Data Protection

Nexpa is committed to responsible, transparent data protection practices. This page explains our obligations as both a data controller (for your account data) and a data processor (for your customers' conversation data), applying data protection principles consistent with the General Data Protection Regulation (GDPR) and other applicable data protection law.

1. Data Controller Information

Controller Name: Nexpa
Trading As: Nexpa
Registered Jurisdiction: Singapore
Data Protection Officer: dpo@customer.nexpa.co

2. Legal Basis for Processing

We rely on the following lawful bases for processing personal data:

3. Data Categories We Process

3.1 Account Holder Data (Controller role)

• Identity data: first name, last name, business name, business type
• Contact data: email address, phone number (E.164)
• Technical data: IP addresses, browser and device identifiers, session tokens
• Commercial data: subscription plan, payment method details (tokenised — full card numbers are never stored by Nexpa), invoice history
• Configuration data: bot settings, flow configurations, knowledge base documents, working hours

3.2 End-Customer Data (Processor role)

When your WhatsApp bot operates, Nexpa processes the following data about your customers strictly on your instruction:

• WhatsApp phone numbers (partially masked in system logs; stored in full in your conversation database)
• Message content (text bodies of inbound and outbound messages)
• Timestamps of messages and delivery events
• Detected language and confidence score (used to personalise responses)
• Conversation status (active, escalated, resolved)
• Opt-out status (contacts who have sent STOP keywords)

You are the data controller for your customers' data. You are responsible for ensuring you have a valid legal basis to process your customers' data via Nexpa and for maintaining any required privacy notices with your customers.

3.3 Special Category Data

Nexpa does not intentionally collect or process special category data (health, biometric, political, religious, or financial data). You must not configure bots to solicit such data from your customers.

4. Data Subject Rights

Individuals whose data we process have the following rights. The procedures for exercising them differ depending on the role in which we process data:

4.1 Rights as Nexpa Account Holder

Submit requests directly to dpo@customer.nexpa.co. We will respond within 30 days.

• Right of Access — Request a full export of your personal data
• Right to Rectification — Correct inaccurate data via your account Settings page or by contacting us
• Right to Erasure — Request deletion of your account and all associated data (subject to legal retention obligations)
• Right to Data Portability — Receive your conversation data in JSON or CSV format
• Right to Object — Object to processing based on legitimate interests
• Right to Restrict Processing — Request temporary restriction of processing while a dispute is resolved

4.2 Rights as End-Customer of a Nexpa Bot

If you are a customer who interacted with a WhatsApp bot powered by Nexpa, your data is controlled by the business that deployed that bot, not by Nexpa directly. Please contact that business for data requests. Nexpa will cooperate with legitimate requests forwarded to us by our customers (controllers).

You can also opt out of further messages from any Nexpa-powered bot at any time by replying STOP to any message. This will immediately cease AI responses from that bot.

5. International Data Transfers

Nexpa's primary infrastructure is hosted in Germany (EU) via Contabo GmbH. Your data benefits from EU-level data protection standards.

Certain sub-processors (Meta, Anthropic, Google, Stripe) operate in the United States. Data transferred to these processors is subject to the following safeguards:

• Standard Contractual Clauses (SCCs) as approved by the EU Commission
• Sub-processor Data Processing Agreements (DPAs) in place with all US-based processors
• Data minimisation — only the minimum data necessary is shared with each sub-processor

Message content sent to Anthropic's Claude AI model for generating bot responses is processed under Anthropic's zero-retention policy for API use — Anthropic does not train models on API prompt data.

6. Data Retention Schedule

Automated deletion processes run weekly. Data scheduled for deletion is marked, quarantined for 7 days to allow error recovery, then permanently purged.

7. Technical & Organisational Security Measures

7.1 Technical Controls

• Encryption in transit: All traffic enforced over TLS 1.2+ (HSTS enabled). Certificate issued by Let's Encrypt, renewed automatically.
• Encryption at rest: Database encrypted using MySQL AES-256 encryption for sensitive fields; server-level disk encryption enabled
• Password hashing: bcrypt with cost factor 12 — passwords are never stored in plain text or reversible format
• API token security: Meta access tokens and API keys stored encrypted; never exposed in logs, error messages, or client-facing responses
• Network isolation: Database accessible only from localhost; no external port exposure; firewall allows only ports 80, 443, and 22 (restricted SSH)
• Rate limiting: Authentication endpoints rate-limited; bot message rate-limited to 10 replies/minute per account
• CSRF protection: Laravel's CSRF tokens enforced on all state-changing requests
• XSS protection: Output escaping enforced in all templates; Content Security Policy headers applied
• SQL injection prevention: Parameterised queries via Laravel Eloquent ORM — no raw user input in SQL
• Session security: HTTP-only, SameSite=strict session cookies; sessions stored server-side in database

7.2 Organisational Controls

• Access to production systems is restricted to authorised personnel on a need-to-know basis
• All team members with data access sign confidentiality agreements
• Production credentials are not stored in version control (Git) — enforced via .gitignore
• Regular security reviews and dependency audits using composer audit and npm audit
• Automated database backups retained for 30 days with off-site replication

8. Sub-processors

We maintain an up-to-date list of approved sub-processors. Material changes to this list will be communicated to customers with at least 14 days' notice, providing the right to object.

9. Data Breach Procedure

In the event of a personal data breach, Nexpa will:

1. Detect & Contain — Immediately isolate the affected system and revoke compromised credentials
2. Assess — Evaluate the scope, nature, and likely impact on data subjects within 24 hours
3. Notify Regulators — Report to the relevant data protection authority within 72 hours of confirming the breach, where required
4. Notify Affected Users — Contact affected users by email within 72 hours with details of: what happened, what data was affected, what we are doing about it, and steps you can take
5. Remediate — Implement corrective measures to prevent recurrence
6. Document — Maintain a full record of the breach, assessment, and response for regulatory purposes

To report a suspected security vulnerability, please email security@customer.nexpa.co. We operate a responsible disclosure policy and will respond within 48 hours.

10. Regulatory Compliance Statement

Nexpa serves customers globally and applies data protection practices consistent with the General Data Protection Regulation (GDPR) and other applicable regional data protection law, regardless of where a given customer or their end-customers are located.

Our compliance measures include:

• Appointment of a Data Protection Officer (DPO)
• Maintenance of a Data Processing Register documenting all processing activities
• Data Protection Impact Assessments (DPIAs) conducted for high-risk processing activities
• Staff training on data protection obligations
• Data subject request procedure with 30-day response commitment
• Lawful basis documented for all processing activities (see Section 2)

We are committed to full compliance with applicable data protection law in the jurisdictions we operate in. Our Data Protection Policy is reviewed annually or when material changes occur.

11. Data Protection Officer (DPO)

Our Data Protection Officer is responsible for overseeing Nexpa's data protection strategy and implementation. Contact the DPO for:

• Data subject access requests
• Exercising any of your data protection rights
• Concerns about how your data is being handled
• Data Processing Agreements (DPAs) for enterprise customers
• Reporting potential data breaches

To escalate a complaint, you may also contact your local data protection authority.