Article 28 structure
This DPA is structured to cover the standard UK GDPR controller–processor requirements. Customers with regulated, special-category or high-risk processing may require an additional schedule, transfer assessment, security schedule or negotiated terms before that processing is authorised.
1. Scope and Incorporation
This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (“Customer”) and Aveniqra for use of the Service. It applies where Aveniqra processes personal data on behalf of Customer. Capitalised terms not defined here have the meaning given in the main agreement or applicable data-protection law. This DPA is intended to include the mandatory controller–processor terms required by Article 28 UK GDPR where that law applies.
2. Roles and Compliance
For Customer Personal Data, Customer is controller and Aveniqra is processor unless the parties agree otherwise in writing or applicable law determines a different role for a specific activity. Each party will comply with the data-protection laws applicable to it. Customer is responsible for ensuring that its instructions, collection and use of Customer Personal Data are lawful and that required notices, permissions and lawful bases are in place. If Aveniqra determines the purposes and essential means of a processing activity outside Customer’s instructions, it will act as controller for that distinct activity to the extent required by law rather than mischaracterising the role.
3. Processing Details
Subject matter: provision, support, security and operation of Aveniqra’s data-pipeline and integration services. Duration: for the term of the Service plus the period reasonably required for controlled deletion or return, backup expiry and any retention required by applicable law. Nature and purpose: receiving, storing, parsing, extracting, transforming, validating, reconciling, routing, delivering, monitoring and supporting Customer Data as instructed. Data subjects may include Customer personnel, customers, suppliers, contractors and other persons whose information Customer submits. Data may include identity, contact, business, transactional, order, invoice, operational and other data configured by Customer. Special-category, criminal-offence, payment-card, health or similarly regulated data must not be submitted unless expressly agreed and appropriate safeguards are enabled. Customer’s rights and obligations as controller are those stated in the agreement and applicable law.
4. Documented Instructions
Aveniqra will process Customer Personal Data only on documented instructions from Customer, including instructions expressed through authorised use and configuration of the Service and instructions concerning international transfers, unless processing is required by applicable law. If legally permitted, Aveniqra will inform Customer of that legal requirement before processing. Aveniqra will immediately inform Customer if, in its opinion, an instruction infringes applicable UK data-protection law and may suspend the affected instruction while the parties resolve the issue.
5. Confidentiality
Aveniqra will ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory duty of confidentiality, receive access only to the extent required for their responsibilities, and are informed of relevant data-protection and security obligations.
6. Security
Aveniqra will implement and maintain technical and organisational measures appropriate to the risk as required by applicable data-protection law, including as relevant identity-bound access, tenant isolation, controlled server-side credentials, private storage, validation and exception handling, audit logging, restricted outbound actions, quarantine controls, resilience and backup/recovery controls, testing and fail-closed production configuration. Security measures may evolve as threats, technology and the Service change, provided the overall level of protection is not materially reduced during a committed service term without a lawful and proportionate reason. Current architecture and control evidence can be reviewed during procurement.
7. Subprocessors
Customer gives general written authorisation for Aveniqra to engage subprocessors required to provide the Service. Aveniqra will impose on each subprocessor, by contract or other binding legal act, data-protection obligations that provide at least the protection required of Aveniqra for the relevant processing under this DPA. Aveniqra remains responsible to Customer for performance of those obligations to the extent required by applicable law and contract. Current material subprocessors are listed on the Subprocessors page. Aveniqra will provide reasonable advance notice of an intended new material subprocessor where practicable so Customer can raise a reasonable data-protection objection. The parties will work in good faith on a practical resolution, which may include an alternative configuration or termination of the affected service where no reasonable alternative is available.
8. International Transfers
Aveniqra will not make a restricted transfer of Customer Personal Data unless a lawful transfer mechanism applies and Customer’s documented instructions authorise the transfer. Depending on the transfer, the mechanism may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful safeguard. Where required, Aveniqra will carry out reasonable and proportionate checks on the recipient and relevant transfer risks and make information about the applicable safeguard available to Customer subject to confidentiality and security restrictions.
9. Data-Subject Requests
Taking into account the nature of the processing, Aveniqra will assist Customer by appropriate technical and organisational measures, insofar as reasonably possible, with Customer’s obligation to respond to requests to exercise data-protection rights. If a request is received directly about Customer Personal Data for which Aveniqra is processor, Aveniqra will not independently determine the request except as required by law; it may direct the requester to Customer and will notify Customer unless prohibited by law.
10. Personal-Data Breaches
Aveniqra will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and will provide information reasonably available to help Customer meet applicable notification, investigation and remediation obligations. Where available this may include the nature of the breach, affected categories, likely consequences, measures taken or proposed and a point of contact. Information may be provided in phases as the investigation develops. Notification is not an admission of fault or liability.
11. DPIAs and Regulatory Assistance
Taking into account the nature of the processing and information available to Aveniqra, Aveniqra will provide reasonable assistance with Customer’s obligations concerning security, breach response, data-protection impact assessments and prior consultations with the ICO or another competent supervisory authority where the processing through the Service makes that assistance relevant.
12. Deletion and Return
At the end of the applicable Service, at Customer’s choice, Aveniqra will delete or return Customer Personal Data and delete existing copies unless applicable law requires storage of the personal data. Data present in protected backups may remain until the relevant backup cycle expires where immediate selective deletion is not technically feasible, but it will remain protected, isolated from ordinary use and deleted in accordance with the applicable retention cycle. Aveniqra may retain distinct records that it is independently required or permitted to retain as controller, such as limited billing, fraud-prevention, legal-claim or compliance evidence, subject to its own lawful basis and retention rules; such records are not treated as continuing processor copies merely to avoid the deletion obligation.
13. Audit Information and Inspections
Aveniqra will make available to Customer information reasonably necessary to demonstrate compliance with the processor obligations applicable to the processing and will allow for and contribute to audits, including inspections, by Customer or an auditor mandated by Customer as required by applicable law. The parties will first use current independent reports, certifications, questionnaires, architecture evidence and remote review where these reasonably demonstrate compliance. Any additional audit will be arranged on reasonable notice and conducted in a proportionate manner that protects other customers, confidential information, platform security and legal privilege and minimises disruption. Restrictions on audit logistics do not remove a mandatory audit right that cannot lawfully be excluded.
14. Records, Regulatory Cooperation and Evidence Integrity
Aveniqra will maintain records required of it as processor under applicable law and will cooperate with a competent supervisory authority as required. Aveniqra may maintain append-only legal, acceptance, audit and evidence records to establish the history and integrity of contractual and security events. Corrections are recorded as new events or superseding documents rather than silently rewriting historical records.
15. Customer Cooperation
Customer will use reasonable efforts to configure the Service appropriately for the sensitivity and regulatory context of its data, restrict user access, maintain accurate destination permissions, respond to exception and approval requests, and promptly notify Aveniqra of material changes that affect processing risk. Customer remains responsible for deciding whether Aveniqra provides sufficient guarantees for the Customer’s particular processing and for conducting any controller-side risk assessment required by law.
16. Liability and Precedence
Liability relating to this DPA is subject to the liability provisions of the main agreement except to the extent applicable data-protection law imposes liability that cannot lawfully be excluded or limited. If this DPA conflicts with the main agreement on the protection of Customer Personal Data, this DPA controls for that conflict.
17. Contact
Data-protection enquiries can be submitted through our contact page. Provider details are published in the Legal Notice.