Legal
NextBayt's International Data Protection Addendum (EU/EEA, UK, and Switzerland).
NextBayt Analytics FZCO
Effective Date: 21 August 2026 Last Updated: 21 August 2026
NOTICE — THIS DOCUMENT HAS THREE PARTS WITH DIFFERENT LEGAL EFFECT. Part A (EU/EEA) is effective now and applies to all EU/EEA users. Part B (United Kingdom) and Part C (Switzerland) are drafted and ready but do not yet apply — see Section 1 for the activation condition.
This International Data Protection Addendum ("Addendum") supplements, and forms part of, our Terms of Service, Privacy Policy, Cookie Policy, and Data Processing Agreement and Sub-Processor Disclosure (together, the "Core Documents"). It is divided into three parts:
Where an applicable Part of this Addendum conflicts with a Core Document on a matter specific to that jurisdiction's data protection law, this Addendum governs for users located in that jurisdiction; the Core Documents continue to govern all other matters and all other users.
NextBayt Analytics FZCO, a Free Zone company registered in Dubai, United Arab Emirates (IFZA, Dubai Silicon Oasis, Trade License No. 89752), is the controller of personal data described in this Addendum and the Privacy Policy, except where the Privacy Policy identifies a Broker Partner or other third party as an independent controller. NextBayt does not have an establishment in the European Union, the United Kingdom, or Switzerland.
Part A is effective now and applies to all EU/EEA users.
As NextBayt has no establishment in the EU/EEA, NextBayt has appointed an EU representative under Article 27 of Regulation (EU) 2016/679 ("GDPR") to act as an additional point of contact for supervisory authorities and data subjects in relation to NextBayt's processing of EU/EEA personal data:
EU Representative: Prighter GmbH Address: Schellinggasse 3, 1010 Vienna, Austria Contact: via Prighter's Privacy Rights Manager (PRM) tool, referenced in Section A.5(d) below, or the contact details in Section 14
You may contact NextBayt's EU Representative, or NextBayt directly at the details in Section 14, regarding any matter addressed in this Part A. Appointing an EU Representative does not transfer or reduce NextBayt's own responsibility as controller. When providing advice and support, Prighter GmbH acts in its own capacity as controller of the limited contact/request data it handles in that role; when providing the underlying technical infrastructure and the Privacy Rights Manager tool used to channel data subject requests to NextBayt, Prighter GmbH acts as NextBayt's processor.
This section supplements Section 7 of the Privacy Policy (Legal Bases Under PDPL) by mapping NextBayt's processing to the equivalent legal bases recognized under Article 6 GDPR for users in the EU/EEA:
a) Contract (Article 6(1)(b)): processing necessary to perform the contract with you, including account provisioning, delivering the Deal Score, Fair Price Estimate, Risk Analysis, and PDF Dossier features, generating AI Assistant responses, personalizing your Deal Score and Fair Price Estimate based on preferences you share with the AI Assistant, billing through Stripe, and the underlying hosting infrastructure necessary to operate the Service at all.
b) Consent (Article 6(1)(a)): for processing requiring your affirmative agreement, including use of your AI Assistant chat content to train or improve AI systems, marketing and proactive deal-matching contact, and non-essential cookies and tracking technologies. You may withdraw consent at any time as described in Section 16 of the Privacy Policy, without affecting the lawfulness of processing carried out before withdrawal.
c) Legitimate Interests (Article 6(1)(f)): for processing necessary for NextBayt's legitimate interests, including Service security and fraud prevention, and product analytics to improve the Service, provided such interests are not overridden by your interests or fundamental rights and freedoms. Where NextBayt relies on legitimate interests, NextBayt has carried out a balancing assessment weighing its interest against your rights; you have the right to object to processing carried out on this basis at any time, per Section A.8 below.
d) Legal Obligation (Article 6(1)(c)): processing necessary to comply with applicable law, including tax and accounting record-keeping and responding to lawful requests from competent authorities.
