Data Processing Agreement
Last updated: 27 August 2026
This Data Processing Agreement ("DPA") forms part of the agreement between the Customer (the "Controller") and AxioVendo Ltd (the "Processor") and applies wherever AxioVendo processes personal data on the Customer's behalf under UK GDPR and the Data Protection Act 2018.
1. Roles
The Customer is the data controller of personal data contained in questionnaires, answers, evidence documents, and team member records. AxioVendo is the data processor and processes such data only on the Customer's documented instructions, as expressed through use of the service.
2. Processing details
| Item | Description |
|---|---|
| Subject matter | Completion of vendor assessment questionnaires |
| Duration | Term of the agreement plus 30-day deletion period |
| Nature and purpose | Storage, extraction, suggestion of answers, workflow routing, approval tracking, export |
| Data categories | Business contact details of team members (name, email, role); any personal data contained in customer documents. On the BYO plan, document content is not processed on AxioVendo infrastructure — only structured Q&A pairs, passage references, and workflow metadata. |
| Data subjects | Customer's employees and, incidentally, individuals named in customer documents |
3. Processor obligations
- Process personal data only on documented instructions from the Controller.
- Ensure persons authorised to process the data are bound by confidentiality.
- Implement the technical and organisational measures described in Section 6.
- Assist the Controller with data subject requests and Articles 32–36 obligations.
- Delete or return all personal data at the end of the engagement (Section 8).
- Make available information necessary to demonstrate compliance, and allow audits (Section 7).
4. Sub-processors
The Controller authorises the sub-processors listed below. AxioVendo will give at least 30 days' notice of any addition or replacement, during which the Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may terminate the affected service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, storage | EU (AWS eu-west-1) |
| Vercel | Hosting | EU-preferred compute |
| Resend | Email delivery | EU/US (SCCs) |
| Stripe | Payments | EU/US (SCCs) |
On the free and PAYG plans, AxioVendo's AI provider also acts as a sub-processor for document content, under terms that prohibit training on customer data. On the BYO plan the Customer's own AI provider is engaged directly by the Customer and is not an AxioVendo sub-processor.
5. International transfers
Transfers outside the UK/EEA are made only under the UK IDTA or EU SCCs with the UK Addendum, or another lawful transfer mechanism.
6. Security measures
- Encryption in transit (TLS 1.3) and at rest (AES-256).
- Row-level security enforcing organisation-level data isolation at the database layer.
- Application-layer AES-256-GCM encryption of stored customer API keys.
- Access to production restricted to named personnel with MFA; access logged.
- Managed backups with point-in-time recovery.
- Vulnerability management and dependency patching.
7. Breach notification and audits
AxioVendo will notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting the Controller's data, providing the nature of the breach, likely consequences, and measures taken. The Controller may audit compliance once per year on 30 days' notice, by written questionnaire or, where reasonably required, a remote review, at the Controller's cost.
8. Deletion on termination
Within 30 days of termination, AxioVendo will delete all Controller personal data (including backups on their rotation cycle) or, at the Controller's prior request, return it in a machine-readable format before deletion.
9. Liability and governing law
Liability under this DPA is subject to the limitations in the Terms & Conditions. This DPA is governed by the laws of England & Wales.