Data Processing Agreement
Last updated: 5 May 2026
1. Purpose and Scope
This Data Processing Agreement (“DPA”) supplements the Octyne Terms of Service and applies where Axis One Group Ltd (“Processor”) processes personal data on behalf of a subscribing business customer (“Controller”) in the course of providing the Octyne service.
2. Roles and Instructions
The customer is the Controller of personal data uploaded or collected through Octyne (such as end-customer contact information, referral details, and voucher redemptions). Octyne acts as a Data Processor. Processor shall process personal data solely on documented instructions from Controller, including with respect to international transfers, unless required to do so by applicable law.
3. Confidentiality and Security
Processor ensures that personnel authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Processor implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and infrastructure monitoring.
4. Sub-processors
Controller grants general authorization to Processor to engage third-party sub-processors (such as cloud hosting, authentication, transactional email, and payment providers) to support platform operations. Processor shall impose data protection obligations on any sub-processor that are no less protective than those set out in this DPA.
5. Data Subject Rights and Assistance
Taking into account the nature of the processing, Processor shall assist Controller by appropriate technical and organizational measures, insofar as possible, to fulfill Controller’s obligation to respond to requests for exercising data subject rights under applicable data protection laws (such as UK GDPR and EU GDPR).
6. Incident Notification
In the event of a confirmed personal data breach affecting Controller personal data, Processor shall notify Controller without undue delay after becoming aware of the incident, providing relevant details to support Controller’s statutory reporting obligations.
7. International Data Transfers
Where personal data is transferred across international boundaries, Processor ensures appropriate transfer mechanisms (such as adequacy regulations, UK International Data Transfer Addenda, or Standard Contractual Clauses) are in place to safeguard the transferred data.
8. Return and Deletion
Upon termination of the service, Processor shall, at Controller’s choice, delete or return all personal data to Controller, and delete existing copies unless applicable law requires retention of the personal data.
9. Contact and Data Protection Inquiries
For DPA execution inquiries or data protection officer communications, please contact us at privacy@octyne.io or via our contact page.