Data processing agreement
This agreement sets out how we handle personal data for you when you use Helio Guard. It meets Article 28(3) of the UK General Data Protection Regulation (UK GDPR).
It forms part of our terms. It applies automatically when you accept them, and needs no signature. If it conflicts with the terms on how personal data is handled, this agreement wins.
Words such as "controller", "processor", "personal data", "processing" and "personal data breach" mean what they mean in UK GDPR.
1. The parties and their roles
- You, the business that holds the Helio Guard account, are the controller.
- We, Nexborne Ltd, registered in England and Wales, company number 17375877, are your processor.
If you are an IT provider using Helio Guard for a client, your client is the controller and you act as its processor. We are then your sub-processor. You confirm your client has authorised you to give us instructions and to agree to this agreement on its behalf.
For your own account details, billing and support, we are a controller in our own right. Our privacy policy covers that.
2. Details of the processing
| Subject matter | Providing Helio Guard: checking what is pasted, sent and uploaded on AI sites, and reporting AI use on the computers you manage. |
|---|---|
| Duration | While the terms are in force, then until the data is deleted under section 10. |
| Nature | Collecting, storing, organising, showing, emailing at your request, and deleting records sent by the Helio Guard agent and browser extension. |
| Purpose | To help you keep company and personal data out of AI tools, show your AI policy, and show you which AI tools are used and on which computers. |
| Data subjects | Your staff and other people who use the computers you manage. Where you are an IT provider, your clients' staff. People whose devices share a local network with a managed computer, by device address only. |
| Types of personal data |
|
| Special category data | None is needed. Helio Guard checks text on the computer for things such as NHS numbers, but never sends or stores that text. |
3. Your instructions
We process the data only on your documented instructions. Those are the terms, this agreement, the settings you choose in Helio Guard, and your written requests to us. We do not process it for any other purpose, and we never sell it.
The law may require us to process it in another way. If so, we will tell you first, unless the law forbids that.
If we think an instruction breaks UK GDPR or other data protection law, we will tell you straight away.
4. Our people
Only people who need access to provide Helio Guard or support get it. Each of them is bound to keep the data confidential.
5. Security
We keep technical and organisational measures in place to protect the data, as Article 32 of UK GDPR requires. They include:
- encryption in transit (TLS) between the computers, our service and your browser;
- each customer's data kept apart from every other customer's, checked on every request;
- role-based access inside each account;
- two-factor sign-in by authenticator app or passkey, offered to every administrator;
- passwords stored only as one-way hashes, and sign-in attempts rate-limited;
- BitLocker recovery keys encrypted with a key held outside the database;
- extension keys stored on our side only as hashes;
- records from the extension checked against a fixed list of fields, with anything else refused;
- text checked on the computer itself, so typed and pasted content never reaches us;
- an agent that only connects out, is signed by Nexborne Ltd, checks each update before installing it, and refuses remote commands;
- nightly database backups, checked every night and test-restored every week, and kept for 14 days;
- hosting in a data centre in Finland, inside the EU.
We may improve these measures over time. We will not lower the overall level of protection.
6. Sub-processors
You give us general permission to use the sub-processors below. Each is bound by a written contract with data protection terms that protect the data at least as well as this agreement. We stay responsible to you for their work.
| Sub-processor | What it does | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting, storage and backups for all Helio Guard data. | Helsinki, Finland (EU) |
| Sendinblue SAS (Brevo) | Delivering emails we send for you, such as Helio Guard reports and account notices. | France (EU) |
| IONOS | Receiving email sent to our support desk, if you include personal data in a support request. | EU |
| Anthropic PBC | Helping our support staff draft replies, using only the support conversation. Catch records and computer details are never sent. | United States |
Mollie B.V., our payment provider, processes card payments for us. For payments it acts as its own controller, not as our sub-processor. It receives none of the data in section 2.
Changes. We will email the account owner at least 30 days before we add or replace a sub-processor, and update this page. You can object on reasonable data protection grounds within that time. We will then work with you in good faith to find a fix. If we cannot, you may end the contract, and we will refund any payment for time after it ends.
7. International transfers
We store the data in the EU. The UK recognises the EEA as giving adequate protection.
Anthropic is in the United States. Any transfer to it is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We do not transfer the data anywhere else outside the UK or EEA without a safeguard that UK GDPR accepts.
8. Helping you
People's rights. If someone asks us to use their rights over data we hold for you, we will pass the request to you without undue delay. We will not answer it ourselves unless you tell us to. Helio Guard lets you view each person's records, and we will help you find, correct, export or delete data to answer a request.
Your other duties. Taking into account what we know, we will help you meet your duties under Articles 32 to 36 of UK GDPR. That covers security, breach notices, data protection impact assessments (DPIAs) and talking to the ICO. We will give you the information you reasonably need, such as this agreement and our privacy policy.
9. Personal data breaches
If we become aware of a personal data breach affecting data we hold for you, we will tell you without undue delay. We will do so within 48 hours of becoming aware of it at the latest.
We will email the account owner and tell you, as far as we know them:
- what happened, and the kinds and rough numbers of people and records affected;
- the likely effects;
- what we have done and will do about it;
- who to contact for more information.
Where we do not know everything yet, we will send what we have and follow up as we learn more. We will help you notify the ICO and the people affected where you need to.
10. At the end
When the contract ends, you choose whether we return or delete the data.
- Return: ask us before you close your account and we will send you a copy of your records in a common, machine-readable format.
- Delete: we delete the data within 30 days of the account being closed. Database backups roll over and are gone within a further 14 days.
We keep a copy only where the law requires us to.
11. Audits
On request, we will give you the information you reasonably need to show we meet this agreement. That includes answering security questionnaires.
If that is not enough, you or an independent auditor you choose may audit us. Give us at least 30 days' notice. Audits are limited to once in any 12 months, unless there has been a breach or a regulator asks. You pay your own costs, and auditors must agree to keep what they see confidential. An audit must not give access to other customers' data.
12. Your part
You are responsible for having a lawful basis for using Helio Guard, and for telling your staff before you switch it on. Your instructions to us must be lawful. Do not deliberately put special category data into Helio Guard settings.
13. Liability, length and law
The liability section of the terms applies to this agreement. This agreement lasts for as long as we process data for you, and then until it is deleted. It is governed by the law of England and Wales, and the courts of England and Wales deal with any dispute.
14. Contact
Nexborne Ltd. Registered in England and Wales. Company number 17375877. ICO registration ZC240034. Email support@heliosmsp.io.