It's not a short, or pretty, story, but beginning well before WinXP Microsoft decided to do "something" about pirated software, and particularly about Windows.
With WinXP, the most common way for most people to get it is to receive it preinstalled on a new computer. Any machine received with preinstalled Windows should have a "Certificate of Authenticity" affixed to the outside of the PC case with a "Product Key" on it. The appearance of the external sticker, with a Product Key shown on it, indicates an OEM version that is "part of the computer." An OEM version is not transferable to another computer. Normal addition of plugins, cards, drives, etc will not affect it, but replacing the motherboard except "with an identical board due to a hardware failure by the original OEM maker" is "making a new machine out of it" and Microsoft expects you to get a new copy of WinXP.
Microsoft provides no tech support for OEM Windows. The OEM maker is your only source of tech support. (Updates and patches are not "support" and usually should come only from Microsoft.)
It is possible for someone to build a machine for you and separately purchase a retail copy of Windows to install on it, in which case the OEM sticker would not be present. If the Windows is purchased separately at retail, it's what they call an "FPP Copy" (Full Purchase Package) and you can use it on any machine, provided it's on only one machine at a time. If the NUC you got the machine from claims to be using an FPP copy, he is required to transfer the original disks, packaging, manuals and all associated parts and pieces with the transfer of ownership to you.
With an FPP copy of WinXP, you can call Microsoft for tech support, free within a limited warranty period and for a fee after the warranty.
Any WinXP copy must be "registered" with Microsoft to get full function. After a specific number of reboots, some (undefined) functions will be disabled. Apparently quite a few people never miss the stuff that doesn't work; but it's a lot nicer if everything is there.
An OEM maker/installer often will "register" the copy before you receive the machine, but you may be asked to confirm it when you make contact with any Microsoft web site. You must do the registration yourself for an FPP copy unless the NUC did it for you.
When you connect to register, you normally will be asked for permission to install an "applet" that manages the process on your machine. A minimal amount of other information, specifically including your "Product Key" will probably be requested. Download of the applet may require you to tell any "cookie blocker" you have installed that Microsoft has this one-time permission to pass it to you.
The registration applet will look primarily at the PnP identifiers on a few key hardware components on your machine and will generate a registration number that includes your Product Key and a code describing your machine. That RegNo will be encrypted and stored on your machine, and also will be transmitted to Microsoft. Only the bits of info that you put on their questionare and the coded number that identifies the parts used in your machine will be returned to Microsoft. No "personal information" such as your location, DNS address, etc is included.
Some NUCs have found that they are able to locate the RegNo and copy it to another machine. If the RegNo they copy across does not match the hardware on your machine, it is very likely to be questioned eventually, if not immediately. If the same Product Key has been reported by more than one "machine" they likely will inform you that you have an illegal copy, and will invalidate all registrations using that Product Key.
In some cases, Microsoft has offered legal copies of WinXP at reduced price (not free) to people who have been cheated with counterfeits, but it's unlikely if you're dealing with a very small NUC. In order to get the reduced price, you will be required to fill out a "Counterfeit Report" identifying your NUC and they'll try to at least shut down repeat business and/or send him/her to jail and/or sue for the full purchase price of all counterfeits installed.
It's possible that your NUC can provide "legal ownership" of your WinXP, but I'd be dubious. If your NUC is just copying a different RegNo to your computer, it may work for a while, but will inevitably be detected if you try to keep your system up to date.
Take consolation from not being alone, as about 40%+ of WinXP copies currently in use are believed by Microsoft to be counterfeit, although the count drops to the 14% to 20% range in "non-third-world" countries.