Because NextBayt is established in the United Arab Emirates and engages sub-processors located in the United States and China, transferring your personal data outside the EU/EEA is a necessary and ongoing feature of the Service. For users in the EU/EEA, NextBayt relies on the following transfer mechanisms rather than on individual consent as the primary basis (unlike the consent-based approach described in Section 10 of the DPA, which applies to NextBayt's non-EU/EEA users):
a) Standard Contractual Clauses (SCCs), adopted by the European Commission on 4 June 2021, executed with sub-processors as follows: - Google Cloud Platform (hosting): SCCs incorporated under Google Cloud's data processing terms; Google LLC also self-certifies under the EU-U.S. Data Privacy Framework, providing an alternative Article 45 adequacy basis for the same transfer. - Anthropic (Claude API): SCCs (Module Two and/or Module Three, as applicable), per Anthropic's Data Processing Addendum. - OpenAI (ChatGPT API): EU/EEA data is contracted through OpenAI Ireland Limited, which transfers data to non-EEA OpenAI affiliates or sub-processors under SCCs or an applicable Article 45 adequacy decision. - Stripe, Google Analytics, Microsoft Clarity, Meta Pixel: SCCs incorporated under each vendor's respective standard data processing terms.
b) AI chat routing restriction specific to EU/EEA users: For users located in the EU/EEA, NextBayt routes AI Assistant queries only to Anthropic (Claude) and OpenAI (ChatGPT). NextBayt does not route EU/EEA users' AI Assistant queries to Moonshot AI (Kimi) or DeepSeek. This routing restriction applies only to EU/EEA users; users elsewhere may have their queries routed to any of the four AI vendors described in the Privacy Policy.
c) Where SCCs or an adequacy decision are not available for a specific, occasional transfer, NextBayt may rely on your explicit consent as a derogation under Article 49 GDPR, consistent with the consent-based disclosure in the Privacy Policy, but this is not NextBayt's primary or intended basis for the routine, ongoing transfers described above.
d) EU Representative infrastructure: if you submit a data subject request or a matter to NextBayt's EU Representative (Section A.3), that request is processed using Prighter's Privacy Rights Manager (PRM) tool and, for personal data breach matters, Prighter's Data Breach Tool, both operated by Prighter GmbH using Hetzner Online GmbH (Germany) as its data center provider, before being forwarded to NextBayt. This is disclosed as a sub-processing activity in the DPA and Privacy Policy sub-processor tables.
This section supplements Section 9(g) of the Privacy Policy and Section 2.4 of the Terms of Service.
The Deal Score and Fair Price Estimate are generated by a fixed, deterministic, rule-based methodology; no part of the scoring calculation itself is performed by a generative AI model. Where you share a preference with the AI Assistant, NextBayt uses a generative AI model only to extract and classify that stated preference (for example, that proximity to a school or a specific amenity matters to you); the extracted preference is then used to adjust the weighting applied within the fixed scoring methodology.
NextBayt's position is that this does not constitute a decision "based solely on automated processing" that "produces legal effects concerning you or similarly significantly affects you" within the meaning of Article 22(1) GDPR, because: (a) the Deal Score and Fair Price Estimate are informational and do not determine your eligibility for, or grant or deny you access to, any right, benefit, service, or transaction; (b) you retain full discretion to disregard the output entirely; and (c) NextBayt provides meaningful transparency about the scoring logic, as described below.
Transparency measures provided regardless of the above position: for any property where personalization has been applied, the Service displays both (i) the baseline Deal Score/Fair Price Estimate calculated without personalization, and (ii) your personalized Deal Score/Fair Price Estimate, together with an indication of the direction and general basis of the adjustment (for example, that proximity to schools was weighted more heavily based on your stated preference).
Additional safeguard: if you believe a Deal Score or Fair Price Estimate you received should be reviewed, you may request that NextBayt review the specific inputs and weighting applied to your score, and provide your own views, by contacting us at the details in Section 14. NextBayt will respond to such requests within a reasonable time.
