Data processing agreement

About This Document

This Data Processing Agreement ("DPA") forms part of the Master Services Agreement, Order Form, or other written agreement (collectively, the "Agreement") between Axle Tech, Inc., a Delaware corporation with its principal place of business at 15 W 18th St, Floor 9, New York, NY 10011 ("Axle" or "Provider"), and the Customer identified in the Agreement or as set forth in the signature block below ("Customer"), and governs the processing of Customer Data (as defined in the Agreement) by Axle on behalf of Customer. Capitalized terms used but not defined in this DPA have the meanings set forth in the Agreement.

In the course of providing the Services to Customer pursuant to the Agreement, Axle may Process Customer Data on behalf of Customer. Axle agrees to comply with the following provisions with respect to Customer Data Processed by Axle as part of the Services.

01Definitions

1.1 "Affiliate" means any legal entity directly or indirectly controlling, controlled by, or under common control with a party, where "control" means ownership of a majority of the voting stock, equity, or voting interests of such entity.

1.2 "Agents" means all third-party service providers (including Sub-processors) that Axle Tech and its Affiliates engage to Process Customer Data on their behalf in connection with the Services.

1.3 "Axle Tech Information Security Policy" means the information security documentation applicable to the specific Services purchased by Customer, as updated from time to time and made available by Axle Tech upon written request. As of the Effective Date, Axle Tech's primary information security documentation is the Axle Tech AI/ML Usage Controls Policy, a copy of which is attached as Exhibit 1.

1.4 "CCPA/CPRA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100 et seq.).

1.5 "Data Privacy Framework" or "DPF" means the EU-US Data Privacy Framework, as administered by the U.S. Department of Commerce and approved by the European Commission, including the Data Privacy Framework Principles set forth at www.dataprivacyframework.gov.

1.6 "Individual" means a natural person to whom Personal Data relates, also referred to as a "Data Subject" pursuant to EU data protection laws and regulations.

1.7 "Model Training" means the use of data to train, fine-tune, improve, or develop any artificial intelligence, machine learning, or large language model on a generalized or persistent basis, including for use outside or beyond the scope of a specific Customer's account.

1.8 "On-Premises Software" means Axle Tech software deployed by Customer within Customer’s own IT environment, where Customer Data does not leave Customer’s infrastructure unless cloud-connected features are explicitly enabled by Customer.

1.9 "Personal Data" means data about an identified or identifiable Individual.

1.10 "Privacy and Security Requirements" means applicable data protection and privacy laws and regulations (including, as applicable, the CCPA/CPRA, GDPR, and UK GDPR) and the Axle Tech Information Security Policy, in each case solely as applicable to Axle Tech's Processing of Personal Data under this DPA.

1.11 "Process" or "Processing" means any operation or set of operations performed upon Customer Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation, retrieval, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, erasure or destruction.

1.12 "SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for the transfer of personal data to third countries.

1.13 "Security Incident" means any confirmed or reasonably suspected unauthorized access to, acquisition of, or disclosure of Customer Data by Axle Tech or its Affiliates or Agents of which Axle Tech becomes aware.

1.14 "Sub-processor" means any third-party processor engaged by Axle Tech to Process Customer Data in connection with the provision of the Services, as listed in Annex 4 to this DPA.

1.15 "UK GDPR" means the GDPR as it forms part of United Kingdom domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018.

02Data processing

2.1 Scope and Roles. This DPA applies when Customer Data is Processed by Axle as part of the Services, as further specified in the Agreement and the applicable Order Form. To the extent that EU Privacy Laws and Regulations or the UK GDPR apply to the Personal Data included in Customer Data that Axle Processes for Customer, Customer is the Data Controller and Axle and its applicable Affiliates are the Data Processor under such laws and regulations.

2.2 Processing of Customer Data. Customer’s instructions to Axle to Process Customer Data will comply with all Privacy and Security Requirements. Customer will have sole responsibility for the accuracy, quality, and legality of Personal Data, the means by which Customer acquired Personal Data, and Customer’s permissions to Process Personal Data pursuant to this DPA.

2.3 Instructions for Axle Tech's Processing of Customer Data. Axle will only Process Customer Data on behalf of and in accordance with Customer’s documented instructions as set forth herein. Customer instructs Axle to Process Customer Data for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Forms; and (ii) Processing to comply with other reasonable written instructions expressly provided by Customer where such instructions are consistent with the Agreement and comply with applicable Privacy and Security Requirements. Any additional instructions outside the scope of this DPA must be agreed in writing by the parties and may be subject to additional fees.

