Snapshot 74857
Normalized text
Scripts and page chrome removed; this is what change detection compares.
APTECO DATA PROCESSING AGREEMENT
Version: 30th April 2026
Parties
The parties to this Data Processing Agreement (“DPA”) are
Apteco Limited incorporated and registered in England with company number 03982815 whose registered office
is at Tink-a-Tank House, 21 Jury Street, Warwick, CV34 4EH, United Kingdom (“Apteco”, “we”, “us” or “our”)
and
An organisation with an Apteco Software Licence for use of software or services (“Client”, “you” or “your”)
each a “Party” and together “the Parties”.
Subject Matter
This DPA is made between the Parties regarding the instruction, scope, processing, retention and deletion of data
regarding identifiable natural people as defined in the Privacy and Data Security legislation (“Personal
Information”)
1. Data processing
1.1 This DPA is subject to the terms of the Software Licence between the Parties regarding the provision of
Apteco software and services. Unless otherwise stated in this DPA, the definitions of the Software
Licence shall apply accordingly.
1.2 This DPA shall govern all obligations between the Parties regarding matters covered by Privacy and
Data Security legislation. It shall apply in addition to any other arrangements between the Parties and
take precedence over all other arrangements between the Parties relating to the processing of
Personal Information.
1.3 As between you and us, we will act as an independent Data Processor for you when processing any
Personal Information for which you are the Data Controller or which you process as Data Processor for
a different Data Controller. These Data Controller and Data Processor roles apply for any purpose in
connection with the performance of our obligations and/or enforcement of our rights under the Software
Licence, including but not limited to the provision of software and of data hosting services and of
support services and of the other Business Purposes set out in clause 2.2 of this DPA and further only
in accordance with any specific written data processing instruction made by you and accepted by us.
1.4 We will exclusively process Personal Information in compliance with the provisions of this DPA and on
your instructions. You shall provide such instructions in written form including by email and be
responsible for ensuring that such instructions are complete, accurate and comply with Privacy and
Data Security Legislation. We will inform you without undue delay if we believe that the processing of
Personal Information or an instruction of yours constitutes a violation of Privacy and Data Security
Legislation.
1.5 Any processing of Personal Information in violation of this DPA and outside of instructions from you is
prohibited, unless we are subject to a legal obligation to carry out such processing. In such a case, we
shall inform you of that legal requirement before processing Personal Information unless that law
prohibits us from giving such notice.
1.6 You warrant to us that you and any other relevant Data Controller have all the necessary consents
and/or lawful grounds in place to enable the lawful transfer to us of any Personal Information including
data regarding any Users and/or other data subjects and the lawful processing by us of such Personal
Information for the duration and purposes outlined in clause 2 of the DPA.
1 30th April 2026
Apteco Data Processing Agreement
1.7 You will inform us in writing in advance if any of the data you will provide to us includes special or
otherwise protected characteristics such as medical, religious or gender information and we will notify
you in writing if we need to restrict the processing of such Personal Information for example in order to
comply with the data processing agreements we have with our sub-data-processors.
1.8 We shall each comply with the Privacy and Data Security Legislation.
2. Subject matter and duration of the processing, content of the processing
2.1 The nature of the Personal Information processing shall be determined by the Software Licence and by
the data and the instructions provided by you and accepted by us.
2.2 Personal Information is processed for the following purposes:
(a) the granting of a licence by us to you to use the Software and services;
(b) the provision of services by us to you to store and process data;
(c) the provision of software support and training and other services by us to you in order for you to use
the Software and services;
(d) the performance by us of our obligations under the Software Licence; and
(e) the exercising by us of our rights under the Software Licence;
each as described in and subject to the Software Licence and any other purpose specifically agreed
between us in writing (collectively the “Business Purposes”).
2.3 The duration of this DPA corresponds to the term of the Software Licence or so long as we retain any
Personal Information related to the Software Licence in our possession or control or in the possession
or control of one of our sub-data-processors acting on our instructions (collectively, the “Term”)
2.4 Any provision of this DPA that expressly or by implication should come into or continue in force on or
after termination of the Software Licence in order to protect the Personal Information will remain in full
force and effect.
2.5 If a change in Privacy and Data Security Legislation prevents either Party from fulfilling all or part of its
obligations under the Software Licence, the Parties may agree to suspend the processing of any
Personal Information until that processing complies with new requirements.
