数据处理协议.

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you (the “Customer”) and NeuraHive Ltd, a company registered in England and Wales (company no. 16640783), registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom (“NeuraHive”). It applies when NeuraHive processes personal data on your behalf: mainly data about visitors to websites you publish with NeuraHive, such as form submissions, enquiries and website analytics (“Customer Personal Data”).

For Customer Personal Data you are the controller (or a “business” under US state laws) and NeuraHive is your processor (or “service provider”). It meets Article 28 of the UK GDPR and EU GDPR, and the equivalent requirements of the CCPA and other data protection laws worldwide.

• Subject matter and purpose: hosting and operating your website and its forms, delivering enquiries to you, and providing website statistics.
• Duration: for as long as you use the Service, then deletion as set out below.
• Data subjects: visitors to your website and people who contact you through it.
• Personal data: what your forms collect (for example name, email, phone, message), and technical data such as IP address, browser and pages visited.
• Special category data: none, unless you choose to collect it. In that case you’re responsible for having a lawful basis.

• Process Customer Personal Data only on your documented instructions (these terms and your use of the Service), unless the law requires otherwise. Tell you if we think an instruction breaks the law.
• Never sell it, share it for cross-context behavioral advertising, or use it for our own purposes outside the business relationship.
• Make sure everyone who handles it is bound by confidentiality.
• Keep appropriate technical and organisational security measures (Article 32), including encryption in transit and at rest, access controls and monitoring.
• Help you respond to data subjects’ requests, and with security, breach notification, impact assessments and regulator consultations.
• Notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
• Delete or return Customer Personal Data when you close your account (within 30 days, backups within a further 90), unless the law requires us to keep it.
• Make available the information needed to show we comply, and allow reasonable audits (normally satisfied by our written responses and security documentation).

You authorise NeuraHive to use sub-processors in these categories: cloud hosting and content delivery; database and storage; email delivery; AI model providers; and security monitoring. Each is bound by written terms giving the same level of protection as this DPA, and we remain responsible for them. We’ll give you at least 14 days’ notice of a new sub-processor (on request by email to info@neurahive.co.uk); you may object on reasonable data protection grounds, and if we can’t address it you may end the affected service.

Where Customer Personal Data is transferred outside the UK, EEA or Switzerland to a country without an adequacy decision, the transfer is covered by the EU Standard Contractual Clauses (Module 2 or 3 as appropriate), the UK International Data Transfer Addendum, or the Swiss equivalent (all incorporated into this DPA by reference), or another lawful mechanism.

You’re responsible for having a lawful basis for the data your website collects, giving visitors a privacy notice (and a cookie notice if your site uses non-essential cookies), and responding to their requests. Forward any request you’d like help with to info@neurahive.co.uk.

This DPA applies automatically when you accept our Terms of Service. If you need a countersigned copy for your records, email info@neurahive.co.uk.