2.4 Processing for Legitimate Purposes. Notwithstanding the foregoing, Axle may Process Customer Data for legitimate business purposes, including archiving, back-up and disaster recovery, cyber security, service operations, improvements and development of Axle’s Services, fraud and service misuse prevention, and legal and administrative proceedings, all in accordance with the Privacy and Security Requirements.

2.5 Restrictions on Model Training. Notwithstanding anything to the contrary in this DPA or the Agreement, Axle will not use, access, Process, or otherwise exploit any Customer Data for the purpose of Model Training, whether to benefit third parties, to improve Axle’s general AI/ML models, or for any other purpose. For the avoidance of doubt, Axle’s AI/ML systems operate solely on data required for real-time functionality and outputs, and Customer Data is never retained for model training purposes, consistent with Axle’s AI/ML Usage Controls Policy. Axle will not permit any third party, including Sub-processors, Affiliates, or Agents, to use Customer Data for Model Training or AI development. For clarity, the use of properly anonymized and aggregated data is governed by Section 11 of this DPA.

2.6 On-Premises Software. For On-Premises Software, Axle’s obligations under this DPA apply solely to the extent that Axle Processes Customer Data in connection with support, maintenance, or cloud-connected features explicitly enabled by Customer. Customer is solely responsible for the security of its own infrastructure, network, and data storage for On-Premises deployments.

03Rights of individuals

3.1 Requests. Axle will, to the extent legally permitted, promptly notify Customer (and in any event within five (5) business days of receipt) if it receives a request from an Individual whose Personal Data is included in Customer Data, or a request by such Individual’s legal guardians, to exercise any right to access, correct, amend, delete, restrict, or port their Personal Data, or to exercise any other right to which the Individual is entitled pursuant to applicable Privacy and Security Requirements.

3.2 Assistance. Axle will provide Customer with commercially reasonable cooperation and assistance, at Customer’s reasonable expense for excessive or repetitive requests, in handling an Individual’s request, to the extent legally permitted under applicable Privacy and Security Requirements, and to the extent Customer does not have direct access to such Personal Data through its use of the Services. Axle will not respond to any such request without Customer’s prior written authorization, except to acknowledge receipt and inform the Individual that the request has been forwarded.

04Axle personnel

4.1 Limitation of Access. Axle will ensure that Axle’s access to Customer Data is limited to those personnel who require such access to perform the Services.

4.2 Confidentiality. Axle will impose appropriate contractual obligations upon its personnel and third-party contractors engaged in the Processing of Customer Data, including obligations regarding confidentiality, data protection, and data security. Axle will ensure that its personnel engaged in the Processing of Customer Data: (i) are informed of the confidential nature of the Customer Data; (ii) have received appropriate training in their responsibilities commensurate with their access; and (iii) have executed written confidentiality agreements that survive the termination of their employment or engagement.

05Affiliates and Third-Party Service Providers

5.1 Affiliates. Some or all of Axle’s obligations under this DPA may be performed by Axle Affiliates, provided that Axle remains responsible for its Affiliates’ compliance with this DPA.

5.2 Agents. Customer acknowledges and agrees that: (i) Axle’s Affiliates may Process Customer Data on Axle’s behalf to perform the Services under the Agreement; and (ii) Axle and its Affiliates may engage Agents in the performance of the Services. Axle will conduct reasonable and appropriate due diligence on all Agents’ privacy, security, and compliance practices before permitting them to Process Customer Data and on a periodic basis thereafter. All Affiliates and Agents to whom Axle transfers Customer Data to provide the Services have entered into written agreements that bind them by substantially the same material data protection obligations as those under this DPA.

5.3 Liability. Axle will be liable for the acts and omissions of its Affiliates and Agents to the same extent Axle would be liable if performing the relevant Services directly under the terms of this DPA.

5.4 Consent to Sub-processors. Customer consents to Axle’s use of the Affiliates and Agents set forth in Annex 4 to this DPA in the performance of the Services.

5.5 Notification and Objection to New Sub-Processors. Axle will notify Customer of any intended addition or replacement of Sub-processors or Agents by updating Annex 4 to this DPA at least thirty (30) days in advance. Customer may object to the engagement of a new Sub-processor or Agent on reasonable grounds relating to the protection of Customer Data within thirty (30) days of such notification. If Customer raises such an objection, the parties will discuss Customer’s concerns in good faith with a view to achieving a commercially reasonable resolution. If no such resolution can be reached, Axle will, at its sole discretion, either not appoint the new Sub-processor or Agent, or permit Customer to suspend or terminate the affected Services in accordance with the termination provisions of the Agreement without liability to either party (but without prejudice to any fees incurred by Customer prior to suspension or termination).

