Data processing addendum

Effective date: 22 July 2026

Last updated: 22 July 2026

Company: XAPNER LTD · Company number: 16227291 · Registered office: Unit 9105, 141 Access House, Morden Road, Mitcham, Surrey, CR4 4DG, United Kingdom · Public service area: London, UK · Website: https://xapner.com · Email: hey@xapner.com · Telephone and WhatsApp: +44 7345 963949

1. PURPOSE

This Data Processing Addendum applies where XAPNER LTD processes personal data on behalf of a Client in connection with Services.

It forms part of the Agreement between XAPNER LTD and the Client.

It is designed to address applicable requirements under:

• The UK General Data Protection Regulation.
• The Data Protection Act 2018.
• The Data (Use and Access) Act 2025.
• The European Union General Data Protection Regulation.
• Other applicable data-protection laws.

2. PARTIES

Controller or Client:

The person or organisation identified as the Client in the applicable Order Document.

Processor:

XAPNER LTD Company number: 16227291

Registered office: Unit 9105, 141 Access House Morden Road Mitcham Surrey CR4 4DG United Kingdom

3. DEFINITIONS

“Applicable Data Protection Law” means data-protection and privacy law applicable to the processing covered by this Addendum.

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, “Personal Data Breach”, and “Supervisory Authority” have the meanings given under Applicable Data Protection Law.

“Client Personal Data” means Personal Data processed by Xapner on behalf of the Client.

“Subprocessor” means another Processor appointed by Xapner to process Client Personal Data.

4. ROLES

The Client normally acts as Controller.

Xapner normally acts as Processor where it processes Client Personal Data solely on documented Client instructions.

Each party may act as an independent Controller for information processed for its own purposes, including:

• Contract management.
• Billing.
• Fraud prevention.
• Security.
• Legal compliance.
• Business administration.
• Legal claims.

5. CLIENT INSTRUCTIONS

Xapner will process Client Personal Data only:

• On documented instructions from the Client.
• As necessary to provide the Services.
• As required by applicable law.

The Agreement, Order Document, project instructions, support requests, and properly authorised communications constitute documented instructions.

If Xapner reasonably believes an instruction breaches Applicable Data Protection Law, Xapner may:

• Inform the Client.
• Suspend the relevant processing.
• Request an amended instruction.
• Refuse the unlawful instruction.

6. CLIENT OBLIGATIONS

The Client confirms that:

• It has a lawful basis for processing.
• It has provided required privacy information.
• It has obtained consent where required.
• Client Personal Data was collected lawfully.
• Its instructions are lawful.
• It will not instruct Xapner to process more information than necessary.
• It will maintain accurate processing records where required.
• It will respond to Data Subject requests.
• It will determine lawful retention periods.
• It will carry out required impact assessments.
• It will not provide special-category or criminal-offence data unless specifically agreed and lawfully supported.
• It will comply with direct-marketing, cookie, employment, communications, and industry-specific laws.

7. PROCESSING DETAILS

The subject matter, nature, purpose, duration, categories, and Data Subjects are described in:

• The Order Document.
• The project scope.
• Annex 1 of this Addendum.
• Documented Client instructions.

8. CONFIDENTIALITY

Xapner will ensure that persons authorised to process Client Personal Data:

• Are subject to confidentiality obligations.
• Receive access only where reasonably necessary.
• Are informed of relevant security and privacy responsibilities.

9. SECURITY

Xapner will implement appropriate technical and organisational measures, taking account of:

• The state of the art.
• Implementation costs.
• The nature and scope of processing.
• The context and purposes.
• The likelihood and severity of risks.
• The agreed service and infrastructure.

Measures may include:

• Access controls.
• Authentication.
• Multi-factor authentication.
• Encryption.
• Secure transmission.
• Role-based access.
• Logging.
• Monitoring.
• Backups.
• Recovery procedures.
• Patch management.
• Malware protection.
• Secure development.
• Vulnerability management.
• Incident response.
• Confidentiality obligations.
• Supplier controls.
• Data minimisation.
• Secure deletion.

The specific measures depend on the Services and are further described in Annex 2.

10. SUBPROCESSORS

The Client gives general written authorisation for Xapner to appoint Subprocessors reasonably necessary to provide the Services.

Subprocessors may include providers of:

• Cloud hosting.
• Email.
• Storage.
• Communications.
• Analytics.
• Payment processing.
• Development tools.
• Support tools.
• Security.
• Backup.
• Project management.
• Artificial intelligence services where approved or appropriate.
• Contractors providing development, design, support, or marketing services.

Xapner will require a Subprocessor to provide data-protection obligations appropriate to the processing.

Where legally required, Xapner will provide reasonable notice of a material new Subprocessor.

The Client may object on reasonable data-protection grounds.

The parties will work in good faith to resolve an objection.

If no reasonable alternative is available, either party may terminate the affected part of the Services, subject to payment for Services already supplied and committed costs.

11. DATA-SUBJECT REQUESTS

Where Xapner receives a request relating to Client Personal Data, Xapner may:

• Refer the request to the Client.
• Inform the requester that the Client controls the relevant processing.
• Assist the Client where required and reasonably possible.

The Client remains responsible for deciding how to respond.

Assistance outside the ordinary Services may be charged at the agreed rate unless required because of Xapner’s breach.

12. REGULATORY ASSISTANCE

Taking account of the nature of processing and available information, Xapner will provide reasonable assistance with:

• Data-protection enquiries.
• Data Subject rights.
• Security assessments.
• Personal Data Breach response.
• Data-protection impact assessments.
• Prior consultation with a Supervisory Authority.
• Demonstrating compliance.

Additional work may be chargeable unless caused by Xapner’s breach.

13. PERSONAL DATA BREACHES

Xapner will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data.

Where information is available, notification may include:

• Nature of the breach.
• Categories of affected Data Subjects.
• Categories of affected Personal Data.
• Approximate numbers affected.
• Likely consequences.
• Measures taken or proposed.
• Contact information for follow-up.

Information may be supplied in stages where it is not immediately available.

The Client is responsible for deciding whether notification to a Supervisory Authority or Data Subjects is legally required.

Xapner will not make a public statement identifying the Client without authorisation unless legally required.

14. INTERNATIONAL TRANSFERS

Xapner may process or permit access to Client Personal Data outside the Client’s country.

Where a restricted transfer requires safeguards, the parties will use an appropriate mechanism, which may include:

• An adequacy decision or regulation.
• European Union Standard Contractual Clauses.
• The United Kingdom International Data Transfer Agreement.
• The United Kingdom Addendum to European Union Standard Contractual Clauses.
• Another approved mechanism.

The relevant transfer terms are incorporated where legally required.

The parties will cooperate with reasonable transfer-risk assessments and supplementary safeguards.

15. DATA LOCATION

Data location depends on:

• The selected hosting service.
• The agreed architecture.
• Client-selected providers.
• Backup arrangements.
• Subprocessors.
• Support requirements.

A specific location requirement applies only where expressly agreed in an Order Document.

16. RETURN AND DELETION

At the end of the Services, Xapner will, at the Client’s written choice and subject to technical and legal limitations:

• