Data Processing Addendum

Last updated: October 2026

This Data Processing Addendum (“DPA”) applies where SXAccess processes personal data on your behalf in connection with the SXAccess service. It forms part of the applicable Terms of Service or other agreement governing your use of SXAccess.

Where this DPA applies and conflicts with the applicable agreement on matters concerning the processing of personal data, this DPA will apply to those matters.

Definitions

Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given to them under applicable data protection law.

“Data Protection Law” means the GDPR, the UK GDPR and other data protection laws applicable to the processing covered by this DPA.

Roles

Where SXAccess processes personal data on your behalf in providing the service, you act as the controller and SXAccess acts as the processor, unless applicable law determines otherwise.

Where SXAccess processes information for its own purposes, such as account administration, billing, customer communications or operation of its business, that processing is governed by our Privacy Policy.

Processing of Personal Data

SXAccess processes personal data as necessary to provide, operate, secure and support the service in accordance with your documented instructions and the applicable agreement.

Your use and configuration of SXAccess may form part of those instructions.

If applicable law requires us to process personal data other than on your instructions, we may do so as permitted or required by that law.

If we become aware that an instruction may conflict with applicable Data Protection Law, we may inform you and, where appropriate, suspend the affected processing until the matter is resolved.

Processing Details

The processing generally relates to providing cloud-based network access and security functionality to your organization.

Depending on your use of SXAccess, personal data processed on your behalf may include account identifiers, business contact information, member, service account and group information, device information, network or connection metadata, access-rule information, activity records and other information submitted or generated through your use of the service.

Data subjects may include your employees, contractors, administrators, users and other individuals whose information you choose to process through SXAccess.

The nature and scope of processing depend on the features you use and how you configure the service.

Confidentiality

We take reasonable steps to ensure that personnel authorized to process personal data are subject to appropriate confidentiality obligations and access personal data only as necessary for their responsibilities.

Security

We maintain appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, alteration or disclosure.

The measures applied may vary depending on the nature of the service, the information processed and the risks associated with the processing.

Additional information about security measures may be provided separately where appropriate.

Sub-processors

You provide general authorization for SXAccess to engage sub-processors where reasonably necessary to provide and support the service.

We will require sub-processors that process personal data on our behalf to be subject to appropriate data protection obligations consistent with applicable Data Protection Law.

We may maintain a current list of relevant sub-processors through our website or another appropriate channel.

Where required by applicable Data Protection Law, we will provide information about intended changes involving sub-processors and provide an opportunity to raise reasonable data protection concerns.

Our use of sub-processors does not relieve us of obligations that applicable Data Protection Law places on us as processor.

Data Subject Requests

Taking into account the nature of the processing, we will provide reasonable assistance, where required by applicable Data Protection Law, to help you respond to requests from individuals exercising their data protection rights.

If we receive a request relating primarily to personal data that we process on your behalf, we may direct the requester to you unless applicable law requires us to respond differently.

Compliance Assistance

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance where required to support your compliance with applicable obligations relating to security, personal data breaches, data protection impact assessments and regulatory consultation.

Personal Data Breaches

If we become aware of a personal data breach affecting personal data processed on your behalf, we will notify you without undue delay where required by applicable Data Protection Law.

We will provide information reasonably available to us that is relevant to your assessment and response to the incident.

Return and Deletion

Following termination or expiry of the applicable service, personal data processed on your behalf will be deleted or returned in accordance with applicable Data Protection Law, our applicable retention processes and the technical capabilities of the service.

We may retain information where required by applicable law or where retention is otherwise permitted under applicable Data Protection Law.

You are responsible for exporting information that you require before your access to the service ends.

Compliance Information and Audits

We will make available information reasonably necessary to demonstrate compliance with our processor obligations under applicable Data Protection Law.

Where required by applicable law, we will allow for and contribute to reasonable audits or assessments relating to the processing covered by this DPA.

Audits and assessments must be reasonable in scope, respect the confidentiality and security of other customers and our systems, and avoid unnecessary disruption to the service.

Where appropriate, existing security documentation, certifications, reports or written responses may be used to address compliance enquiries before additional audit activities are considered.

International Transfers

Personal data may be processed in countries other than the country in which you are located.

Where Data Protection Law requires safeguards for an international transfer of personal data, we will use an appropriate lawful transfer mechanism.

Such mechanisms may include applicable Standard Contractual Clauses or other transfer safeguards recognized under applicable Data Protection Law.

Customer Responsibilities

You are responsible for ensuring that you have an appropriate legal basis and any necessary notices, permissions or authorizations for the personal data you provide to SXAccess for processing.

You are also responsible for your use and configuration of the service, including determining which personal data is processed and who is permitted to access it.

You should not use SXAccess to process categories of personal data that are unnecessary for your intended use of the service.

Liability

Any limitations of liability contained in the agreement governing your use of SXAccess also apply to this DPA to the extent permitted by applicable Data Protection Law.

Changes

We may update this DPA where necessary to reflect changes to the service, applicable Data Protection Law or our processing practices.

The current version will be made available through the SXAccess website or another appropriate channel.

Contact

For data protection enquiries relating to this DPA, contact support@sxaccess.com.