06Additional terms for EEA and UK Personal Data

6.1 To the extent Axle self-certifies to and maintains certification under the DPF, Axle will comply with the DPF Principles for transfers of Customer Personal Data from the EEA, UK, or Switzerland, including the requirements for onward transfers to Sub-processors. Axle will notify Customer if it ceases to maintain DPF certification.

6.2 All Axle Affiliates and Agents to whom Axle transfers Personal Data to provide the Services are certified to the DPF, or provide at least the same level of protection for such Personal Data as is required by the relevant DPF Principles, and comply with the requirements of the DPF for onward transfers of Personal Data to Agents.

6.3 Axle and its Affiliates and Agents will take all measures necessary to facilitate the lawful Processing of Personal Data in accordance with all applicable Privacy and Security Requirements.

6.4 Customer authorizes the transfer of Personal Data to any jurisdiction outside the EEA or UK, including the United States, for the purpose of providing the Services, pursuant to the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914, which are incorporated by reference into this DPA as Schedule 1 and apply to any Personal Data transfers outside the EEA, including onward transfers to Sub-processors, together with the UK Addendum incorporated as Schedule 2. Axle and its Affiliates and Agents to whom Axle transfers Personal Data to provide the Services will comply with the SCCs in all respects, with Customer as the controller and Axle and its applicable Affiliates and Agents as processors.

6.5 For transfers of Personal Data subject to the Swiss Federal Act on Data Protection, references in the SCCs to the GDPR shall be read as referring to the Swiss FDPA, and the concept of supervisory authority shall include the Swiss Federal Data Protection and Information Commissioner.

07Security

7.1 Controls. Axle will maintain appropriate administrative, physical, and technical safeguards for the protection of the security, confidentiality, and integrity of Customer Data, pursuant to the Axle Information Security Policy and in compliance with the Privacy and Security Requirements. The technical and organizational measures maintained by Axle are described in Annex 3 to this DPA. Axle regularly monitors compliance with these safeguards. Axle will not materially decrease the overall security of the Services during the term of the Agreement.

7.2 Policies, Certifications, and Audit Reports. Axle uses external auditors to verify the adequacy of its security measures. The internal controls of the Services are subject to periodic testing by such auditors. Upon Customer’s written request at reasonable intervals and subject to confidentiality limitations, Axle will make available to Customer (provided Customer is not a direct competitor of Axle), or to a third-party auditor on Customer’s behalf (provided such auditor is not a direct competitor of Axle and has executed Axle’s non-disclosure agreement), the then-current Axle Information Security Policy and summaries of third-party audit or certification reports commonly made available to Axle customers.

7.3 On-Site Audit. Customer may conduct or commission an on-site audit of Axle’s data processing practices, subject to: (i) at least forty-five (45) days’ prior written notice; (ii) once per calendar year absent a Security Incident requiring broader review; (iii) conducted by a mutually acceptable third-party auditor subject to a confidentiality undertaking; (iv) conducted in a manner that does not unreasonably disrupt Axle’s operations or compromise the security of other customers’ data; and (v) at Customer’s expense, except that if the audit reveals material non-compliance by Axle, Axle shall bear the reasonable documented costs of the audit. Customer agrees that where Axle provides a current third-party audit report or certification covering the relevant subject matter, Customer will accept such report in lieu of an on-site audit unless Customer has reasonable documented grounds to believe it does not address its specific compliance concerns.

08Security Breach management and notification

8.1 Breach Prevention and Management. Axle will maintain security incident management policies and procedures and will, to the extent permitted by law, promptly notify Customer without undue delay (no later than seventy-two (72) hours of discovery of the incident) of any Security Incident. Notification shall be provided to Customer’s designated privacy or security contact and shall include: (a) a description of the nature of the Security Incident, including the categories and approximate number of Individuals and records affected; (b) the name and contact details of Axle’s privacy contact; (c) the likely consequences of the Security Incident; and (d) the measures taken or proposed to address the Security Incident. Where complete information is not available at the time of initial notification, Axle shall provide further information as it becomes available without undue delay.

8.2 Remediation. To the extent that a Security Incident is caused by a violation of Axle’s obligations under this DPA, Axle will identify and make reasonable efforts to remediate the cause of such Security Incident at Axle’s own expense. Axle’s notification of or response to a Security Incident shall not constitute an admission of fault or liability.

8.3 Cooperation. Axle shall cooperate with Customer and provide reasonable assistance in Customer’s investigation of and response to a Security Incident, including preparation of any required regulatory notifications.

