Data Processing Agreement

Annex 1 to the NX1 partner terms · Version 1.0 · July 2026

This English text is provided for convenience; the German Vereinbarung zur Auftragsverarbeitung is the legally binding version.

§ 1 Parties and subject matter

(1) The processor is Shio Ventures GmbH, Straßburger Straße 55, 10405 Berlin, Germany (“NX1”). The controller is the partner registered in the NX1 partner account (“partner”).

(2) The partner creates a start page in the NX1 partner portal and provides content for it. NX1 stores this content and delivers it to users of the NX1 extension and web app (“fans”). Where this content contains personal data, NX1 processes it exclusively on the partner’s documented instructions. This agreement governs that processing pursuant to Art. 28 GDPR.

(3) Not covered by this agreement are usage, installation, click and campaign figures, and any other server-side measurement of the operation of the NX1 services. NX1 collects and processes such data as its own controller for the purposes of operating, debugging and improving the service. The partner receives only aggregated figures without identifiers; the partner has no right to issue instructions in this respect. Details are set out in the NX1 privacy policy.

§ 2 Nature, purpose, duration, categories of data and data subjects

(1) Nature and purpose: storage, provision and delivery of the content provided by the partner for the purpose of operating their start page; generation of page content using AI at the partner’s request.

(2) Duration: for the term of the partner contract.

(3) Categories of data: image data (uploaded backgrounds, logos, campaign images), text content (tile and widget texts, banner and campaign texts), information about connected channels, and publicly available post content obtained via those channels.

(4) Categories of data subjects: persons depicted, named or otherwise identifiable in the content provided by the partner.

(5) The partner ensures that they are entitled to provide this content and hold the required legal basis. They confirm this in the portal before the first publication.

§ 3 Instructions (Art. 28(3)(a) GDPR)

(1) NX1 processes the data exclusively on the partner’s documented instructions. The partner’s operation of the portal — adding, changing, publishing and deleting content — constitutes a documented instruction. Further instructions are given in text form to partner@nx1-app.com.

(2) Where NX1 is required to process under Union or Member State law, NX1 informs the partner of that legal requirement before processing, unless the law prohibits such information.

(3) If NX1 considers an instruction to be unlawful, NX1 says so and may suspend execution until the matter is resolved.

§ 4 Confidentiality (Art. 28(3)(b) GDPR)

NX1 ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

§ 5 Technical and organisational measures (Art. 28(3)(c), Art. 32 GDPR)

NX1 implements the measures described in Annex B and keeps them at the state of the art for the duration of the contract. Changes must not fall below the level of protection achieved.

§ 6 Sub-processors (Art. 28(2) and (3)(d) GDPR)

(1) The partner grants general written authorisation for the engagement of the sub-processors listed in Annex C.

(2) NX1 informs the partner of intended changes at least 30 days in advance in text form. The partner may object within 14 days of receipt on important data protection grounds. In the event of a justified objection that makes performance impossible, either party may terminate the partner contract with effect from the change.

(3) NX1 imposes on sub-processors data protection obligations equivalent to those in this agreement.

§ 7 Data subject rights (Art. 28(3)(e) GDPR)

NX1 assists the partner by appropriate technical and organisational measures in fulfilling data subject rights. Where a data subject contacts NX1 directly and the request concerns content provided by the partner, NX1 forwards it to the partner without delay and does not answer it itself. The partner may change or delete the content concerned in the portal at any time.

§ 8 Assistance obligations (Art. 28(3)(f) GDPR)

NX1 assists the partner in complying with Art. 32 to 36 GDPR, in particular regarding security of processing, notification of personal data breaches and data protection impact assessments. NX1 notifies the partner of personal data breaches affecting this agreement without undue delay and no later than 48 hours after becoming aware of them.

§ 9 Deletion and return (Art. 28(3)(g) GDPR)

(1) After the end of the partner contract, NX1 deletes the processed content, including uploaded image files, within 30 days, unless a statutory retention obligation applies. Instead of deletion the partner may request return in a common format; the request must be made before that deadline expires.

(2) Start pages already installed on fan devices are snapshots on the respective device and are not under NX1’s control; the deletion obligation does not extend to them (clause 11 of the partner terms).

