Data Processing Agreement
Nextbit256 S.L. — Standard Data Processing Agreement
Effective Date: May 2026
1. Parties
This Data Processing Agreement ("DPA") is between:
Processor: Nextbit256 S.L., incorporated under the laws of Spain, with registered address at Carrer del Moll de la Duana, s/n, Edificio Lanzadera, 46024 Valencia, Spain ("Nextbit"); and
Controller: the legal entity or individual that accesses or uses the Services ("Customer" or "Controller").
This DPA forms part of and is subject to the Nextbit Terms of Service available at https://www.nextbit256.com/docs/terms-of-service ("Terms of Service"). By using the Services to process personal data of third parties, the Controller accepts this DPA in full.
2. Definitions
Terms used in this DPA have the meanings given in Regulation (EU) 2016/679 ("GDPR") and, where applicable, Spanish Organic Law 3/2018 (LOPDGDD). Additionally:
- "Services" means the Public API inference services provided by Nextbit, as described in the Terms of Service.
- "Applicable Data Protection Law" means the GDPR, the LOPDGDD, and any other data protection legislation applicable to the processing described herein.
- "Subprocessor" means any third party engaged by Nextbit to process Personal Data in connection with the provision of the Services.
- "EU Endpoint" means the Services accessed through the base URL https://eu.api.nextbit256.com/v1.
- "Global Endpoint" means the Services accessed through the base URL https://api.nextbit256.com/v1.
- "Request Content" means the prompts, inputs, files, and other content submitted by or on behalf of the Controller in an API request, the outputs generated in response, and any logs containing such prompts, inputs or outputs.
- "Request Metadata" means technical and billing information associated with an API request that does not include Request Content, such as timestamps, model identifier, token counts, API key identifier, account identifier, IP address, response status and latency.
3. Scope and Instructions
Nextbit processes Personal Data solely in connection with the provision of the Services, in accordance with its standard practices as described in the Privacy Policy and this DPA.
Instructions from the Controller that deviate from those standard practices are only binding on Nextbit if incorporated into a separate written agreement signed by both parties. No instruction submitted by email, support ticket, platform message, or any other channel shall modify Nextbit's obligations under this DPA or otherwise bind Nextbit absent such a signed agreement.
The Controller's choice of endpoint (EU Endpoint or Global Endpoint) for each API request constitutes the Controller's documented instruction as to the location of processing of that request, as described in Section 4.
The Controller is solely responsible for the lawfulness of all processing performed on its behalf, including ensuring that a valid legal basis exists for each processing activity and that data subjects have received adequate privacy notices. Nextbit has no obligation to verify the Controller's compliance.
4. Service Endpoints and Location of Processing
Nextbit makes the Services available through two endpoints. The models available on each endpoint are listed at the /v1/models path of the corresponding base URL. In the model catalogue published on the Nextbit website, models served through the EU Endpoint are labelled "EU" and models served through the Global Endpoint are labelled "Multi". The model catalogue of each endpoint may change over time.
EU Endpoint (https://eu.api.nextbit256.com/v1). Model inference is performed exclusively on infrastructure located in Spain, within the European Union. No third-party infrastructure provider performs inference on, or stores, Request Content submitted through the EU Endpoint.
Global Endpoint (https://api.nextbit256.com/v1). Model inference may be performed on compute capacity provided by a third-party cloud infrastructure provider on nodes located outside the European Economic Area ("EEA").
API gateway (both endpoints). API traffic to both endpoints is received by an API gateway hosted within the European Union. The gateway processes Request Content only transiently, in transit, for the purposes of routing, securing and authenticating requests, and does not store Request Content.
It is the Controller's sole responsibility to select the endpoint appropriate to its data residency and data protection requirements. Controllers who require that Request Content not be processed on inference infrastructure outside the EEA must use the EU Endpoint exclusively.
