LEGAL

PCBA Cost Estimate Service Terms and Conditions

Version pcba-cost-estimate-service-terms-2026-09-14 · Effective September 14, 2026

These Terms govern the PCBA Cost Estimate tool operated by NEXIOT PTE. LTD. (UEN 202312306Z) (NEXIOT, we, us or our). They cover the requested estimate, customer files, confidentiality, intellectual property and personal data. Schedule 1 is the Service Privacy Notice and forms part of these Terms. The Service is for business and professional use.

1 Acceptance and scope

1.1 The Customer (you or your) is the business identified in the submission that owns or lawfully controls the Customer Files. By selecting the acceptance checkbox and submitting a request, its representative accepts these Terms for that business and represents that they have authority to bind it and provide the submission. A sole trader accepts in that business capacity. Do not submit files without that authority.

1.2 NEXIOT is the contracting service provider for the Service and operates it under the NexPCB brand with authorisation. Use of the brand does not make the brand owner, an affiliated company or a Service Provider a contracting party, or give it independent rights to Customer Files or Personal Data. A different entity is responsible only where it is identified and separately agrees to provide a later quotation, manufacturing or other service.

1.3 These Terms take effect for each submission on electronic acceptance. The Service may be accessed through the NexPCB website or a Connected Platform. The Connected Platform's own terms and privacy notice apply to its platform services. Files selected through the Service's embedded upload interface are submitted to NEXIOT's Service environment; content that you separately enter or attach directly to the Connected Platform is handled by that platform under its own terms. Contract acceptance is separate from any consent required for Personal Data processing.

2 Definitions

2.1 Customer Files means all engineering packages and related technical content submitted by or for you, including Gerber, drill, bill of materials (BOM), Pick and Place, stackup, fabrication, manufacturing instructions, schematics, drawings, archives, file names and associated metadata, together with extracted content and Outputs to the extent they disclose that content. Non-public Customer Files are confidential without a confidentiality legend.

2.2 Outputs means the technical analysis and preliminary cost estimates generated for your submission. Service Providers means affiliates and external infrastructure, extraction, analysis, component-pricing, PCB-pricing, customer-contact and technical providers engaged to perform specified tasks for NEXIOT. Connected Platform means a third-party interface through which you choose to access the Service, such as OpenAI's ChatGPT or Anthropic's Claude.

2.3 Personal Data includes personal information as defined by the applicable law. Customer Personal Data means Personal Data in Customer Files that NEXIOT processes on your behalf. Service Administration Data means business contact and enquiry details, submission and acceptance records, and security and usage records processed by NEXIOT for the independent purposes described in Schedule 1. Extracting Personal Data from Customer Files does not by itself make it Service Administration Data.

2.4 Applicable Data Protection Law means Singapore's Personal Data Protection Act 2012 and its regulations (PDPA), the EU General Data Protection Regulation 2016/679 as applicable in the European Economic Area (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (CCPA), and any other binding privacy or data protection law applicable to the relevant processing. Statutory terms have their meanings under the applicable law. Contractual protections apply as written; statutory duties and rights apply where their legal conditions are met.

3 Service and estimate limitations

3.1 We will use reasonable care and skill to receive and analyse your submission and generate the requested estimate. Automated interpretation may be incomplete or inaccurate, and supplier prices, availability, quantities, lead times, currencies, taxes, freight and production assumptions may change. The estimate is indicative, is not a binding quotation or offer to manufacture, and does not reserve materials or capacity.

3.2 You should check the input files, assumptions and Outputs before relying on them for design, procurement or production. The Service does not certify manufacturability, safety, regulatory conformity or fitness for a particular application. You may question an Output or request a reviewed quotation through the Service. An estimate or quotation request does not create a manufacturing order. A reviewed quotation or later service may be offered by NEXIOT, an affiliate or another supplier; the relevant entity and its terms will be identified before you accept a binding quotation or order.

