Data processing addendum

This is version 3.0 of data processing addendum. The version that governs a signed engagement is the one in force on the day it was signed, and every acceptance is recorded against its exact text.

In this document "Nuub" means Nuub Limited (company number 17414025), registered office The Future Works, 2 Brunel Way, Slough, SL1 1FQ, United Kingdom, trading as Nuub.

Contractual notices go to admin@nuub.co.uk. Data protection requests go to admin@nuub.co.uk. Nuub Limited has applied for registration with the Information Commissioner's Office. Registration number pending.

These are business-to-business terms, governed by the law of England and Wales. If you are buying wholly or mainly outside a trade, business, craft or profession, contact Nuub before purchasing, because different rights apply.

This addendum applies where Nuub processes personal data solely on the client's documented instructions. Where each party decides its own purposes, each acts as an independent controller and this addendum does not apply.

It forms part of the client terms of engagement and, for a Nuub Pulse subscriber, of the Nuub Pulse subscription terms. It does not vary either of them in any other respect.

Subject matter: delivery of the contracted services. Duration: the engagement, plus the retention period in the privacy notice. Nature and purpose: hosting, analysis, reporting and support. Types of data and categories of data subject: as determined by the client's own material and briefing.

This section covers only the personal data Nuub processes on behalf of the subscribing business to provide Nuub Pulse. It does not describe processing Nuub carries out for its own purposes.

Subject matter: operating the Nuub Pulse subscription for the subscribing business. Duration: the term of the subscription and up to 12 months after it ends, after which the data is deleted or irreversibly anonymised unless the client asks for earlier deletion or the law requires longer retention.

Nature and purpose: storing the subscribing business's baseline, monthly figures, management answers, priorities and actions, and producing that business's own standing, commentary and monthly brief from them for its workspace.

Types of personal data: any personal data the subscribing business chooses to include in that content, such as names, roles and remarks about individuals. Categories of data subject: the subscribing business's staff, contractors, customers and other contacts named in that content.

Documented instructions: the client's instruction is to operate the subscription as described above. Nuub does not use this data for benchmarking across clients, for training AI models, for its own marketing or prospecting, or for analytics unrelated to providing Pulse to that client. Nuub Pulse does not currently send this data to an external AI service.

Confidentiality and security, sub-processors, assistance with data subject rights, breach notification, audit and information apply to Pulse exactly as set out elsewhere in this addendum. At the end of the subscription the client may export its records while they remain available, and on request Nuub deletes them earlier.

Process only on documented instructions; keep personnel under confidentiality; apply appropriate technical and organisational measures; assist with data subject requests, security, breach notification and impact assessments; and delete or return personal data at the end of the engagement except where retention is legally required.

Notify the client without undue delay after becoming aware of a personal data breach affecting the client's data.

Make available the information reasonably needed to demonstrate compliance and allow audits on reasonable notice, no more than once a year unless required by a regulator.

The client authorises the sub-processors listed in the privacy notice. Nuub gives notice before adding a sub-processor and the client may object on reasonable data protection grounds.

Transfers outside the UK are made under adequacy regulations or the UK international data transfer agreement or addendum.

Where an AI service is used to process client personal data, it is used only through Nuub's approved AI provider, only with the client's own material, and only for the client's service. Nuub Pulse does not currently send client content to an external AI service, and Nuub will update the applicable privacy information before that changes.

• Client terms of engagement — The master terms governing every diagnostic, review, blueprint, sprint and programme bought from Nuub.
• Executive network agreement — The terms on which an executive joins the Nuub bench, delivers work and is paid a share of billings.
• Fractional appointment terms — Additional terms for ongoing COO, CFO, NED and Chair appointments placed and administered by Nuub.
• Platform terms of use — How the Nuub platform, workspace, assessments and AI features may be used by clients and executives.
• Expenses and travel policy — What can be claimed, how it is approved, and why Nuub takes no share of expenses.
• Booking and session terms — How a paid session is booked, rescheduled, cancelled and credited, and what happens if either side does not turn up.
• Constraint assessment terms and disclaimer — The basis on which the constraint assessment, its scores and its cost-of-constraint estimates are provided.
• Growth partnership and retainer schedule — The additional terms that apply to a recurring monthly partnership: term, notice, what is included and what happens to unused capacity.
• Referral programme terms — How a referral is registered, when a reward becomes payable, and what disqualifies a referral.
• Privacy notice — What personal data Nuub holds, why, on what lawful basis, who it is shared with, how long it is kept and what rights apply.
• Cookie notice — What is stored on your device, why, and how to control it.
• Mutual non-disclosure agreement — Standard mutual confidentiality terms for exploratory conversations before an engagement is contracted.
• Nuub Pulse subscription terms — The terms for the Nuub Pulse monthly business subscription: what is included, what is explicitly not included, renewal and cancellation, what happens if a payment fails, and how your information is treated.
• Accessibility statement — The accessibility standard Nuub works towards, what is known to fall short, and how to report a problem.