(3) The aggregated figures referred to in § 1(3) are not covered by deletion, as they have no personal reference; they are subject to the automatic 90-day retention period.

§ 10 Evidence and audits (Art. 28(3)(h) GDPR)

NX1 makes available to the partner, on request, the information necessary to demonstrate compliance, in particular the current version of Annexes B and C. On-site inspections take place after reasonable advance notice, during normal business hours and no more than once a year unless there is specific cause.

§ 11 Transfers to third countries

Processing outside the EU and the EEA takes place only within the scope of the sub-processors listed in Annex C and is based on an adequacy decision (EU-US Data Privacy Framework) or on the European Commission’s standard contractual clauses.

§ 12 Final provisions

(1) This agreement is Annex 1 to the NX1 partner terms and takes effect upon their acceptance. Acceptance is documented electronically with a timestamp and version number (Art. 28(9) GDPR).

(2) In the event of conflict between this agreement and the partner terms, this agreement prevails for the processing of personal data.

(3) German law applies.

Annex A — Processing overview

• Start page content (texts, configuration) — Cloudflare storage, for the term of the contract
• Uploaded images (backgrounds, logos) — Cloudflare storage, delivered via the NX1-owned address /wpi/<id>, for the term of the contract, then deleted under § 9
• Campaigns (takeover image, title, banner text, target link, time window) — Cloudflare storage, until 30 days after the campaign ends
• Connected channels (handle, channel identifier, connection state) — for the term of the contract
• Channel posts (public content, cached for delivery) — hours up to 30 days
• AI generation on request (the partner’s input and the generated page) — processed at the sub-processor without permanent storage, result in Cloudflare storage

Annex B — Technical and organisational measures (Art. 32 GDPR)

Access control

• Passwordless sign-in via a single-use six-digit code sent by email, valid for 15 minutes, maximum five attempts; additionally, per-IP limits on sending and verification.
• Session cookie readable only server-side, transmitted only over encrypted connections, protected against cross-site requests; 128 bits of randomness; lifetime 30 days.
• Server-side tenant separation: every access to a start page checks ownership; analyses are filtered server-side to the partner’s own published address. A partner can neither read nor change another partner’s content or figures.
• Administrative access is limited to the operator and secured via Cloudflare Zero Trust.

Transmission and input control

• Encrypted transmission only (TLS).
• Uploaded files are checked by file signature rather than by extension and are limited in size and edge length. Vector graphics are checked for executable components and rejected otherwise; delivery prevents the browser from reinterpreting the file type.
• Image addresses are derived from the content and are therefore not guessable.
• Images are delivered exclusively from NX1-owned addresses — from the partner’s own uploads or the internal catalogue. Embedding images from foreign servers is excluded, because that would report fans’ connection data to the foreign server on every page view.
• All values provided by the partner pass server-side validation; the client software repeats it independently before rendering.

Availability and resilience

• Operated on a globally replicated edge infrastructure (Cloudflare).
• Failures in secondary paths (counting, measurement) cannot interrupt the actual request.

Data minimisation and separation

• The measurement store contains no installation identifiers, no IP addresses, no full web addresses and no free text, only coarse attributes.
• The measurement store has no interface for reading individual records, only aggregates.
• Automatic deletion of the measurement store after 90 days.
• Hashes used to count active installations are formed with a daily rotating random value that is deleted after 48 hours; linking across days is thereafter impossible, including for NX1.

Accountability

• Acceptance of the partner terms and this agreement with version number and timestamp in the partner account.
• Content changes carry timestamps; the first publication goes through editorial approval.

Annex C — Sub-processors

• Cloudflare, Inc. (USA, global edge) — hosting, storage, delivery, measurement store. Basis: EU-US Data Privacy Framework.
• Anthropic, PBC (USA) — AI generation of page content at the partner’s request. Basis: EU-US Data Privacy Framework.
• Resend, Inc. (USA) — sending system emails to the partner (sign-in codes, notifications). Basis: European Commission standard contractual clauses.

Image sources (Unsplash, Pexels, Pixabay) and channel platforms (YouTube, TikTok, X, Telegram, Twitch) are not listed as sub-processors: they supply content or make the partner’s own content available and do not process personal data on NX1’s behalf.

Version

Version 1.0, July 2026. Annex 1 to the NX1 partner terms.