3.3 Any fee for an estimate or additional service must be disclosed and accepted before that work begins. An estimated manufacturing price is not a charge for using the Service. We do not guarantee continuous availability or a completion time unless expressly agreed. These limitations do not reduce our express confidentiality, security, privacy or intellectual property obligations, or exclude liability that cannot lawfully be excluded.

4 Customer responsibilities

4.1 You retain responsibility for the accuracy, completeness and lawful provision of the submission and your instructions. You must have the rights and permissions needed for the uses expressly authorised by these Terms, provide required privacy information and establish an applicable lawful basis, including consent where required. NEXIOT remains responsible for its own legal duties; your representations do not replace them.

4.2 Provide only Personal Data necessary for the requested service and remove unnecessary information from file contents, comments and metadata. Do not submit identity documents, account credentials, health information, other sensitive or special-category data, criminal-offence data or children's data unless we have first agreed in writing to a lawful process and appropriate safeguards. We may isolate, remove or return prohibited or unnecessary information and notify you where appropriate.

4.3 Do not upload malicious content, interfere with the Service or access another customer's information. You must comply with applicable export controls, sanctions and trade restrictions. Restricted files may be submitted only after obtaining the necessary authorisations and NEXIOT's prior written agreement to handle them.

5 Permitted Purpose and confidentiality

5.1 The Permitted Purpose is limited to receiving and unpacking your submission; identifying and extracting technical content; analysing specifications and obtaining relevant component and PCB pricing; generating and delivering your requested Outputs; securing and troubleshooting that processing; answering your requested follow-up or reviewed-quotation request; and maintaining the minimum records lawfully necessary for service administration, compliance and actual or reasonably anticipated disputes. Clause 9 restricts the processing of Customer Personal Data within this purpose.

5.2 NEXIOT will use Customer Files only for the Permitted Purpose, protect them under clause 8 and limit access to authorised persons with a need to know who are bound by confidentiality duties. NEXIOT will not sell, publish or disclose Customer Files except as expressly permitted by these Terms. We will not use submission data for unsolicited marketing, targeted advertising, cross-context behavioural advertising, AI model training, or independent product development, and will contractually prohibit Service Providers from doing so. We will not sell or share Personal Data as those terms are defined by the CCPA.

5.3 The confidentiality duty does not cover information to the extent NEXIOT can demonstrate that it was lawfully known without a confidentiality duty before receipt, became public without breach, was lawfully received from another source without a confidentiality duty, or was independently developed without using Customer Files. These exceptions do not transfer ownership, grant additional usage rights, or remove protection required for Personal Data.

5.4 Where disclosure is legally compelled and permitted under all applicable laws, we will disclose only what is required, give advance notice where lawful and reasonably practicable, and reasonably cooperate with your request for protective treatment. You bear reasonable external costs of additional assistance you request, except to the extent caused by our breach or otherwise required by law. A foreign authority's demand does not by itself authorise a disclosure or transfer prohibited by Applicable Data Protection Law. Professional advisers may receive only information necessary for lawful advice, subject to confidentiality and the same purpose limits.

6 Service Providers and disclosure limits

6.1 We may engage Service Providers, as defined in clause 2.2, only for tasks permitted under clause 5.1, after assessing their suitability and binding them in writing to appropriate confidentiality, security, purpose restrictions, incident reporting and return or deletion duties. Access must be limited to what their task requires.

6.2 Original archives and file binaries will be processed and stored within the Singapore-hosted Service environment. AI, analysis and pricing providers may receive only the extracted text snippets or structured technical and purchasing data reasonably necessary for their task. Known Personal Data must be removed or minimised first; any remaining Personal Data retains full protection. Original archives, original file binaries, upload URLs and download links must not be sent to those providers.

6.3 Only when you actively request project help or a reviewed quotation may the customer-contact provider receive your business contact details, request details, estimate summary and a protected internal record link. The original engineering package and downloadable result file are not sent with that request and are not accessible through the link. If a prospective quotation or fulfilment provider later needs Customer Files, we will explain the purpose and obtain separate confirmation before sharing them. The provider may not be known when the initial quotation request is submitted.

