission, integration, matching, modification, AI-assisted Processing, generation of outputs, workflow Processing, approval-based actions, authorised autonomous actions, restriction, export, backup and deletion, depending on the Services selected.
Purpose of Processing: To provide, operate, secure, support and maintain the Services purchased or configured by the Customer and to perform documented Customer instructions.
Frequency: Continuous or intermittent according to the Customer’s use and configuration of the Services.
Categories of Data Subjects
- Customer employees and workers
- Contractors
- Job applicants
- Customers and prospective customers
- Suppliers and business contacts
- Partners
- Website or service users
- Other individuals whose Personal Data the Customer lawfully processes through the Services
Types of Personal Data
- Names and business contact information
- Email addresses and telephone numbers
- Job titles, employer and organisational information
- Account identifiers, user IDs and authentication/access information
- Employment and recruitment information
- Communications and CRM records
- Customer-service and workflow information
- Documents and files
- Transaction-related business information
- Device and technical information
- Usage records, audit logs and IP addresses
- Location information where enabled
- AI prompts and inputs
- AI outputs containing Personal Data
- Other Personal Data submitted or generated through authorised use of the Services
Special Category Personal Data: The Services are not intended to require Special Category Personal Data by default. Where the Customer elects to process such data, the Customer is responsible for ensuring the Processing is lawful and appropriate and for satisfying any additional requirements. Where a deployment routinely requires such data, additional safeguards may be documented in the Order Form or Processing schedule.
Criminal Offence Data: The Customer must not process criminal offence data through the Services unless the Processing is lawful, appropriate for the relevant Service and supported by any additional safeguards required by Applicable Data Protection Law.
Controller Rights and Obligations: The Customer retains control over the purposes of Processing and its documented instructions, subject to Applicable Data Protection Law and the applicable agreement.
Schedule 2 – Technical and Organisational Measures
The exact controls may vary according to the relevant Service and deployment architecture. 15.Group’s measures may include, as appropriate:
- Access Control: role-based access, authentication controls, least-privilege principles and administrative access restrictions.
- Encryption: encryption in transit and, where appropriate, encryption at rest.
- Infrastructure Security: network controls, environment separation, secure configuration and infrastructure protection.
- Application Security: secure development practices, vulnerability management, software updates and security testing appropriate to the Service.
- Logging and Monitoring: operational logging, security monitoring, audit information and incident detection appropriate to the Service.
- Resilience: backup, recovery, availability and business-continuity controls appropriate to the deployment.
- Personnel Security: confidentiality obligations, access controls and appropriate security awareness.
- Incident Management: processes for identification, investigation, containment, remediation and notification of relevant security incidents.
- Data Management: retention, deletion, access and backup controls appropriate to the relevant Processing.
- Supplier Management: appropriate due diligence and contractual data-protection requirements for relevant Sub-processors.
- Testing and Review: periodic assessment and improvement of technical and organisational controls appropriate to risk.
Schedule 3 – Approved Customer Sub-processors
The following provider is verified as a Customer Sub-processor in the current production inventory supplied to 15.Group legal/compliance review.
Sub-processor: Hetzner Online GmbH
Service: Dedicated servers, cloud servers and database hosting infrastructure
Products: NEXUSS, ZEYL AI, Bridge
Data / Processing: Application data, user inputs, database contents, system/application logs and associated billing metadata
Primary Location: Germany (Falkenstein, Nuremberg) and Finland (Helsinki); support access stated as Germany
Transfer Position: Primary processing is EEA-native. Any additional restricted transfer must comply with Clause 11.
The underlying verified inventory identifies Hetzner Online GmbH as the Customer Sub-processor processing end-user data on behalf of 15.Group for NEXUSS, ZEYL AI and Bridge.
OVH Hosting Ltd / OVHcloud is not listed above as an approved Customer Sub-processor at this stage because the supplied production inventory classifies it as Core 15.Group infrastructure and expressly leaves its final classification dependent on confirmation of whether customer/end-user data is present. If that classification changes, Schedule 3 should be updated before relying on this schedule for the affected Processing.
Schedule 4 – Infrastructure and Sub-processor Register Notes
- The supplied production inventory identifies Hetzner Online GmbH as the verified Customer Sub-processor for NEXUSS, ZEYL AI and Bridge.
- The supplied inventory identifies OVH Hosting Ltd / OVHcloud as hosting Core 15.Group infrastructure, with final Customer Sub-processor classification still requiring internal confirmation.
- Authentication/identity, email/notifications, analytics, customer support/ticketing, CRM/sales, payments/billing, file extraction/document processing, and source-code hosting/deployment were not mapped in the supplied inventory and should be added to the register only after internal verification.
- 15.Group should keep the public/customer-facing Sub-processor List and internal Record of Processing Activities under periodic review as providers or processing arrangements change.
