{"id":5094,"date":"2026-08-28T14:14:36","date_gmt":"2026-08-28T13:14:36","guid":{"rendered":"https:\/\/www.access4.com\/uk\/?page_id=5094"},"modified":"2026-08-31T06:36:00","modified_gmt":"2026-08-31T05:36:00","slug":"dpa","status":"publish","type":"page","link":"https:\/\/www.access4.com\/uk\/legal\/dpa\/","title":{"rendered":"DPA"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

DATA PROCESSING ADDENDUM<\/span><\/h1>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\tLast updated: August 2026 <\/span>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ACCESS4 DATA\nPROCESSING ADDENDUM (UK)<\/b><\/p>


<\/b><\/p>

1.      \n<\/span><\/b>Scope and roles<\/b> <\/p>

1.1.  <\/span>This\nDPA applies where the Access4 Entity (we, us, our) Processes Personal Data on\nbehalf of the Partner (you, your) in connection with a Service. This\nDPA is a <\/span>separate document that is incorporated into, and forms part of,\nthe Contract by reference, and supplements the General Trading Terms. We make\nit available on our website and may update it as set out in the Variation\nclause below. Capitalised terms not defined here have the meaning given\n<\/span>in the General Trading Terms.<\/p>

1.2.  <\/span>The\nparties acknowledge that, in respect of Personal Data Processed through the\nServices: the relevant Customer (or its own end customer, as applicable) is the\nController; you act as a Processor; we act as a Sub-processor engaged by you;\nand our Suppliers act as further Sub-processors engaged by us. The parties\nagree that the actual role of each party is ultimately determined by the\ncircumstances of the Processing. <\/p>

1.3.  <\/span>This\nDPA reflects our obligations as a processor under<\/span> the UK GDPR.\nTo the extent of any conflict on data protection matters, this DPA prevails\nover the rest of the Contract (including the General Trading Terms)\non those matters.<\/span><\/p>

1.4.  <\/span>In\nthis DPA, the terms Controller, Processor, Sub-processor, Processing, data\nsubject, Personal Data Breach and Supervisory Authority have the meanings given\nin the UK GDPR. Customer means the Partner\u2019s customer or, where<\/span>\nthe Partner supplies<\/span> the Services through a reseller or other\nintermediary, that intermediary\u2019s end customer, in each case being the party<\/span>\non whose behalf Personal Data is Processed through the Services.<\/p>

 <\/p>

2.      \n<\/span><\/b>Processing instructions<\/b> <\/p>

2.1.  <\/span>We\nwill Process Personal Data only on your documented instructions (including as\nset out in the Contract and Annex 1), and as necessary to provide the Services,\nunless required otherwise by Applicable Laws<\/span> (in which case we will,\nwhere lawful, inform you first).<\/p>

2.2.  <\/span>You\nwarrant that your instructions, and your and each Customer’s Processing, comply\nwith the Privacy Laws, and that all notices have been given and consents\nobtained necessary for us and our Suppliers to Process the Personal Data\n(including for recording, monitoring and processing of communications).<\/p>

 <\/p>

3.      \n<\/span><\/b>Confidentiality<\/b> <\/p>

We will ensure that persons authorised to Process the Personal Data are\nsubject to appropriate obligations of confidentiality.<\/p>

 <\/p>

4.      \n<\/span><\/b>Security<\/b> <\/p>

We will implement and maintain appropriate technical and organisational\nmeasures to protect Personal Data against a Personal Data Breach, appropriate\nto the risk, consistent with the requirements<\/span> of the UK GDPR\nand our Privacy Policy.<\/p>

 <\/p>

5.      \n<\/span><\/b>Sub-processors<\/b><\/a> <\/p>

5.1.  <\/span>You give us a general authorisation to appoint\nSub-processors (including our Suppliers) to Process Personal Data. We will make\navailable to you a list of our current Sub-processors on request.<\/span><\/p>

5.2.  <\/span>We\nwill impose on each Sub-processor data protection obligations that are, in\nsubstance, no less protective than those in this DPA, and we remain responsible\nfor each Sub-processor’s acts and omissions. <\/p>

5.3.  <\/span>We\nwill give you at least 30 days’ notice (by any means permitted for notices\nunder the Contract, including by updating a list we make available) before\nadding or replacing a Sub-processor. You may object on reasonable data\nprotection grounds within that period; if the parties cannot resolve the\nobjection, you may terminate the affected Service.<\/p>

 <\/p>

6.      \n<\/span><\/b>Assistance<\/b> <\/p>

6.1.  <\/span>Taking\ninto account the nature of the Processing, we will provide reasonable\nassistance to enable you (and the Controller) to: (a) respond to requests to\nexercise data subject rights; and (b) comply with your obligations under the\nUK GDPR relating to security, personal data<\/span> breach notification, data\nprotection impact assessments and prior consultation<\/span>, in each\ncase taking into account the information available to us.<\/p>

6.2.  <\/span>We\nwill promptly notify you if we (or a Sub-processor) receive a request from a\ndata subject to exercise their rights under the Privacy Laws in respect of\nPersonal Data we Process on your behalf. Unless required otherwise by\nApplicable Laws, we will not respond to any such request directly, and the\nparties acknowledge that any such request should be directed to, and handled\nby, the relevant Controller (as between the parties, you or your Customer).<\/p>

 <\/p>

7.      \n<\/span><\/b>Personal Data Breach<\/b> <\/p>

We will notify you without undue delay after becoming aware\nof a Personal Data Breach affecting the Personal Data, and will provide\nreasonable information and cooperation to enable you and the Controller to meet\nany notification obligations under the Privacy Laws, including any obligation\nto notify the Information Commissioner’s Office within 72 hours (where\napplicable).<\/p>