6.4 For Customer Personal Data, we will make available a current list or description of the relevant sub processors, their tasks and processing locations. Where reasonably practicable, we will give advance notice of a material addition or replacement. A change needed urgently for security, availability or legal compliance may take effect first, in which case notice will follow as soon as reasonably practicable. You may object on reasonable data protection grounds. We will consider the objection in good faith and, where reasonably available, offer an alternative; otherwise you may stop using the affected part of the Service.

6.5 Each sub processor of Customer Personal Data must assume the same applicable data protection obligations that bind NEXIOT, including clause 9 and any transfer safeguards. NEXIOT remains responsible to you for the obligations delegated to all Service Providers and fully liable for each sub processor's performance of its data protection obligations. Service Providers acting on our behalf for Service Administration Data must also receive written instructions and legally required processor, intermediary or service-provider terms.

7 Ownership and intellectual property

7.1 You and your licensors retain all ownership and intellectual property rights in Customer Files, including your technical content reflected in Outputs. You grant NEXIOT only a non-exclusive, limited permission to copy, transmit, extract, analyse and store Customer Files as necessary for the Permitted Purpose and the retention periods in clause 10. NEXIOT may extend that permission to Service Providers only as necessary to perform their authorised tasks and subject to these Terms.

7.2 Except for that limited permission, no patent, copyright, design, trade-secret, trademark, manufacturing or other commercial licence in Customer Files is granted. The Service does not authorise manufacture, sale, reuse for another customer, or commercial exploitation of your design. Any manufacturing permission must be agreed separately.

7.3 NEXIOT and its licensors retain pre-existing rights in the Service software, methods, templates and background materials. Those rights do not extend to your Customer Files. To the extent an Output includes material owned by NEXIOT, we grant you a perpetual, worldwide, royalty-free, non-exclusive right to use, copy and share that material as part of the Output for your project evaluation, procurement and related business purposes, subject to third-party rights disclosed before delivery. This does not transfer third-party rights that neither party owns or permit extraction of Service software.

7.4 Nothing in this clause transfers ownership of a person's Personal Data or limits their statutory rights. Deletion from the Service does not prevent you from retaining and using lawfully downloaded Outputs for your project.

8 Security and incidents

8.1 NEXIOT will maintain documented administrative, technical and organisational measures appropriate to the sensitivity of Customer Files, the Personal Data processed and the risks. These include access limited by role and need, confidentiality training, strong authentication for privileged access, encryption in transit and at rest where appropriate to risk, secure file handling, access logging, vulnerability and patch management, segregation of customer information, secure deletion, incident response, and recovery and resilience measures. We will regularly assess and test their effectiveness and make a description available to you on request. No internet service can guarantee absolute security.

8.2 We will promptly investigate suspected incidents, take reasonable steps to contain and mitigate them, preserve relevant evidence and record corrective action. We will notify your designated business contact without undue delay after becoming aware of a confirmed breach affecting Customer Files or Customer Personal Data, where notice is required by applicable law or is reasonably necessary for protective action. Notice may be provided in stages as reliable information becomes available.

8.3 The initial notice will contain available details of the incident, affected data and individuals, likely consequences, mitigation and a contact for updates. Missing details may follow promptly in stages. We will assist you with assessment and any legally required notifications. Each party remains responsible for notices required of it by law. We will not notify individuals or regulators on your behalf without your instructions unless the law requires us to do so, in which case we will inform you where lawful.

8.4 For processing for which we are the responsible organisation or controller, we will meet the applicable notification triggers and deadlines. Under the PDPA, this includes notifying the PDPC as soon as practicable and no later than three calendar days after determining that a breach is notifiable, and notifying affected individuals as soon as practicable where required, at or after the PDPC notification. Under the GDPR, this includes notifying the competent authority without undue delay and, where feasible, within 72 hours of awareness unless risk to individuals' rights and freedoms is unlikely, and notifying individuals without undue delay where high risk requires it. California and other applicable breach-notification laws govern their respective notices. A delay is permitted only to the extent the applicable law allows it.

