Legal

Data Processing Agreement

This page summarises how NuxLay processes personal data on behalf of clients. It is a summary for transparency. For a specific project, the signed project agreement and, where needed, a signed Data Processing Agreement (DPA) with standard contractual clauses will govern, and will take precedence over this summary.

Last updated: 2 November 2026. These pages are general information, not legal advice. A signed project agreement, where one exists, takes precedence for that project.

Roles

For client data, the client is usually the controller, deciding why and how its customer data is processed, and NuxLay is the processor, processing it only on the client's documented instructions and to deliver the agreed services. For NuxLay's own website enquiries, NuxLay is the controller — see the Privacy Policy.

What we process

Only the personal data needed to deliver the agreed services, such as contact details, website and account information, and, where the service requires it, customer enquiry, order, or analytics data supplied by the client. We do not process special-category data unless the project agreement expressly requires it and a lawful basis is agreed.

Instructions and confidentiality

We process client personal data only on documented instructions, and we will tell the client promptly if an instruction appears to breach data protection law, unless we are forbidden by law from doing so. Our staff who handle client data are bound by confidentiality obligations and have access only where needed for the project.

Security measures

We use reasonable technical and organisational measures appropriate to the risk, including access controls, secure hosting, encrypted connections where available, and form and server protections. We will tell the client without undue delay after becoming aware of a personal data breach affecting client data, and we will cooperate reasonably with the client's investigation and notification duties.

Sub-processors and transfers

We use only the sub-processors needed to deliver the service, such as our hosting provider and, once configured, our email provider. We will tell the client before adding a new sub-processor that will handle client personal data, and the client may object on reasonable data-protection grounds. Where client data is transferred outside the EEA or UK, we rely on an adequacy decision or standard contractual clauses, as set out in the signed DPA for that project.

Data subject rights and return or deletion

We will help the client, as far as reasonable, to respond to data subject requests (access, correction, deletion, restriction, portability, and objection) and to meet its duties for security, breach notification, and impact assessments, taking into account the nature of our processing. At the end of the project, we will return or delete client personal data as the client instructs in writing, unless law requires us to keep it. To request a signed DPA, contact us using the details below. Contact NuxLay at contact@nuxlay.com or +92 323 0189006, Gulberg Green, Islamabad, Pakistan.

Other legal pages

Contact: contact@nuxlay.com · +92 323 0189006 · Gulberg Green, Islamabad, Pakistan