For visitors accessing the Site from the EU/EEA, non-essential cookies (as categorized in the Cookie Policy — analytics, session replay, and advertising cookies) are set only with your prior, affirmative opt-in consent, obtained through the Site's cookie consent tool. Strictly necessary cookies (Cookie Policy Section 4.1) do not require consent and are set regardless, as they are necessary for the Site to function. You may withdraw consent at any time using the cookie consent tool or your browser settings, consistent with Section 9 of the Cookie Policy.
In addition to the rights described in Section 16 of the Privacy Policy, if you are located in the EU/EEA you have the right to:
a) Lodge a complaint with a supervisory authority in your EU/EEA member state of habitual residence, place of work, or place of the alleged infringement, without prejudice to any other administrative or judicial remedy; b) Object to processing based on legitimate interests (Section A.4(c) above) or carried out for direct marketing purposes, at any time and free of charge; c) Request data portability, i.e., to receive personal data you have provided to NextBayt in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where technically feasible, for processing carried out by automated means on the basis of consent or contract; d) Not be subject to a decision based solely on automated processing producing legal or similarly significant effects, as further addressed in Section A.6 above.
NextBayt will respond to requests exercising these rights within one month of receipt, extendable by a further two months where necessary taking into account the complexity and number of requests, in which case you will be informed of the extension and the reasons for the delay within the first month.
If you are a consumer located in the EU/EEA, you have the right to withdraw from a paid Subscription within fourteen (14) days of the contract for that Subscription being concluded, without giving any reason, under Directive 2011/83/EU (as implemented in your member state).
This right does not apply to NextBayt's free trial, because no payment is taken and no paid contract is concluded during the trial period described in Section 5.3 of the Terms of Service.
When you subscribe to a paid plan, you will be asked, before payment is taken, to separately confirm: (a) that you request immediate access to the Pro Tier features from the start of your Subscription, and (b) that you acknowledge that, by requesting immediate access, you lose your right of withdrawal once the Service has been fully performed, consistent with Article 16(m) of Directive 2011/83/EU. If you do not provide this confirmation, NextBayt will not begin providing Pro Tier access until the 14-day withdrawal period has elapsed.
Where you validly withdraw before the Service has been fully performed, NextBayt may deduct an amount proportionate to the Pro Tier access already supplied up to the point of withdrawal, calculated by reference to the total contract price, consistent with Article 14 of Directive 2011/83/EU.
Part B is prepared and ready but does not yet apply — see Section 1. The United Kingdom remains an Excluded Territory under the Terms of Service until activation.
Upon activation of this Part B, NextBayt will have appointed a representative in the United Kingdom under Article 27 of the UK GDPR (the retained, UK-domesticated version of the EU GDPR) to act as an additional point of contact for the Information Commissioner's Office ("ICO") and UK data subjects:
UK Representative: [to be appointed — candidate: Prighter "UK GDPR Rep Growth"] Address: [to be filled in upon appointment] Email: [to be filled in upon appointment]
Upon activation, the legal bases described in Section A.4 above apply equally under the UK GDPR (which retains the same Article 6 structure as the EU GDPR), substituting the ICO as the relevant supervisory authority in place of an EU national authority.
Upon activation, transfers of UK personal data outside the UK will rely on: (a) the UK International Data Transfer Agreement ("UK IDTA") or the UK Addendum to the EU SCCs, issued by the ICO, executed with Google Cloud Platform, Anthropic, and OpenAI (each of which already supports the UK Addendum alongside their EU SCCs, per their published Data Processing Addenda); and/or (b) the UK Extension to the EU-U.S. Data Privacy Framework, where the relevant vendor is certified. The same AI chat routing restriction described in Section A.5(b) will apply: UK users' AI Assistant queries will be routed only to Anthropic and OpenAI, never to Moonshot AI or DeepSeek.
Upon activation, the position and transparency measures described in Section A.6 apply equally under the UK GDPR, which contains an equivalent Article 22.
Upon activation, the opt-in consent requirement described in Section A.7 will apply equally to UK visitors under the UK's Privacy and Electronic Communications Regulations (PECR) and UK GDPR.