9 Processing Customer Personal Data

9.1 This clause, together with clauses 4 to 6, 8, 10 and 11, constitutes the parties' data processing agreement for Customer Personal Data. The Customer is the organisation, controller or business, or an authorised processor engaging NEXIOT as a subprocessor, as applicable. NEXIOT acts as data intermediary, processor or CCPA service provider or contractor for that data. Actual processing determines the statutory roles. Schedule 1 explains NEXIOT's separate role for Service Administration Data.

9.2 The subject matter is processing Personal Data incidentally included in engineering submissions to produce the requested PCBA analysis and estimate. Processing consists of receiving, organising, extracting, reviewing, securely storing, transmitting limited task data, delivering results, troubleshooting, and deleting or returning data. The specific business purposes are the requested engineering-file analysis, component and PCB price matching, estimate delivery, related support expressly requested by the Customer, and security and error correction of those operations. Personal Data is disclosed to NEXIOT only for those limited purposes. Duration is from submission until deletion or return under clause 10, including any restricted lawful retention.

9.3 Data subjects are the Customer's personnel, contractors, representatives, suppliers, project contacts and other individuals identified in the submitted files. Data types are names, business contact details, professional affiliations and identifiers, and incidental identifying comments, signatures or metadata within the engineering content. Sensitive data is excluded under clause 4.2 unless the parties first document the additional scope and safeguards. The Customer controls the content and must document any material change in these categories before submitting it.

9.4 We will process Customer Personal Data only on your documented, lawful instructions, including those in these Terms and your service request, and only to the extent necessary and proportionate for clause 9.2. This applies to transfers as well as other processing. We will immediately tell you if we consider an instruction unlawful and suspend the affected processing while it is resolved. Processing outside instructions may occur only where legally required and permitted; where the GDPR applies to our processor role, that exception is limited to a requirement of EU or Member State law, with prior notice unless that law prohibits notice on important public-interest grounds. Clause 5.4 remains applicable.

9.5 Where the CCPA applies, we will comply with its applicable provisions and regulations and provide the same level of privacy protection required of a business. In addition to clause 5.2, we will not retain, use or disclose Customer Personal Data outside the specific purposes in clause 9.2 or the direct business relationship with you, or combine it with Personal Data from another customer, another source or our own interaction with an individual, except where the CCPA expressly permits the activity and these Terms and any other applicable law also permit it. NEXIOT certifies that it understands and will comply with these restrictions.

9.6 We will promptly relay privacy requests relating to Customer Personal Data to you and assist you, through appropriate measures and available information, to respond within the applicable deadline. You will provide the instructions and information needed for us to act. We will not give a substantive response on your behalf without your authorisation unless required by law. We may explain our service-provider role and direct the individual to the relevant Customer. We will implement valid instructions to access, correct, export, restrict or delete data and communicate them to relevant sub processors and other recipients as required.

9.7 Taking account of the processing and information available to us, we will assist with security, breach response, data protection impact assessments and prior regulatory consultation, including GDPR Articles 32 to 36. Where applicable, we will cooperate with your CCPA risk assessments, cybersecurity audits and automated-decision making obligations, provide relevant information in our possession or control, and not misrepresent relevant facts. We will maintain legally required processing records and cooperate with competent authorities.

9.8 On reasonable request, we will provide information reasonably necessary to demonstrate compliance, which may include relevant policies, summaries, certifications or independent audit reports. If those materials are insufficient and an audit is required by applicable law, you may arrange a proportionate audit by an independent auditor, subject to reasonable advance notice, an agreed scope, confidentiality, security safeguards and minimal disruption. You will bear the reasonable cost unless the audit identifies a material breach by NEXIOT. These conditions do not restrict a competent regulator or a reasonably necessary incident investigation.

9.9 We will notify you promptly if we determine that we can no longer meet our data protection obligations. Upon notice, you may take reasonable and appropriate steps to stop and remedy unauthorised processing, including directing suspension, remediation, return or deletion and requesting evidence of completion. If lawful compliance cannot be restored, either party may terminate the affected processing. These rights do not limit other available remedies.