5. Nature and Purpose of Processing
| Field | Detail |
|---|---|
| Subject matter | AI inference: processing of inputs submitted via the Services and generation of model outputs |
| Duration | Request Content: for the duration of the processing of each API request only, subject to Section 11. Account data and Request Metadata: term of the Terms of Service plus applicable retention periods under Section 11 |
| Nature | Automated processing of input and output data through AI inference infrastructure operated by Nextbit or its Subprocessors, as described in Section 4 |
| Purpose | Provision of the Services as requested by the Controller, including authentication, billing, security and abuse prevention |
| Types of personal data | Any personal data included by the Controller in Request Content; account data; Request Metadata |
| Categories of data subjects | Any individuals whose personal data is included in data submitted by the Controller through the Services; the Controller's users and account holders |
6. Obligations of Nextbit
Nextbit shall:
- Instructions. Act only on acknowledged instructions from the Controller as defined in Section 3. Where no acknowledged instruction applies, process in accordance with this DPA and the Privacy Policy.
- No model training. Not use Request Content to train, fine-tune, evaluate or otherwise develop any AI model, whether operated by Nextbit or any third party.
- No disclosure. Not disclose Request Content to any third party, except (i) to Subprocessors, to the extent strictly necessary to provide the Services in accordance with Sections 4 and 8; or (ii) where required by applicable law, court order, or binding request of a competent public authority, as further described in Section 9.
- Confidentiality. Ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations.
- Security. Implement technical and organizational measures appropriate to the risk presented by the processing. The description of current measures is maintained in the Privacy Policy and may be updated from time to time.
- Subprocessors. Engage Subprocessors in accordance with Section 8.
- Data subject rights. Assist the Controller in responding to data subject rights requests under Applicable Data Protection Law, within 45 business days of receiving a written request from the Controller. Nextbit's assistance is limited to information technically available to it. As Request Content is not retained (Section 11), Nextbit will generally be unable to access, retrieve or produce Request Content after the corresponding request has been completed. The Controller remains solely responsible for responding to data subjects.
- DPIA assistance. Provide such technical information as is reasonably available to Nextbit to assist the Controller in conducting a Data Protection Impact Assessment, if requested. The DPIA is the Controller's sole responsibility.
- Breach notification. Notify the Controller within 48 hours of becoming aware of a personal data breach affecting the Controller's data, including: the nature of the breach, approximate categories and number of individuals affected, and measures taken or proposed. The Controller is responsible for notifying the competent supervisory authority within 72 hours and, where required, affected data subjects.
- Data return and deletion. As described in Section 11.
- Audit rights. As described in Section 12.
7. Obligations of the Controller
The Controller warrants and represents that it:
- Has a valid legal basis under Applicable Data Protection Law for all processing it causes Nextbit to perform.
- Has selected, for each API request, the endpoint that is appropriate to its data residency and data protection requirements, as described in Section 4.
- Will not use the Services to process Special Categories of Personal Data (Article 9 GDPR) without executing a separate addendum with Nextbit prior to such processing.
- Has provided, and will maintain, adequate privacy notices to data subjects whose data is processed through the Services.
- Will give instructions only in writing and acknowledges that instructions are only binding on Nextbit upon Nextbit's express written acknowledgment.
- Is solely responsible for its compliance with Applicable Data Protection Law, including its obligations as provider or deployer of AI systems under Regulation (EU) 2024/1689 (AI Act).
- Is solely responsible for the acts and omissions of its users, agents, and end-users in connection with the Services.
- Will indemnify Nextbit against any claims, fines, or damages arising from the Controller's failure to comply with any of the above warranties.
8. Subprocessors
The Controller grants Nextbit general written authorization to engage Subprocessors that Nextbit determines appropriate for the provision of the Services, in the following categories:
| Category | Endpoint | Role | Access to Request Content |
|---|---|---|---|
| API gateway hosting provider (EU region) | Both | TLS termination, authentication, routing and metering of requests | Transient, in transit only; not stored |
| Cloud infrastructure provider (non-EEA nodes) | Global Endpoint only | Model inference | Yes, during processing of the request; see Section 11 |
| Payment, communication and business tools providers | N/A | Account management, billing and customer support | No |
No Subprocessor performs model inference on Request Content submitted through the EU Endpoint.
Nextbit will impose on each Subprocessor data protection obligations materially equivalent to those in this DPA. In particular, any Subprocessor performing model inference is contractually bound (i) not to use Request Content to train, fine-tune or otherwise develop any model; (ii) not to disclose Request Content to any third party, save as required by applicable law or legal process; and (iii) not to retain Request Content after the request has been completed, save where retention is required by law, in which case for no longer than thirty (30) days.