Upon activation, the rights described in Section A.8 apply equally under the UK GDPR, save that complaints may be lodged with the ICO.
Upon activation, UK consumers will have an equivalent 14-day right of withdrawal from a paid Subscription under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, with an equivalent immediate-access waiver mechanism to that described in Section A.9 for EU/EEA consumers (Regulations 36-37).
Part C is prepared and ready but does not yet apply — see Section 1. Switzerland remains an Excluded Territory under the Terms of Service until activation.
Article 14 of the revised Swiss Federal Act on Data Protection ("revFADP") requires a foreign controller to appoint a representative in Switzerland only where all of the following apply: the processing relates to offering goods/services to, or monitoring the behavior of, individuals in Switzerland; the processing is on a large scale; the processing is regular; and the processing poses a high risk to the data subjects' personality rights or fundamental rights. NextBayt will assess whether this threshold is met based on actual Swiss user volume before or promptly after activation, and will appoint a representative if the threshold is met:
Swiss Representative: [to be appointed if the Article 14 threshold is met — candidate: Prighter "Swiss FADP Rep Growth"] Address: [to be filled in upon appointment, if applicable] Email: [to be filled in upon appointment, if applicable]
Upon activation, NextBayt processes Swiss personal data on grounds broadly equivalent to those described in Section A.4, as recognized under the revFADP, with the Federal Data Protection and Information Commissioner ("FDPIC") as the relevant supervisory authority.
Upon activation, transfers of Swiss personal data outside Switzerland will rely on the Swiss Federal Council's adequacy list (Annex 1 to the Swiss Data Protection Ordinance), which already recognizes the EEA, the United Kingdom, and, since September 2024, the United States for companies certified under the Swiss-U.S. Data Privacy Framework extension — covering Google Cloud Platform and any similarly certified AI vendor without the need for separate Swiss-specific contractual clauses. Where a sub-processor is not on the adequacy list, NextBayt will rely on SCCs as for EU/EEA transfers. The same AI chat routing restriction described in Section A.5(b) will apply: Swiss users' AI Assistant queries will be routed only to Anthropic and OpenAI, never to Moonshot AI or DeepSeek, as China is not on the Swiss adequacy list.
Upon activation, the position and transparency measures described in Section A.6 apply equally as a matter of good practice under the revFADP.
Upon activation, NextBayt will apply the same cookie disclosure and control practices described in Section A.7 as good practice; the revFADP does not impose a strict opt-in consent requirement equivalent to the EU ePrivacy regime, but transparent notice and control remain required.
Upon activation, Swiss data subjects will have rights broadly equivalent to those described in Section A.8, exercisable before the FDPIC and Swiss courts, subject to the specific scope of those rights under the revFADP (which differs in some respects from the GDPR).
Swiss law does not grant consumers a general statutory right of withdrawal from online or distance contracts, unlike the EU/EEA (Section A.9) and the UK (Section B.9). Accordingly, no equivalent withdrawal mechanism applies to Swiss consumers upon activation, and NextBayt's standard non-refundable Subscription terms (Terms of Service Section 5.7) apply in full to Swiss consumers without modification.
The Service is not directed to, and must not be used by, individuals under the age of 18, consistent with Section 1.3 of the Terms of Service. This applies equally under all Parts of this Addendum.
For any question about this Addendum or to exercise a right described above, please contact:
NextBayt Analytics FZCO IFZA, Dubai Silicon Oasis, Dubai, United Arab Emirates Email: [email protected]
EU Representative (Part A, active): Prighter GmbH — Schellinggasse 3, 1010 Vienna, Austria — via the Privacy Rights Manager (PRM) tool referenced in Section A.5(d) UK Representative (Part B, not yet active): [to be appointed] Swiss Representative (Part C, not yet active, if required): [to be appointed if applicable]
NextBayt may update this Addendum from time to time, consistent with Section 23 of the Privacy Policy. Material changes, including activation of Part B or Part C, will be notified consistent with that Section.