10 Retention return and deletion

10.1 Original uploaded packages are scheduled for deletion from active Service storage seven days after upload. Temporary extracted working files are removed when processing and necessary troubleshooting finish, no later than that seven-day period. Online analysis files and results are retained for no more than 30 days after upload. We will monitor the deletion workflow and promptly correct failures. Download any Outputs you need before the relevant period expires; the Service is not a long-term archive.

10.2 A request for a formal quotation does not automatically extend retention. If files are needed for a later engagement, we will agree the files, purpose and retention period with you in writing before the ordinary period expires. A limited legal preservation may apply only where permitted or required under the applicable law, for the records and period actually necessary. For Customer Personal Data processed under the GDPR, retention after processing ends is allowed only where EU or Member State law requires storage. We will explain a restriction on deletion where lawful.

10.3 You may request earlier deletion or return of Customer Personal Data and Customer Files through clause 14.1. At the end of processing, we will, at your choice, return the data then held and delete remaining copies, or delete it, subject only to clause 10.2. Unless you instruct otherwise before scheduled deletion, you instruct us to delete under clause 10.1. We will act without undue delay and meet any shorter legal deadline. We will require corresponding action by Service Providers and confirm completion on request.

10.4 Backup copies awaiting secure overwrite must be isolated from ordinary use, remain protected, and be deleted within a documented, bounded backup cycle disclosed to the Customer before processing. Backup retention must not defer a legally required deletion. If a backup is restored, prior deletions and corrections must be reapplied before routine use. A backup is not a basis for renewed analysis, marketing or indefinite retention.

10.5 Limited submission metadata, contact details, file hashes, acceptance records, security records and privacy-request records may be retained as Service Administration Data only for the purposes in Schedule 1 and for as long as necessary under documented retention criteria. We assess the active request, applicable statutory duties and limitation periods, and actual security incidents or disputes, and periodically review necessity. We delete or irreversibly anonymise data when no longer needed. File hashes and pseudonymous records remain Personal Data where linkable to individuals. Customer technical content in retained records remains confidential.

11 Hosting and international transfers

11.1 Customer Files and core Service data are hosted in Singapore. Limited task data allowed by clause 6 may be processed by approved providers in countries where they operate, and authorised personnel may access data remotely where necessary to operate, secure or support the Service. We apply data minimisation, access controls and the protections in these Terms to those activities, and make information about relevant provider categories and locations available in the Service Privacy Notice or on request.

11.2 For transfers governed by the PDPA, NEXIOT will ensure a standard of protection at least comparable to that required by the PDPA, through legally enforceable recipient obligations or another legally available mechanism. Each party remains responsible for the transfer obligations applicable to it.

11.3 Where the GDPR applies and a transfer mechanism is required, the parties will use an available lawful mechanism, such as an applicable adequacy decision or the relevant European Commission standard contractual clauses, together with supplementary measures where required. A Customer that requires separately executed transfer terms for its own compliance should contact us before submitting Personal Data that depends on those terms.

11.4 Where UK data protection law applies and a transfer mechanism is required, the parties will use an available lawful mechanism, which may include an adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to the EU clauses. These Terms do not by themselves complete or execute those model clauses. Information about applicable safeguards is available from the Data Protection Officer under clause 14.1.

12 Termination survival and remedies

12.1 You may stop using the Service or request cancellation of an uncompleted submission. We may suspend or end affected processing where reasonably necessary to address a material breach, security risk, unlawful instruction or legal requirement, with notice and an opportunity to resolve the issue where practicable. Suspension or termination does not permit unrelated use or indefinite retention of data; clause 10 continues to apply.

12.2 Confidentiality obligations for each submission continue for five years after upload. Protection of trade secrets continues for as long as they remain trade secrets. Personal Data protections continue for as long as required by Applicable Data Protection Law, and all retained copies remain subject to the use, security and deletion restrictions applicable to them. Ownership, accrued rights and provisions intended to survive also continue.

