Data Processing Agreement

Last updated: 14 August 2026


This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Customer") and [AXO LEGAL ENTITY] ("AXO Signal") governing use of AXO Signal.


1. Roles of the parties


For personal data processed by AXO Signal solely on behalf of the Customer in providing the Service:


  • the Customer acts as Controller; and
  • AXO Signal acts as Processor,
  • unless applicable law determines otherwise.


AXO Signal may separately act as a Controller in relation to information processed for its own legitimate business purposes, including account administration, security, fraud prevention, legal compliance and operation of its business.


2. Processing instructions


AXO Signal shall process Customer Personal Data only:


  • on documented instructions from the Customer;
  • as necessary to provide the contracted Service; or
  • where processing is required by applicable law.


3. Confidentiality


AXO Signal shall ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.


4. Security


AXO Signal shall implement appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.


Measures may include, where appropriate:


  • encryption;
  • access controls;
  • authentication controls;
  • logging and monitoring;
  • secure development practices;
  • vulnerability management;
  • backup and recovery controls; and
  • incident-response procedures.


5. Sub-processors


Customer authorises AXO Signal to engage subprocessors necessary to provide the Service.


AXO Signal shall require subprocessors processing Customer Personal Data to provide data protection obligations materially equivalent to those applicable to AXO Signal under this DPA.


AXO Signal will maintain information concerning its material subprocessors


6. Data subject rights


Taking into account the nature of processing, AXO Signal shall provide reasonable assistance to the Customer in responding to requests from individuals exercising rights under applicable data protection law.


7. Personal data breaches


AXO Signal shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data where notification is required under applicable law.


AXO Signal shall provide reasonably available information necessary to assist the Customer in meeting applicable breach-notification obligations.


8. Compliance assistance


Taking into account the nature of processing and information available to AXO Signal, AXO Signal shall provide reasonable assistance


concerning:


  • security obligations;
  • personal data breach assessments;
  • data protection impact assessments; and
  • regulatory consultations,
  • where required under applicable data protection law.


9. International transfers


Where Customer Personal Data is transferred internationally in circumstances constituting a restricted transfer under applicable UK data protection law, AXO Signal shall ensure that an appropriate transfer mechanism or safeguard is used.


This may include applicable adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to recognised standard contractual clauses, or another lawful transfer mechanism.


International transfers remain subject to the broader security and accountability requirements of UK GDPR. ICO


10. Return and deletion


Following termination of the applicable Service, AXO Signal shall delete or return Customer Personal Data in accordance with the Customer's instructions, subject to applicable law and legitimate retention requirements.


11. Audit information


AXO Signal shall make available information reasonably necessary to demonstrate compliance with applicable processor obligations and shall cooperate with reasonable audits as required by applicable data protection law, subject to appropriate confidentiality, security and operational safeguards.


12. Processing details


Subject matter: Provision of AXO Signal services.


Duration: Duration of the Customer's use of the Service plus applicable retention periods.


Nature and purpose: Hosting, organisation, analysis, enrichment, retrieval, automation and other processing required to provide AXO Signal.

Categories of data subjects: Customer personnel, business contacts, prospects, customers and other individuals whose personal data is lawfully submitted to or processed through the Service.


Types of personal data: Business contact information, professional information, account information, identifiers, communications, usage information and other data submitted by the Customer.


Special category data: Not intentionally required for normal operation of AXO Signal. Customers should not submit special category data unless expressly agreed and a lawful basis and applicable Article 9 condition have been established.