This Data Processing Agreement (“DPA”) forms part of the agreement between Nurama Ltd (“Nurama”) and the customer (“Customer”) governing use of the Nurama platform (the “Service”).

1. Roles of the parties

For the purposes of applicable data protection laws, including the UK GDPR:

• The Customer
• Nurama Ltd

Nurama processes personal data only on documented instructions from the Customer and in accordance with this DPA.

2. Scope and duration

This DPA applies to all personal data processed by Nurama on behalf of the Customer in connection with the Service. Processing continues for the duration of the Customer’s use of the Service, unless otherwise required by law.

3. Nature and purpose of processing

Nurama processes personal data solely to:

• Provide, operate, and support the Service
• Enable collaboration, asset management, and communication
• Maintain security, performance, and reliability
• Provide customer support and technical assistance

Nurama does not process personal data for its own purposes beyond operating the Service.

4. Categories of data and data subjects

Data subjects may include:

• Customer employees
• Contractors and freelancers
• Clients, reviewers, and collaborators
• Other authorised users invited by the Customer

Personal data may include:

• Names and email addresses
• Account and role information
• Profile data (including profile images)
• Content and communications uploaded to the Service
• Usage and activity data

Sensitive personal data is not required by Nurama and is processed only if uploaded at the Customer’s discretion.

5. Customer obligations

The Customer confirms that:

• It has a lawful basis to process personal data
• It has provided all required notices to data subjects
• It has obtained all necessary consents where required
• Its instructions to Nurama comply with applicable law

The Customer is responsible for configuring the Service and access permissions appropriately.

6. Nurama obligations

Nurama shall:

• Process personal data only on documented instructions from the Customer
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Not disclose personal data to third parties except as permitted by this DPA
• Assist the Customer in meeting its obligations under data protection law

7. Sub processors

The Customer authorises Nurama to engage sub processors to support delivery of the Service. Current sub processors include providers for:

• Hosting, content delivery, and security
• Email communications
• Payment processing
• Error monitoring and diagnostics
• Product analytics (where enabled)

Nurama ensures that subprocessors are subject to data protection obligations no less protective than those set out in this DPA. Nurama may update subprocessors as needed and will make reasonable efforts to keep information current.

8. International data transfers

Personal data may be processed outside the UK. Where data is transferred internationally, Nurama ensures appropriate safeguards are in place, including:

• Adequacy decisions where applicable
• Standard contractual clauses or equivalent mechanisms

9. Security measures

Nurama implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, or disclosure. No system is completely secure, and absolute security is not guaranteed.

10. Personal data breaches

Nurama will notify the Customer without undue delay upon becoming aware of a personal data breach affecting personal data processed on the Customer’s behalf. Nurama will provide reasonable information to support the Customer's obligations.

11. Data retention and deletion

Upon termination of the Service, Nurama will:

• Delete or anonymise personal data processed on behalf of the Customer, or
• Retain data where required by law

Deletion is subject to reasonable technical and operational constraints.

12. Audits

Nurama will make available information reasonably necessary to demonstrate compliance with this DPA. Audits may be conducted only where legally required and subject to reasonable notice, scope, and confidentiality restrictions.

13. Liability

Liability arising under this DPA is subject to the limitations of liability set out in the Terms and Conditions between the parties. Nothing in this DPA limits liability where such limitation is not permitted by law.

14. Governing law

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over disputes arising from this DPA.