12.3 Unauthorised use or disclosure may cause harm for which damages are inadequate, and either party may seek available injunctive or equitable relief. The Service is provided free of charge and for preliminary informational purposes. To the fullest extent permitted by law, NEXIOT is not liable for indirect, incidental, special, consequential or punitive damages, or for loss of profit, revenue, business or opportunity, arising from the Service or an estimate. Where liability cannot be excluded, NEXIOT's total aggregate liability arising from or relating to any submission will not exceed SGD 100. Nothing limits liability or statutory rights that cannot lawfully be limited, a regulator's powers, or liability under a separate later agreement.

13 Entire agreement changes and governing law

13.1 These Terms, including Schedule 1, consolidate the file confidentiality and Service privacy provisions for submissions accepted under this version and prevail over inconsistent general website terms for those submissions. Earlier submissions remain governed by the version accepted for them. Customer NDAs, purchase-order terms, file legends and other terms submitted through the automated Service do not amend this agreement. A separately executed later agreement may govern a later engagement or expressly identified files.

13.2 Applicable mandatory law and any binding international transfer clauses take priority. Clause 9 governs the parties' processor relationship for Customer Personal Data; Schedule 1 governs transparency and individual rights for NEXIOT's independent processing. The provisions must be read together. No general Service limitation or later privacy-notice update reduces confidentiality, processor obligations or non-waivable individual rights.

13.3 Amendments to these contractual Terms apply only to new submissions accepted under the amended version, unless both parties expressly agree otherwise. Privacy-notice changes follow Schedule 1. If a provision is unenforceable, it is limited only as necessary and the remainder continues in effect.

13.4 Singapore law governs this agreement, without regard to conflict-of-law rules. Contract disputes are subject to the courts of Singapore, except that either party may seek urgent protective relief in another competent court. This clause does not restrict an individual's mandatory rights to complain to a regulator, bring proceedings in an available statutory forum, or rely on mandatory protections under applicable European, California or other law.

14 Contact and electronic records

14.1 For Service questions, file requests or privacy matters, contact NEXIOT PTE. LTD., UEN 202312306Z, 36 ROBINSON ROAD, #21-01, CITY HOUSE, SINGAPORE 068877. Email: pcba.estimate@nexiot.sg. Address privacy questions, consent withdrawals, rights requests, transfer-safeguard requests and complaints to the Data Protection Officer at those contact details. Identify the submission or request and provide enough information to locate the relevant records.

14.2 We may retain the accepted document version, acceptance time, business email, file name and hash, IP address and browser information as evidence of electronic acceptance, subject to clause 10.5 and Schedule 1. The acceptance checkbox records the representative's electronic agreement on behalf of the Customer to the extent recognised by applicable law.

Schedule 1 Service Privacy Notice

This notice explains how NEXIOT handles Personal Data for the PCBA Cost Estimate Service. It applies to Service Administration Data for which NEXIOT determines the purposes and means of processing as an organisation under the PDPA and, where applicable, a controller under the GDPR or a business under the CCPA. For Customer Personal Data processed on a Customer's instructions, clause 9 applies; we assist that Customer with individual requests. We remain responsible for any duties that apply directly to us in either role.

A Information and sources

A.1 We collect contact and request details, including name, business email, optional company name, country or region, optional city, requested quantity and enquiries; submitted project content and results, including file names, hashes, extracted information, analysis and estimates, which may contain Personal Data; and Service records, including submission times, IP address, browser information and the document versions accepted at upload.

A.2 Information comes directly from you, automatically from Service interactions, from files and communications supplied by you or your authorised colleagues, and, when used, through a Connected Platform. A Connected Platform may separately collect account, conversation and usage information under its own privacy notice. Files uploaded through the Service's embedded interface are submitted to NEXIOT; content separately entered or attached to the platform is handled by that platform. We generate analysis and estimates from submissions and supplier-pricing information. Clause 9 governs Customer Personal Data within those inputs and Outputs.

A.3 Business contact details and the requested technical information are needed to process the request; company name and city are optional. Without necessary information, we may be unable to provide an estimate or requested assistance. Please keep your details accurate. The minimisation and sensitive-data restrictions in clause 4.2 apply.