2.6 Subject to clause 2.7, we shall ensure that the processing of Personal Information under this DPA shall
take place exclusively in the UK or in a member state of the European Union or in another Contracting
State to the Agreement on the European Economic Area or in a third country in respect of which an
adequacy decision of the European Commission or the UK (as applicable depending on the Apteco
contracting Party) has been made.
2.7 Any transfer of Personal Information to a third country not covered in clause 2.6 shall only take place if:
(a) the specific transfer requirements of the applicable Privacy and Data Security Legislation are
fulfilled; or
(b) where the transfer is from the UK, there is in place an International Data Transfer Agreement as
provided by the UK Information Commissioner’s Office for the transfer of personal data from the UK
(a reference to which agreement is set out in Annex A) or such alternative clauses as may be
approved by the UK from time to time; or
2 30th April 2026
Apteco Data Processing Agreement
(c) where the transfer is from the UK there is in place an addendum to the European Commission’s
Standard Contractual Clauses as provided by the UK Information Commissioner’s Office for the
transfer of personal data from the UK (a reference to which addendum is set out in Annex B) or
such alternative addendum as may be approved by the UK from time to time; or
(d) where the transfer is from the EU or EEA, there is in place the European Commission's Standard
Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU)
2016/679 as set out in the Annex to Commission Implementing Decision (EU) 2021/914 (a
reference to which is set out in Annex C) or such alternative clauses as may be approved by the
European Commission from time to time; or
(e) where the transfer is from Canada there is in place a specific data transfer agreement between the
data exporter and the data importer that ensures the data importer shall secure and process the
data to the same standards as are enforced in Canada; or
(f) where the transfer is from Australia there is in place a specific data transfer agreement between the
data exporter and the data importer that ensures the data importer shall secure and process the
data to the same standards as are enforced in Australia; or
(g) where the transfer is from New Zealand there is in place a specific data transfer agreement
between the data exporter and the data importer that ensures the data importer shall secure and
process the data to the same standards as are enforced in New Zealand.
2.8 The types of Personal Information subject to processing by us are controlled by you through your
choice of what data you provide to us which may include the following categories of data:
(a) contact information, possibly including name, physical address, email address, mobile number,
social network identifiers, etc.;
(b) transactional information, possibly including enquiry, purchase, return, subscription and donation
information including dates, products, services, values, etc.;
(c) device and digital identifiers, possibly including advertising ids, tokens, app identifiers, etc.;
(d) profiling information, possibly including personal characterising, segmenting, scoring, behavioural
modelling data, etc.;
(e) campaign and communication information, possibly including details of previous, current and
planned campaigns, responses, interactions, dates, values and response attribution, etc;
(f) special personal data possibly including details of medical or protected characteristics and such
data must be clearly identified in advance and which may be used for restricted purposes in the
Software or services;
(g) other types of data that may be used in the Software or with the services or as instructed by you.
2.9 The categories of data subjects affected by the processing include:
(a) Current and past Licensed Users and Unlicensed Users of the Software and services;
(b) Current and past employees, workers, agents and contractors of you or the Licensee;
(c) Any data subjects provided by you or by the Data Controller including potential, current and past
customers or supporters or other contacts for which they are the Data Controller.
