1. When this addendum applies
This Data Processing Addendum (“DPA”) applies where you upload documents to AxioExtract that contain personal data. In that situation, Axiometra Ltd acts as a processor and you act as the controller (or processor on behalf of a controller).
2. Subject matter and duration
Subject matter: processing of personal data contained in uploaded documents and extraction outputs to provide the Service.
Duration: processing continues until you delete the relevant documents or close your account, after which we delete the data in accordance with our retention schedule.
3. Our obligations as processor
We will:
- process personal data only on your documented instructions, including transfers;
- ensure that staff authorised to process personal data are subject to confidentiality obligations;
- implement appropriate technical and organisational security measures;
- assist you in responding to data subject requests and complying with UK GDPR;
- notify you without undue delay after becoming aware of a personal data breach; and
- make available information necessary to demonstrate compliance and allow audits on reasonable notice.
4. Sub-processors
A current list of sub-processors used to provide the Service, including their function and location, is available on request from our contact page. We will inform you of any intended addition or replacement of sub-processors that process personal data contained in your uploaded documents and give you the opportunity to object before that change takes effect.
5. Security measures
We implement the following technical and organisational measures to protect personal data:
- TLS encryption for data in transit;
- encryption at rest provided by the managed cloud platform;
- role-based access controls and row-level database security;
- two-factor authentication and hashed backup codes;
- audit logging of administrative and security events; and
- regular dependency and vulnerability scanning.
6. Data subject rights
Where we receive a request from a data subject whose personal data is in your uploaded documents, we will forward it to you unless we are legally required to respond directly. We will provide reasonable assistance to help you comply with UK GDPR requests.
7. Return and deletion
At the end of the Service term, or earlier on your request, we will delete or return your personal data in accordance with your instructions, except where we are required to retain it by law.
8. International transfers
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as UK-approved Standard Contractual Clauses or equivalent measures.
9. Contact
For data-protection queries, contact us at contact@axiometra.com.