Nextbit is under no obligation to publish or maintain a public list of Subprocessors. The Controller may request information about current Subprocessors by submitting a written request to [email protected]. Nextbit will provide such information as it is able to disclose, subject to its confidentiality obligations towards its Subprocessors.
Nextbit will notify Controllers of material Subprocessor changes (additions or replacements) by updating this DPA or the Terms of Service and publishing the revised version on its website. Continued use of the Services following such publication constitutes acceptance of the change.
If the Controller objects to a Subprocessor change, it must notify Nextbit in writing at [email protected] within 30 days of the update publication and must cease using the Services, or the affected endpoint, as applicable. Nextbit is not obligated to remove the Subprocessor or to continue providing the Services to an objecting Controller.
9. International Data Transfers and Governmental Access
EU Endpoint. Model inference and any storage of Personal Data in connection with the EU Endpoint take place within the EEA. The API gateway hosting provider described in Section 4 may be incorporated in, or have its parent company established in, a third country (including the United States). To the extent any processing by that provider constitutes a transfer of Personal Data outside the EEA, it is made subject to Standard Contractual Clauses ("SCCs") approved by the European Commission and, where applicable, the EU–US Data Privacy Framework ("DPF") for providers that have self-certified thereunder.
Global Endpoint. Request Content submitted through the Global Endpoint is processed on infrastructure located outside the EEA. Such transfers are made subject to SCCs approved by the European Commission (Commission Implementing Decision (EU) 2021/914).
UK and Switzerland. Where Personal Data subject to the UK GDPR is transferred to a country not covered by UK adequacy regulations, the transfer is governed by the SCCs as amended by the International Data Transfer Addendum issued by the UK Information Commissioner's Office (version B1.0, in force since 21 March 2022). Where Personal Data subject to the Swiss Federal Act on Data Protection is transferred to a country not recognised as adequate by Switzerland, the SCCs apply with the adaptations required by that Act. Transfers to the EEA do not require these instruments, as the EEA is recognised as adequate by both the UK and Switzerland.
Governmental access. The Controller acknowledges that Subprocessors, or their parent companies, may be incorporated or operate in third countries and may be subject to the laws of those countries — including, by way of example, the US CLOUD Act (2018) and FISA Section 702, and laws of other jurisdictions in which infrastructure providers or their corporate groups are established — which may permit public authorities to compel access to data regardless of its physical location. This exposure cannot be fully excluded by contractual measures. The limited retention of Request Content described in Section 11 reduces, but does not eliminate, this exposure.
To the extent permitted by applicable law, Nextbit will notify the Controller of any governmental request for access to the Controller's data received by Nextbit and will use reasonable efforts to challenge requests it considers disproportionate before complying.
Controllers for whom third-country governmental access represents a material risk should use the EU Endpoint exclusively and may contact [email protected] to discuss their requirements.
10. Security
Nextbit implements technical and organizational security measures appropriate to the level of risk presented by the processing, including measures to protect against unauthorized access, disclosure, alteration, or destruction of Personal Data. The description of current measures is set out in the Privacy Policy and may be updated by Nextbit from time to time without notice. No specific security commitments are made in this DPA beyond those expressly set out herein.
11. Data Retention and Deletion
Request Content — EU Endpoint. Nextbit does not store or retain Request Content submitted through the EU Endpoint. Request Content is processed in memory for the sole purpose of generating the response and is discarded once the request has been completed. No prompts, inputs, outputs, or logs containing them are written to persistent storage.
Request Content — Global Endpoint. Neither Nextbit nor its Subprocessors retain Request Content submitted through the Global Endpoint after the request has been completed, save where retention is required by applicable law, in which case Request Content shall be retained for no longer than thirty (30) days and used for no purpose other than compliance with that legal requirement.
Request Metadata. Request Metadata is retained for the purposes of billing, security, fraud and abuse prevention, and compliance with legal obligations (including accounting and tax obligations), for as long as necessary for those purposes and as required by applicable law. Request Metadata does not contain Request Content.
No model training. Nextbit does not use Personal Data submitted by the Controller, whether through the EU Endpoint or the Global Endpoint, to train, fine-tune, or otherwise develop any AI model.
Termination. Upon termination of the Terms of Service, Nextbit will delete the Controller's account data and Request Metadata within 60 calendar days, except to the extent that retention is required by applicable law. As Request Content is not retained, there is no Request Content to return to the Controller upon termination.
