Data processing agreement

Scope

This agreement forms part of our terms of service. It applies when we process personal data for you under UK GDPR, or EU GDPR where that applies. You do not need to sign it.

In it, "we" are Repcurve Ltd, trading as Nest Ready, acting as processor, and "you" are the organisation using Nest Ready, acting as controller. Words such as "personal data", "processing" and "personal data breach" mean what they mean in UK GDPR.

Your instructions

We process personal data only on your documented instructions. Using Nest Ready as it is designed to be used, and the settings you choose in it, are those instructions. We tell you if we believe an instruction breaks data protection law, and we process data otherwise only where the law requires us to, telling you first unless the law forbids it.

Confidentiality and security

Everyone who can access your data is bound to keep it confidential. We protect it with the measures in our privacy policy: separation of each organisation's data enforced by the database, encryption in transit and at rest, private storage that files leave only through the signed-in app, and sign-in without passwords.

Subprocessors

You give general authorisation for the subprocessors on the list we provide on request (contact us; the privacy policy gives their categories). We tell owners by email at least 30 days before adding or replacing one. You can object, and if we cannot resolve the objection you can end the agreement. Each subprocessor is bound to data protection obligations at least as strict as these, and we remain responsible for its work.

Assistance

As far as the service allows, we help you answer requests from people exercising their rights, and with data protection impact assessments and consultations with a supervisory authority.

Breaches

We tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data. We give you what we know, then more as we learn it, and help you meet your own obligations.

At the end

When the service ends, we delete your data within the retention periods in our privacy policy, unless the law requires us to keep it. Download anything you want to keep before then.

Audits

We give you the information you need to show we meet this agreement, on request. On-site audits are by agreement, on reasonable notice, and at your cost.

Transfers

Where your data leaves the UK, the transfer relies on the safeguards in our privacy policy. If an owner chooses a processing region outside the UK and EU, drawings are processed in the United States, or for "any region" wherever the provider runs, which may be outside the UK, EU and US, under those safeguards.

Details of processing

Subject matter	Converting engineering drawings into cutting files
Duration	The term of the agreement, plus the retention periods
Nature and purpose	Storage, automated extraction, AI-assisted reading, review by your own users, and making output files
Types of personal data	Names, signatures, contact and company details in title blocks and notes, and any personal data a photo shows
Data subjects	Your staff, and the staff of your customers and suppliers named on drawings