3. Duties of Apteco, Technical and Organisational Measures
3.1 Regarding our processing of your Personal information:
3 30th April 2026
Apteco Data Processing Agreement
(a) we acknowledge that any Personal Information received by us from you shall constitute confidential
and proprietary information and that its use and security is subject to the confidentiality provisions
of the clause titled “Confidential Information” of the Software Licence and Applicable Laws and
Privacy and Data Security Legislation;
(b) we shall keep and ensure that all our employees and contractors keep the Personal Information
confidential and shall only process the Personal Information:
(i) for the Business Purposes;
(ii) in accordance with the written instructions received from you from time to time;
(iii) as may be required by Applicable Laws or Privacy and Data Security Legislation; and
(iv) as otherwise specified in the Software Licence;
(c) we have and will maintain in place during the Term the appropriate and reasonable technical and
organisational measures that are suitable and sufficient to protect any Personal Information against
unauthorised or unlawful processing and against accidental loss, destruction or damage. We are
entitled to make changes to these technical and organisational measures at any time, provided that
the level of security does not fall below the standard expressed in this clause;
(d) we will take all reasonable steps to ensure that Personal Information will only be available to such
staff members who need to have access to it;
(e) we will ensure our staff are trained in handling Personal Information and in the data privacy and
security principles of the Privacy and Data Security Legislation;
(f) we will inform you if we are aware of any significant impairment of our ability to carry out any
processing of Personal Information under this DPA. The same applies if, based on circumstances
and information we are aware of, we believe that our processing of Personal Information or an
instruction of yours constitutes a violation of Privacy and Data Security Legislation;
(g) we will assist you, insofar as this is possible, taking into account the nature of the processing and
the information available to us, and at your cost and written request, in (i) responding to any request
from a data subject, and in (ii) ensuring your compliance with your obligations under Privacy and
Data Security Legislation with respect to security, breach notifications, impact assessments and
consultations with supervisory authorities or regulators;
(h) we will not respond to any such request under clause 3.1(g) without your prior written consent;
(i) we will notify you without undue delay if we become aware of a Personal Information breach;
(j) we will not inform any third party of any accidental, unauthorised or unlawful processing of all or
part of the Personal Information and/or a Personal Information breach without first obtaining your
written consent, except when required to do so by law.
(k) we shall manage Personal Information in accordance with the privacy policy available at
www.apteco.com/privacy-policy. The terms of this DPA shall prevail if there is any conflict between
the DPA and our privacy policy.
(l) We shall have in place an appointed Data Protection Officer able to assist you with data protection
enquiries and contactable by email to data.privacy@apteco.com.
3.2 Immediately following any accidental, unauthorised or unlawful personal data processing or personal
data breach, the Parties will co-ordinate with each other to investigate the matter. Further, we will
reasonably cooperate with you, at your cost, in your handling of the matter.
3.3 We agree that you have the sole right and responsibility to determine:
4 30th April 2026
Apteco Data Processing Agreement
(a) whether to provide notice of any accidental, unauthorised or unlawful processing and/or Personal
Information breach to any data subjects, the UK Information Commissioner, other in-scope
regulators, law enforcement agencies or others, as required by Privacy and Data Security
Legislation or in your discretion, including the contents and delivery method of the notice; and
(b) whether to offer any type of remedy to affected data subjects, including the nature and extent of
such remedy.
3.4 On request by you and in any event upon the termination or expiry of the Software Licence, we shall (at
your discretion) promptly delete or destroy any of your Personal Information held in our storage for the
provision of Software or services or technical support or shall surrender to you, within thirty (30) days of
receipt of such a written request, any Personal Information that you had provided to us in connection
with the Software Licence or which we have created in connection with our processing activities
hereunder, unless applicable law requires the storage of the data, records or documentation. You shall
pay all reasonable expenses incurred by us in returning or disposing of such Personal Information in
accordance with this clause 3.4.
3.5 Nothing in this DPA shall require us to remove Personal Information held on backup media, which shall
be held as confidential information and not retrieved until overwritten or removed in the normal cycle of
the backup process or is otherwise destroyed.
3.6 We shall keep accurate and up-to-date written records regarding any processing of Personal
Information under this DPA, in order for us to be able to demonstrate our compliance.
4. Access rights, inspection rights and complaints (including data subject requests and third-
party rights)
4.1 Upon written request and upon prior written notice of at least 10 business days, you shall be granted
access to any of our premises where we process your Personal Information but not to the premises of
our sub-data-processors in order to conduct inspections and investigations during our normal business
hours, provided that:
(a) you shall not exercise your rights under this clause 4.1 more than once every twelve (12) months;
(b) you treat any information you obtain access to as part of any such inspection or investigation in
accordance with the clause titled “Confidential Information” of the Software Licence regarding
confidentiality;
(c) such inspections and investigations shall not entitle you to access any of our internal pricing or
information relating to any of our other clients;
(d) you shall ensure that such inspections and investigations do not interfere with our business
operations; and
(e) you shall bear the cost of any such inspections and investigations.