The Controller may not require deletion of account data or Request Metadata within a shorter timeframe. The 60-day period is the standard contractual term applicable under this DPA and is not subject to negotiation hereunder.
12. Audit Rights
The Controller's rights under Article 28(3)(h) GDPR to obtain information demonstrating Nextbit's compliance with this DPA are exercised exclusively through written requests submitted to [email protected]. Nextbit will, at its sole discretion, determine what information, if any, to provide in response and within what timeframe. Nextbit is under no obligation to respond within any specified period or to provide any particular document or information.
Nextbit may satisfy audit requests by providing: responses to written questionnaires, third-party certifications or any other information Nextbit considers sufficient in the circumstances.
The following are expressly excluded, absent Nextbit's prior written consent on a case-by-case basis: physical access to Nextbit's premises or data centers; remote access to Nextbit's production systems; inspection of infrastructure configurations, source code, or logs; and any form of audit requiring active personnel time from Nextbit.
Controllers requiring broader audit rights should contact [email protected] before using the Services. Nextbit has no obligation to grant such rights. If no satisfactory arrangement is reached, the Controller should not use the Services.
13. Special Categories of Personal Data
The Services are not designed or intended for the processing of Special Categories of Personal Data as defined in Article 9 GDPR (including, without limitation: health data, genetic data, biometric data used for unique identification, data concerning racial or ethnic origin, political opinions, religious beliefs, or data concerning sexual orientation or sex life).
The Controller must not submit Special Categories of Personal Data through the standard Services. If the Controller's use case requires such processing, it must notify Nextbit at [email protected] and execute a separate written addendum before initiating any such processing. The Controller warrants that it holds a valid legal basis under Article 9(2) GDPR for any such processing.
The Controller shall indemnify Nextbit against any liability, fines, or costs arising from the Controller's transmission of Special Categories of Personal Data through the Services without an executed addendum.
14. AI Act
The Controller acknowledges that it acts as the provider or deployer of any AI system deployed through the Services under Regulation (EU) 2024/1689 ("AI Act"), and assumes all obligations arising from that role, including without limitation documentation requirements, conformity assessments, transparency obligations, and supervisory authority reporting. Nextbit acts solely as a technical operator of inference infrastructure and does not assume any obligations of a provider or deployer under the AI Act as a result of the Controller's use of the Services. The Controller is solely responsible for compliance with the AI Act vis-à-vis its users and competent supervisory authorities.
15. Term and Termination
This DPA is effective for the duration of the Terms of Service and terminates automatically upon termination of the Terms of Service, subject to the data retention obligations in Section 11 and the survival of confidentiality obligations for a period of three (3) years following termination.
16. Liability
The liability of each party under this DPA, including in respect of any claims under Article 82 GDPR, is subject to the limitations, exclusions, and caps set out in the Terms of Service. Nextbit's total aggregate liability under or in connection with this DPA shall not exceed the greater of €100 or the total amounts paid by the Controller to Nextbit in the six (6) months preceding the event giving rise to the claim.
Nextbit is not liable for: (i) any processing carried out on the basis of instructions that Nextbit has not expressly acknowledged; (ii) any disclosure of data to public authorities resulting from legal obligations imposed on Nextbit or its Subprocessors under any applicable law, including the laws of third countries; (iii) any consequences of the Controller's choice of endpoint; or (iv) any damages arising from the Controller's breach of its warranties or obligations under this DPA or Applicable Data Protection Law.
17. Governing Law
This DPA is governed by and construed in accordance with the laws of the Kingdom of Spain. Any disputes arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of Valencia, Spain, unless mandatory provisions of law applicable in the Controller's jurisdiction provide otherwise.
18. Contact and Acceptance
This DPA applies automatically to all Controllers who use the Services to process Personal Data of third parties. No separate signature is required for the standard terms set out herein.
Controllers who require a separately negotiated or countersigned version of this DPA may contact [email protected]. Nextbit has no obligation to negotiate or execute a customized DPA. The Controller may download and retain this document as evidence of the terms applicable at the date of use.
For all data protection queries: [email protected]
This DPA is incorporated into and forms part of the Nextbit Terms of Service (https://www.nextbit256.com/docs/terms-of-service). In case of conflict, the ToS prevails except where this DPA specifically provides greater protection for personal data.