 <\/p>

8.      \n<\/span><\/b>Government and law enforcement access<\/b><\/p>

If we receive a legally binding request from a public\nauthority, law enforcement agency or Supervisory Authority to disclose Personal\nData we Process on your behalf, we will, where and to the extent legally\npermitted, notify you (and not the data subject) without undue delay. We will\nnot otherwise be required to handle the request on your behalf. Nothing in this\nclause requires us to notify you, or prevents any disclosure, where\nnotification or withholding disclosure is prohibited or restricted by Applicable\nLaws (including the Investigatory Powers Act 2016).<\/p>


<\/p>

9.      \n<\/span><\/b>Return and deletion <\/b><\/p>

On termination of the relevant Service, we will (at your\nchoice) delete or return the Personal Data, and delete existing copies, unless\nretention is required by Applicable Laws<\/span>.<\/p>


<\/p>

10.  <\/span><\/b>Audit<\/b>\n<\/p>

We will make available information reasonably necessary to\ndemonstrate compliance with our obligations under<\/span> the UK\nGDPR and allow for and contribute to audits, including inspections, conducted\nby you or an auditor mandated by you, on reasonable prior notice, no more than\nonce in any 12-month period (unless required by a Supervisory Authority or\nfollowing a Personal Data Breach), subject to reasonable confidentiality and\nsecurity conditions. We may satisfy this obligation by providing third-party\naudit reports or certifications.<\/p>


<\/p>

11.  <\/span><\/b>International\ntransfers<\/b> <\/p>

We may transfer Personal Data outside the United Kingdom\nwhere an adequacy basis applies. Where no adequacy basis applies, the parties\nwill put in place an appropriate transfer mechanism under the UK GDPR, and the\nInternational Data Transfer Agreement (IDTA), or the International Data\nTransfer Addendum to the EU SCCs (UK Addendum), as applicable, is incorporated\ninto this DPA and completed using the information in the Annexes.<\/p>


<\/p>

12.  <\/span><\/b>Governing\nlaw <\/b><\/p>

This DPA is governed by the laws of England and Wales.<\/p>


<\/p>

13.  <\/span><\/b>Liability<\/b><\/p>

Each party\u2019s liability arising out of or in connection with\nthis DPA is subject to, and does not increase, the limitations and exclusions\nof liability set out in the General Trading Terms, which apply to this DPA as\nif set out in full.<\/p>

 <\/p>

14.  <\/span><\/b>Variation<\/b><\/p>

We may vary this DPA from time to time where reasonably\nnecessary to reflect changes in the Privacy Laws or the requirements of a\nSupervisory Authority, or to give effect to an approved transfer mechanism,\nprovided that any such variation does not materially reduce the protections for\nPersonal Data. We will make the updated DPA available on<\/span> our website,<\/span>\nor by such other means as we may notify.<\/p>


<\/p>

Annex 1 \u2013 Processing details<\/b> <\/p>

Subject matter and duration: <\/b><\/p>

Processing of Personal Data for the term of the relevant Service\nand any wind-down period.<\/p>

Nature and purpose:<\/b> providing, operating, supporting,\nsecuring and improving the Services, including as described in the applicable\nStandard Service Terms and Accepted Order. <\/p>

Types of Personal Data<\/b>: contact details, account and\nidentity data, communications content and metadata<\/span>, voice and\naudio recordings and transcripts, text and interaction content, and other\nPersonal Data contained in Customer Data submitted to or generated by the Services.<\/p>

Categories of data subjects<\/b>: your personnel, your\nCustomers and their personnel, and end users interacting with the Services.<\/p>


<\/p>

Annex 2 \u2013 Security measures<\/b> <\/p>

The technical and organisational measures maintained by us\nand our Suppliers, as described in our Privacy Policy and made available on\nrequest, and\nwhich vary depending on the relevant Service, product, platform and its\ncapabilities, may include: role-based access controls and authentication; use\nof encryption where appropriate to the relevant\nService and platform; logical separation of Customer Data; network and security\nmonitoring and logging; vulnerability management and regular penetration\ntesting; backups; incident detection and response processes; and personnel\nconfidentiality obligations and security awareness training.<\/span><\/p>


<\/span><\/p>

Annex 3 \u2013 Sub-processors<\/b> <\/p>

We engage Sub-processors to Process Personal Data in\nconnection with the Services. A list of our current Sub-processors is available\nto you on request.<\/b><\/span><\/p>

Further Sub-processors may be appointed in accordance with\nclause <\/span>\u00a0<\/span>REF _Ref237871848 \\r \\h <\/span>5\n 08D0C9EA79F9BACE118C8200AA004BA90B02000000080000000E0000005F005200650066003200330037003800370031003800340038000000\n\nand notified to you.<\/p>


<\/p>

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<\/p>

Version 1.0  | \nEffective date: 18 August 2026<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

DATA PROCESSING ADDENDUM Last updated: August 2026 ACCESS4 DATA PROCESSING ADDENDUM (UK) 1.       Scope and roles 1.1.  This DPA applies where the Access4 Entity (we, us, our) Processes Personal Data on behalf of the Partner (you, your) in connection with a Service. This DPA is a separate document that is incorporated into, and forms part […]<\/p>\n","protected":false},"author":19,"featured_media":0,"parent":65,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"class_list":["post-5094","page","type-page","status-publish","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t