4.2 You may also choose to exercise this right through or jointly with another auditor mandated by you and
bound to the same confidentiality obligations, provided such third party is not a competitor of us. You
are obliged to document the result of the audit and submit a report to us. As far as we consider the
deficiencies mentioned in the respective report to be justified and non-trivial, we shall remedy such
deficiencies without undue delay.
4.3 We shall, at your cost, take such technical and organisational measures as may be appropriate, and
promptly provide such information to you as you may reasonably require, to enable you to comply with:
(a) the rights of data subjects under Privacy and Data Security Legislation, including subject access
rights, the rights to rectify, port and erase personal data, object to the processing and automated
processing of Personal Information, and restrict the processing of Personal Information; and
5 30th April 2026
Apteco Data Processing Agreement
(b) information or assessment notices served on the you by any supervisory authority under Privacy
and Data Security Legislation.
4.4 We shall notify you as soon as possible in writing if we receive any complaint, notice or communication
that relates directly or indirectly to the processing of Personal Information or to either Party's
compliance with the Privacy and Data Security Legislation.
4.5 We shall notify you without undue delay if we receive a request from a data subject for access to their
Personal Information or to exercise any of their other rights under Privacy and Data Security
Legislation.
4.6 We shall give you, at your cost, reasonable co-operation and assistance in responding to any
complaint, notice, communication or data subject request.
5. Assignment of further processors
5.1 You acknowledge and agree that we may engage any of the sub-data-processors listed on our website
at www.apteco.com/sub-data-processors as updated or otherwise notified to you in writing from time to
time in our provision of software and services and processing of Personal Information for you.
5.2 We will impose no less onerous data protection obligations on the further sub-data-processors by way
of a contract or other legal instrument as set out in this DPA with each sub-data processor. We will
document the contractual basis of data transfer for each sub-data-processor on the web page defined
in clause 5.1 and will in particular provide sufficient guarantees that the appropriate technical and
organisational measures are implemented in such a way that the processing of Personal Information is
carried out in accordance with the requirements of this DPA and the Privacy and Data Security
Legislation.
5.3 You agree that we will be deemed to control any of your Personal Information in the possession of our
sub-data-processors and that we shall instruct such sub-data-processors only in accordance with the
Software Licence and instructions from you.
5.4 You hereby explicitly approve us appointing any other member of the Apteco group as a sub-data-
processor under this DPA.
6. Miscellaneous
6.1 The limitation of liability provisions set forth in the clause titled “Limitation of Liability” of the Software
Licence will apply to our liability to you under this DPA.
6.2 The notice provisions set forth in the clause titled “Notices” of the Software Licence will apply to the
Parties in respect of any notices they may give under this DPA.
6.3 This DPA is governed by the Laws of England and the Parties submit to the exclusive jurisdiction of the
English Courts.
6.4 Should any provision of this DPA be found to be invalid or unenforceable by an English court then the
remainder of this DPA shall remain as valid and enforceable. The invalid provision shall be
renegotiated by the Parties acting in good faith with reasonable endeavours to achieve the original
purpose of the invalid provision or otherwise interpreted as if such invalid provision were never part of
this DPA.
6.5 This DPA shall terminate on the expiry or termination of the Software Licence except for those clauses
that are constructed to continue.
6 30th April 2026
Apteco Data Processing Agreement
SIGNED as an agreement between Apteco and Client by reference to this online resource when an Apteco
Software Licence is accepted by Client.
Note
Versions of this agreement made out for your organisation for digital or wet ink signature are available on request.
7 30th April 2026
Apteco Data Processing Agreement
Annex A – UK International Data Transfer Agreement
Included here by reference to the UK Information Commissioner’s Office latest standard materials as may be
found on their website at https://ico.org.uk/media2/migrated/4019538/international-data-transfer-agreement.pdf
(or by search of https://ico.org.uk) and as may be amended from time to time according to clause 5.4 of that
agreement.
Annex B – UK Addendum to Standard Contractual Clauses
Included here by reference to the UK Information Commissioner’s Office latest standard materials as may be
found on their website at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf (or
by search of https://ico.org.uk) and as may be amended from time to time according to clause 18 of that
addendum.
Annex C – European Commission’s Standard Contractual Clauses
Included here by reference to the European Commission’s Standard Contractual Clauses as may be found in the
Annex to the implementing decision on their website at http://data.europa.eu/eli/dec_impl/2021/914.
8 30th April 2026