# Joint Controller Arrangement ## Between Nexus Technologies GmbH and Meridian Analytics B.V. **Effective Date**: 2026-02-01 **Arrangement Reference**: JCA-2026-001 --- ## 1. Parties | Detail | Controller 1 | Controller 2 | |--------|-------------|-------------| | Legal Entity | Nexus Technologies GmbH | Meridian Analytics B.V. | | Registered Address | Friedrichstraße 108, 10117 Berlin, Germany | Herengracht 420, 1017 BZ Amsterdam, Netherlands | | Registration | HRB 182734 B, Amtsgericht Charlottenburg | KvK 78234561 | | DPO | Dr. Katharina Weiss, dpo@nexus-tech.eu | Lars van den Berg, dpo@meridian-analytics.nl | --- ## 2. Scope of Joint Processing | Element | Detail | |---------|--------| | Processing Activities | Operation of the shared customer insights platform "InsightHub" which combines Nexus customer transaction data with Meridian analytical models to generate customer segmentation and purchasing propensity scores | | Personal Data Categories | Customer name, email, purchase history, product preferences, website behaviour (pseudonymised), segmentation labels, propensity scores | | Data Subject Categories | Nexus Technologies GmbH customers who have made at least one purchase and have active accounts (approximately 145,000 individuals) | | Processing Location | EU data centres (Frankfurt, Germany — AWS eu-central-1) | --- ## 3. Purpose Determination Both controllers jointly determine the purpose of processing as: generating customer segmentation insights and purchasing propensity scores to enable Nexus to personalise product recommendations and marketing communications, and to enable Meridian to improve and validate its analytical models. - **Nexus's purpose**: Personalised marketing and product recommendations for existing customers based on data-driven segmentation. - **Meridian's purpose**: Model validation and improvement using real-world transaction data to enhance the accuracy of predictive analytics products. Both purposes are pursued through the common InsightHub platform and are interdependent. --- ## 4. Means Determination | Essential Means | Determined By | |----------------|---------------| | Data elements to be processed | Jointly — both parties agreed on the data schema | | Retention periods | Jointly — 24 months from last customer interaction | | Access controls and authorisation | Nexus (platform operator) with Meridian review | | Analytical methodology | Meridian (model design and execution) | | Security standards | Jointly — minimum ISO 27001 equivalent controls | | Hosting infrastructure | Nexus (AWS eu-central-1, Frankfurt) | --- ## 5. Responsibilities Allocation | GDPR Obligation | Responsible Party | Detail | |----------------|-------------------|--------| | Lawful basis (Art. 6) | Nexus | Nexus establishes and documents the lawful basis (Art. 6(1)(f) legitimate interest with documented LIA ref: LIA-2026-IH-001) | | Privacy notices (Art. 13-14) | Nexus | Nexus provides privacy notice to data subjects including disclosure of Meridian as joint controller | | Data subject rights (Art. 15-22) | Nexus (designated contact) | Nexus serves as the contact point. Meridian must respond to Nexus's coordination requests within 5 business days | | Security (Art. 32) | Joint | Both parties implement agreed security standards. Nexus is responsible for platform security; Meridian for its analytical environment security | | Breach notification (Art. 33-34) | Nexus (primary) | Nexus notifies the BfDI (German federal DPA) within 72 hours. Meridian notifies Nexus within 24 hours of discovering a breach | | DPIA (Art. 35) | Joint | Joint DPIA conducted and co-signed (ref: DPIA-2026-IH-001) | | RoPA (Art. 30) | Both independently | Each party maintains its own Art. 30 records referencing this arrangement | --- ## 6. Contact Point for Data Subjects The designated contact point is Nexus Technologies GmbH: - **Email**: privacy@nexus-tech.eu - **Post**: Data Protection Office, Nexus Technologies GmbH, Friedrichstraße 108, 10117 Berlin, Germany - **Response commitment**: Within the Art. 12(3) timeline of one month from receipt Per Art. 26(3), data subjects may exercise their rights against either Nexus or Meridian regardless of this designation. --- ## 7. Transparency — Essence of the Arrangement The following essence is published on both parties' websites and included in Nexus's privacy notice: > Nexus Technologies GmbH and Meridian Analytics B.V. jointly operate the InsightHub customer analytics platform. Nexus provides customer transaction data and Meridian provides analytical processing to generate customer segmentation insights. Nexus is responsible for providing privacy information and handling data subject rights requests. You may contact Nexus at privacy@nexus-tech.eu or Meridian at dpo@meridian-analytics.nl. You have the right to exercise your GDPR rights against either organisation. --- ## 8. Security Standards Both parties commit to maintaining: - ISO 27001 certified or equivalent information security management - AES-256 encryption for data at rest - TLS 1.3 for data in transit - Role-based access control with quarterly access reviews - Annual penetration testing by independent third parties - Multi-factor authentication for all platform access - Logging and monitoring of all data access with 12-month log retention --- ## 9. Breach Management | Scenario | Action | Timeline | |----------|--------|----------| | Meridian detects breach | Notify Nexus DPO | Within 24 hours | | Nexus detects breach | Notify Meridian DPO | Within 24 hours | | Supervisory authority notification | Nexus notifies BfDI | Within 72 hours of awareness | | Data subject notification (if required) | Nexus communicates | Without undue delay per Art. 34 | | Forensic investigation | Joint investigation team | Commence within 48 hours | --- ## 10. Liability Both parties acknowledge joint and several liability to data subjects under Art. 82(4). Internally, liability is allocated proportionally to each party's contribution to the processing that caused the damage. Where a determination cannot be made, liability is shared equally. The party that pays full compensation to a data subject is entitled to claim contribution from the other party per Art. 82(5). --- ## 11. Term and Termination - **Duration**: This arrangement is effective from 2026-02-01 and continues for an initial term of 24 months, renewable annually thereafter. - **Termination**: Either party may terminate with 90 days' written notice. Upon termination, Meridian deletes all personal data received from Nexus within 30 days and provides written confirmation of deletion. - **Survival**: Sections 9 (Breach Management), 10 (Liability), and security obligations survive termination for 3 years. --- ## 12. Art. 26(3) Acknowledgment Both parties acknowledge that, irrespective of the terms of this arrangement, data subjects may exercise their rights under the GDPR against each and any of the joint controllers. --- **Signed for Nexus Technologies GmbH**: Dr. Katharina Weiss, DPO — 2026-02-01 **Signed for Meridian Analytics B.V.**: Lars van den Berg, DPO — 2026-02-01