09Customer privacy obligations

Customer undertakes to: (a) provide adequate notices to Individuals about the Processing of their Personal Data as required by applicable Privacy and Security Requirements; (b) obtain all necessary consents and authorizations required for Axle to Process Customer Data as instructed under this DPA; and (c) promptly notify Axle if Customer becomes aware of any actual or suspected Security Incident affecting Customer Data within Customer’s own environment.

10Deletion and retention of Personal Data

10.1 Data Deletion. Axle will return Customer Data to Customer or delete such data within thirty (30) days of the effective date of termination of the Services, or sooner upon Customer’s written request. At Customer’s request, Axle will certify in writing that it has completed the deletion of Customer Data from its systems. Axle will impose the same deletion and certification obligation on all Sub-processors of Customer Data.

10.2 Data Retention. Notwithstanding the foregoing, Customer acknowledges and agrees that Axle may retain copies of Customer Data solely as necessary in connection with its routine backup and archiving procedures and to ensure compliance with its legal obligations and its continuing obligations under applicable law, including to retain data pursuant to legal requirements and to use such data to protect Axle, its Affiliates, Agents, and any person on their behalf in court and administrative proceedings, and for investigations and inspections related to Axle’s Services. Any retained data shall remain subject to all obligations of this DPA.

10.3 Backup Purge. Axle shall use commercially reasonable efforts to purge Customer Data from backup systems within ninety (90) days of the applicable deletion date. During this period, such data shall not be accessed or used for any purpose other than backup restoration.

10.4 On-Premises. For On-Premises Software, Customer is solely responsible for data management, deletion, and export within its own environment. Axle has no obligation to delete or return data that it does not hold or control.

11Anonymized and aggregated data

Axle shall not Process Customer Data in non-anonymized form for any purposes beyond those authorized in this DPA. Axle may use properly anonymized and aggregated data derived from Customer Data (from which no Individual or Customer can be identified or re-identified) for internal product improvement, service analytics, and benchmarking purposes, provided such use complies with applicable Privacy and Security Requirements. Such anonymized and aggregated data does not constitute Customer Data or Personal Data for purposes of this DPA.

12Limitation of liability

Each party’s and its Affiliates’ total cumulative liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations of liability and exclusions set out in the Agreement. Any reference in the Agreement’s limitation of liability provision to the liability of a party means that party and its Affiliates in the aggregate. For the avoidance of doubt, claims arising under this DPA form part of the aggregate liability cap in the Agreement unless the parties have expressly agreed otherwise in writing.

13Term

This DPA will commence on the same date that the Agreement is effective, and will survive for as long as Axle or its Affiliates or Agents possess Customer Data. The obligations of confidentiality, security, and data deletion set forth in this DPA shall survive the termination or expiry of the Agreement.

14Compliance

14.1 Axle’s compliance and privacy team is responsible for ensuring that all relevant Axle personnel adhere to this DPA and applicable Privacy and Security Requirements. Axle will maintain records of all categories of Processing activities carried out on behalf of Customer as required by Article 30(2) GDPR, including categories of Processing, transfer details, and a description of Axle’s technical and organizational measures, and will make such records available to competent supervisory authorities upon request. Axle will cooperate with and respond to enquiries from any competent supervisory authority in connection with this DPA.

14.2 Axle’s privacy and compliance team can be reached at: contact@axleaccess.com.

15General

15.1 Order of Precedence. In the event of a conflict between this DPA and the Agreement with respect to data protection matters, this DPA shall prevail. The SCCs and UK Addendum shall prevail over this DPA with respect to international transfers to the extent of any inconsistency.

15.2 Amendments. Axle may amend this DPA to reflect changes in applicable Privacy and Security Requirements upon at least thirty (30) days’ prior written notice to Customer. Customer may object to any such amendment within thirty (30) days of notice. All other amendments require the written agreement of both parties.

15.3 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of New York, United States, without prejudice to any mandatory provisions of applicable Privacy and Security Requirements. Any disputes shall be subject to the exclusive jurisdiction of the courts of New York County, New York, subject to Schedule 1 with respect to EEA/UK transfer disputes.

15.4 Entire Agreement. This DPA, including all Annexes and Schedules, constitutes the entire agreement between the parties with respect to the subject matter hereof, and supersedes all prior representations, agreements, and understandings relating to the Processing of Customer Data.

15.5 Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

15.6 Counterparts. This DPA may be executed in counterparts, including electronically, each of which shall be deemed an original and all of which together shall constitute one agreement.

Schedules, Annexes, and Exhibit 1 continue on the DPA Schedules and Annexes page.