Data Processing Agreement

This Data Processing Agreement ("DPA") is between the customer named in the Order Form ("Customer", the controller) and ScotiTech Solutions Limited ("ScotiTech", the processor). It forms part of the Master Services Agreement.

This DPA applies only where ScotiTech processes personal data on the Customer’s behalf — for example in the AXOS hosted demo environment, a ScotiTech-managed hosting service, or managed support that requires access to Customer data.

Where AXOS is self-hosted by the Customer, the Customer is the sole controller and operator of the data inside AXOS. ScotiTech does not process that data, has no access to it, and this DPA does not apply to it. Implementation support delivered without access to personal data is outside this DPA.

Subject matter: the personal data the Customer or its users place into an AXOS environment that ScotiTech operates or accesses under the Order Form.

Duration: the term of the Order Form plus the return-and-deletion period in clause 10.

Nature and purpose: hosting, operating, supporting, and securing the AXOS environment; delivering the AI features the Customer has configured; responding to Customer instructions. ScotiTech does not process Customer personal data for its own purposes.

Data subjects: the Customer’s employees, contractors, clients, suppliers, and any other individuals whose data the Customer places into AXOS. Categories: identifiers, contact details, employment and professional details, communications, documents, and any other data the Customer chooses to process. The Customer must not place special-category, criminal-offence, or children’s data into a ScotiTech-operated environment without prior written agreement on additional safeguards.

ScotiTech processes Customer personal data only on the Customer’s documented instructions, which are the Order Form, this DPA, and configuration the Customer applies through AXOS. ScotiTech will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

ScotiTech does not, and will not, use Customer personal data or content to train, fine-tune, evaluate, or improve any AI model, whether operated by ScotiTech or by a third party. Any model the Customer connects to AXOS is governed by the Customer’s own contract with that model provider; ScotiTech sends content only to the endpoints the Customer has configured.

ScotiTech ensures that personnel authorised to process Customer personal data are bound by confidentiality obligations and receive appropriate data protection training. Access is limited to personnel who need it to perform the services.

ScotiTech implements the technical and organisational measures described in Schedule 1. These include TLS 1.3 in transit, AES-256 at rest, role-based access control, HTTP security headers, request rate limiting, admin routes protected by a rotated shared secret, logging that excludes personal identifiers, and a daily retention sweep. The current security posture is published at axos.scotitech.com/security.

ScotiTech does not currently hold ISO 27001, SOC 2 Type II, or Cyber Essentials Plus certification. Cyber Essentials self-assessment is being completed now. Progress statements and the evidence pack are available under NDA through the Trust Center.

The Customer gives general written authorisation for the sub-processors listed at axos.scotitech.com/subprocessors as at the Effective Date. ScotiTech will give the Customer at least 30 days’ notice of any intended addition or replacement through the agreed support channel. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, either party may terminate the affected service.

ScotiTech imposes data-protection obligations on each sub-processor that are no less protective than this DPA, and remains liable to the Customer for the sub-processor’s performance.

Taking into account the nature of the processing, ScotiTech assists the Customer with appropriate technical and organisational measures to respond to data-subject requests. For the hosted demo and registration data this includes an authenticated export-or-erase route operated by ScotiTech on the Customer’s instruction. ScotiTech will promptly forward to the Customer any request it receives directly and will not respond to it except on the Customer’s instruction or where required by law.

ScotiTech will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer personal data, so that the Customer can meet its own notification obligations within 72 hours. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. ScotiTech will cooperate with the Customer and take reasonable steps to contain and remediate the breach.

On termination or expiry of the services, ScotiTech will, at the Customer’s choice, return Customer personal data in a commonly used machine-readable format or delete it, and delete existing copies, within 30 days, unless retention is required by law. ScotiTech will confirm deletion in writing on request. Bounded operational logs and backups roll off on the schedule in Schedule 2.

ScotiTech will make available the information necessary to demonstrate compliance with this DPA, including the Trust Center artefacts, the evidence pack under NDA, and completed security questionnaires. ScotiTech will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, on reasonable notice, no more than once per year unless required by a supervisory authority or following a breach, and subject to reasonable confidentiality and scope controls.

ScotiTech’s primary hosting for ScotiTech-operated services is in the European Economic Area. Where Customer personal data is transferred to a country without an adequacy decision, the parties rely on the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses (module two or three as applicable), or another valid transfer mechanism, which are incorporated by reference.

ScotiTech will provide reasonable assistance to the Customer in carrying out Data Protection Impact Assessments and, where required, prior consultation with a supervisory authority, in each case relating to processing under this DPA. The platform-level inputs ScotiTech can supply are set out in the DPIA support note below.

Each party’s liability under this DPA is subject to the limitations and exclusions in the Master Services Agreement. In the event of conflict, this DPA prevails over the Master Services Agreement in relation to the processing of personal data, and the Standard Contractual Clauses prevail over this DPA.