B Purposes recipients and shared safeguards

B.1 NEXIOT processes Service Administration Data to deliver and communicate about your requested estimate, respond to requested assistance, maintain and troubleshoot the Service, detect misuse and security incidents, evidence acceptance, answer privacy requests and complaints, meet applicable legal duties and handle legal claims. Processing must be necessary and proportionate to the relevant purpose. The Permitted Purpose in clause 5.1 sets the overall limits; it does not supply a lawful basis for every kind of Personal Data processing.

B.2 Clauses 5 and 6 identify the permitted recipients, task-specific disclosure limits and prohibitions on marketing, sale, advertising and model training. A Connected Platform may receive the limited account, instruction, status and result information needed to invoke and display the Service, but NEXIOT does not send the original engineering package to the platform through the connected Service. Clauses 8, 10 and 11 explain security, retention and international processing. Professional advisers and public authorities receive information only as lawfully permitted or required under clause 5.4.

B.3 We will give any additional notice, establish a valid legal basis and obtain consent where required before a new purpose begins. Neither acceptance of these Terms nor a later notice update retrospectively authorises an incompatible use of data already collected.

C Cookies and automated analysis

C.1 Where we use cookies or similar technologies, we will identify their purposes, providers and duration and provide legally required choices before use. Non-essential technologies will not operate before consent where consent is required. Browser controls may also block or delete cookies, although blocking necessary technologies can affect the Service. Providers are not permitted to track Service users across unrelated websites for their own advertising purposes.

C.2 Automated file analysis generates a preliminary technical and cost estimate about the submitted project. When you use a Connected Platform, limited status, confirmation fields and aggregate results may be displayed through that platform. The Service does not make a solely automated decision about an individual with legal or similarly significant effects. You may question a result or request a reviewed quotation through the Service.

D Singapore PDPA

D.1 We notify individuals of the purposes of collection, use and disclosure and obtain consent where the PDPA requires it. Deemed consent is relied on only where its statutory conditions are met. Processing without consent occurs only where the PDPA or another written law permits or requires it and the relevant conditions are satisfied. We do not condition the Service on consent to purposes beyond what is reasonable for providing it.

D.2 You may withdraw consent, including deemed consent, by giving reasonable notice to the Data Protection Officer in clause 14.1. We will explain the likely consequences and when withdrawal takes effect. Withdrawal may prevent completion of an estimate or assistance. We and our data intermediaries and agents will stop the affected processing unless processing without consent is legally permitted or required; lawful retention remains subject to clause 10.

D.3 Subject to statutory exceptions, you may request access to your Personal Data and information about how it has been or may have been used or disclosed in the preceding year, and correction of errors or omissions. We provide access as soon as reasonably possible and make corrections as soon as practicable. If we cannot respond to an access or correction request within 30 days, we will notify you in writing within that period when we expect to respond.

D.4 We may charge a reasonable access fee after providing a written estimate and obtaining your agreement; corrections are free. We will explain any refusal as required, preserve relevant data where the law requires, and send corrections to previous recipients where required. We consider deletion requests under the PDPA and our retention duties; the PDPA does not give an unrestricted erasure right. You may complain to Singapore's Personal Data Protection Commission at www.pdpc.gov.sg. These fee rules do not override another applicable law's requirement to handle a request free of charge.

E European and UK privacy rights

E.1 Where the GDPR or UK data protection law applies to NEXIOT's independent processing, the legal bases are as follows. For a requested service where you personally are the contracting party, necessary processing to perform that contract or take requested pre-contract steps relies on Article 6(1)(b). For representatives of business customers, necessary service communications and relationship management rely on Article 6(1)(f), reflecting our and the Customer's legitimate interests in delivering the requested business service.

E.2 Necessary Service operation, security, troubleshooting, acceptance records and legal claims rely on Article 6(1)(f), reflecting our interests in a reliable and secure Service and protecting legal rights. We assess whether individuals' interests and fundamental rights override those interests before relying on them. Article 6(1)(c) applies only to a binding obligation under applicable EU or Member State law, or UK law for UK processing; a foreign legal demand alone is not sufficient. Article 6(1)(a) applies to a specified optional activity where we request consent. Consent may be withdrawn at any time without affecting earlier lawful processing.

