Nexus Data Processing Agreement

Updated 13 November 2026

This agreement applies automatically to every Nexus account and is part of the Terms of Service; nothing needs to be signed. It governs the personal data of the customer contacts you store and message through Nexus. Questions go to dpo@izaaja.com.

1. Who plays which role

For customer contact data in Nexus, you as the business owner are the controller: you decide why the data is processed, and you make sure of the lawful basis and consent. PT IZAAJA SOLUSI DIGITAL is the processor: we process it for you, to run your inbox, CRM, broadcasts and chatbot. For your own account, agent and subscription data we are the controller, as the Privacy Policy explains.

2. What we process, and for how long

Whose data: people who message your WhatsApp number or the social accounts you connect, and contacts you add or import.
What data: phone number, profile name, message content and time, attachments, labels, notes, pipeline stage, consent status and source, and broadcast send results.
What for: showing and sending messages, keeping contacts, running the broadcasts you start, drafting chatbot answers if you turn it on, and building the reports you open in Nexus.
How long: while your account is active, and under section 7 of the Privacy Policy: deleted or anonymised once account deletion is confirmed and the 14-day period ends.

3. Only on your instructions

Your instructions are the settings you choose and the actions you and your agents take in Nexus. We do not use contact data for our own purposes: not to train our AI models, not sold, not for advertising to your contacts, and not to contact them in our own name. If we think an instruction breaks the law, we tell you instead of carrying it out. You remain responsible for making sure contacts agreed to receive your messages.

4. People and security

Only our staff who need access to run or fix the service can reach contact data, and they must keep it confidential. The technical protections in section 11 of the Privacy Policy — HTTPS, token encryption, hashed passwords, and the per-agent permissions you set — apply in full to contact data.

5. Other providers we use

You authorise the recipients listed in section 8 of the Privacy Policy, namely Meta (WhatsApp Business Platform, Instagram and Facebook), the AI model provider (currently DeepSeek, only when the AI chatbot is on), Contabo (hosting), Cloudflare, and email and notification services; each receives only what its task needs. We require every recipient to protect the data at least as strictly as this agreement requires of us, and we remain responsible to you for what they do, as far as that can be arranged through our agreements with them. For WhatsApp messages, Meta states that it acts as a processor for the business and uses messages only on that business’s instructions.

Before a new provider starts receiving contact data, we update that list and email the account owner. If you object, write to dpo@izaaja.com; if we cannot meet your objection, you may end your subscription as the Terms of Service provide.

6. When a contact asks about their data

A contact’s request — to see, correct or delete their data — you answer as controller. If a contact contacts us directly, we pass the request on to your business. If the tools in Nexus are not enough, email dpo@izaaja.com and we carry out the request for you within the deadline your law sets. A contact who asks to stop receiving messages must be removed from broadcasts at once; Nexus provides an opt-out status for that.

7. If contact data leaks

We tell you without undue delay after we learn of it, with what we know: what happened, what data and roughly how many contacts are affected, and what we have done. The notice goes early enough for you to meet your own duties as controller, and we keep adding detail as we learn more.

8. Data abroad

Our servers are in Germany, and WhatsApp and social messages pass through Meta, so contact data is processed outside your country. We apply the cross-border safeguards your law requires; asking which safeguards apply to you is free, through dpo@izaaja.com.

9. When the account ends

When your account is deleted, contact data is deleted or anonymised as in section 2 above. Before that, export the contacts you still need from Nexus, or ask for a machine-readable copy at dpo@izaaja.com.

10. Showing that we comply

We answer your written questions about how we process contact data, and give you the information a data protection authority asks of you about our part. An audit by you or an independent auditor can be arranged by written agreement on timing and scope, in confidence.

11. Which document wins

For contact data, this agreement prevails over the Terms of Service if they differ. If the Indonesian and English versions differ, the Indonesian version applies, unless your country’s law says otherwise.