Effective October 27, 2026. This Data Processing Addendum (“DPA”) forms part of the Terms of Service between [Legal company name] (“Processor”) and the business using Axeclusive Solutions (“Controller”). It applies when the Processor processes personal data on behalf of the Controller and governs in case of conflict with the Terms.
1. Roles and scope
The Controller determines the purposes and means of processing End Customer personal data. The Processor processes it only to provide the Service, on the Controller’s documented instructions (the Terms, this DPA and the Controller’s use and settings of the Service). If the Processor believes an instruction violates data-protection law, it will tell the Controller. Applicable law includes the GDPR, UK GDPR, Swiss FADP, the CCPA/CPRA and other US state privacy laws, PIPEDA, Quebec Law 25 and similar laws (“Data Protection Law”).
2. Details of processing (Annex 1)
- Subject matter and duration: provision of the Service for the term of the subscription and the export period afterwards.
- Nature and purpose: hosting, storage, booking management, payment status tracking, e-mail notifications, waivers, quotes, invoices, chat and support.
- Data subjects: the Controller’s End Customers, participants, guardians, leads and staff.
- Personal data: names, e-mail, phone, address, booking history, payment status and limited card details from the payment provider, waiver signatures, dates of birth and emergency contacts (if the Controller enables them), chat messages, IP address and device data.
- Special categories: none intended. If the Controller collects any (for example health information in a waiver or intake question), it is responsible for the lawful basis and for limiting it to what is necessary.
3. Processor obligations
- Ensure that people authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures (Annex 2 — see our Security policy).
- Assist the Controller, taking into account the nature of processing, with data-subject requests (the Service includes tools to export and erase a customer’s data), data-protection impact assessments and consultations with authorities.
- Not sell, share, retain, use or disclose the data for any purpose other than providing the Service, not combine it with data from other sources except as permitted by law, and not process it outside the direct business relationship. The Processor certifies that it understands and will comply with these restrictions (CCPA service-provider terms).
- At the end of the Service, delete or return the data after the export period, unless the law requires storage.
- Make available information reasonably necessary to demonstrate compliance, through security documentation and written answers to reasonable questionnaires. On-site audits may be performed no more than once a year, on 30 days’ notice, during business hours, at the Controller’s expense and under confidentiality, or where required by an authority.
4. Sub-processors
The Controller gives general authorisation for the sub-processors listed at /legal/subprocessors. The Processor will give at least 15 days’ notice of a new sub-processor (by updating the list and notifying account owners). The Controller may object on reasonable data-protection grounds; if the parties cannot resolve it, the Controller may cancel the affected Service and receive a pro-rata refund of prepaid fees. The Processor imposes data-protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.
Payment providers (such as Stripe, Square and PayPal) that the Controller connects with its own account act under the Controller’s own agreement with them and are not sub-processors of the Processor.
5. Personal data breaches
The Processor will notify the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data, and will provide the information reasonably available to help the Controller meet its obligations (for example the GDPR’s 72-hour notice to authorities, or PIPEDA’s “as soon as feasible” notice and record-keeping). Notification is not an admission of fault or liability. The Controller is responsible for deciding whether to notify authorities and End Customers, unless the law requires the Processor to do so.
6. International transfers
Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) and, where applicable, Module Three, incorporated by reference, with: Clause 7 (docking) included; Clause 9 option 2 (general authorisation, notice as in section 4); Clause 11 optional language omitted; Clause 17 and 18 governed by the law and courts of Ireland; and Annexes completed by section 2 above and our Security policy. For UK transfers the UK International Data Transfer Addendum applies; for Swiss transfers the SCCs apply with references read as the FADP.
7. Controller obligations
The Controller warrants that it has a lawful basis and any required consent and notices for the data it submits, that its instructions comply with Data Protection Law, and that it will not upload data it is not permitted to process. The Controller is responsible for its End Customers’ requests and for its own security settings, users and devices.
8. Liability
Each party’s liability under this DPA is subject to the exclusions and limitations of liability in the Terms, except where Data Protection Law does not allow it.
9. Contact
[Legal company name], [Registered address] · [Legal / privacy e-mail]