E.3 Subject to legal conditions and exceptions, you may access and obtain a copy of your data, correct it, seek erasure or restriction, and obtain data you supplied in a portable format where processing is automated and based on consent or contract. You may request direct transfer to another controller where technically feasible. You may object to legitimate-interest processing on grounds relating to your situation; we will stop unless we establish overriding compelling grounds or the processing is necessary for legal claims. Any direct-marketing objection will be honoured without that balancing test.

E.4 We respond without undue delay and normally within one month. Where legally permitted because of complexity or the number of requests, we may extend by up to two further months and explain why within the first month. Requests are normally free; a fee or refusal is possible only where the law permits, including a manifestly unfounded or excessive request. Identity checks must be proportionate. We will explain a refusal and available remedies.

E.5 Contact the Data Protection Officer under clause 14.1. You may complain directly to the supervisory authority in the EEA country of your habitual residence, workplace or the alleged infringement, or to the UK Information Commissioner's Office where applicable. You need not contact us first. Where legally required, NEXIOT will appoint an EEA or UK representative and publish the representative's identity and contact details with this notice before the relevant processing begins.

F California disclosures and rights

F.1 This section applies where the CCPA governs the processing, including covered business-contact information. The table identifies collection categories and recipients for business purposes. Sources are in section A, purposes in section B, and retention periods and criteria in clause 10; those provisions apply to each relevant category. We disclose only the minimum information allowed by clause 6. We will maintain the historical category disclosures required for the preceding 12 months in the notice published with the Service and update them at least annually.

F.2 The sale, sharing and other use prohibitions in clause 5.2 apply to all Personal Data, including data of individuals under 16. We do not use sensitive Personal Data to infer characteristics about people. Incidental sensitive information is handled only within uses permitted by the CCPA and any stricter applicable law. We do not offer financial incentives for Personal Data.

F.3 Subject to applicable exceptions, you may request the categories and specific pieces of Personal Data collected, sources, purposes and categories of recipients; obtain a portable copy; and request correction or deletion. You have rights to opt out of sale or sharing and to limit use and disclosure of sensitive Personal Data where those rights apply. We will not unlawfully discriminate or retaliate because you exercise a privacy right.

F.4 Send requests to the Data Protection Officer's email or postal address in clause 14.1, or through additional designated methods published with this notice where required. NEXIOT will provide a website request method and a toll-free telephone method if required by the CCPA; the email-only exception will be used only where the business operates exclusively online and has a direct relationship with the relevant consumer. You may use an authorised agent as permitted by law. We may proportionately verify identity and agent authority for requests requiring verification, without requiring you to create an account. Opt-out requests do not require identity verification.

F.5 We acknowledge requests to know, delete or correct within 10 business days and respond within 45 calendar days. A legally permitted extension may add up to 45 calendar days, with notice and reasons within the initial period. Applicable sale-or-sharing opt-outs and sensitive-information limitation requests will be implemented as soon as feasible and no later than 15 business days, or sooner if the law requires. Requests are free except where the CCPA expressly permits a fee. We will explain any refusal or applicable exception and provide required information about complaints.

F.6 We recognise Global Privacy Control and other legally required opt-out preference signals. Under the practices stated in this notice there is no sale, advertising sharing or targeted advertising to stop. Conventional Do Not Track browser signals do not change processing necessary to provide the Service. You may complain to the California Privacy Protection Agency or California Attorney General.

G Other applicable rights and updates

G.1 Where another applicable US state law gives you privacy rights, we will honour those rights and the applicable verification, response, appeal and opt-out requirements. Send requests or appeals to the Data Protection Officer using clause 14.1. We will explain any refusal and, where required, how to contact the competent authority.

G.2 We publish the current notice and its effective date with the Service and review it regularly. We will notify material changes and obtain fresh consent where required. Changes do not retrospectively authorise incompatible processing. Questions and complaints may be sent to the Data Protection Officer.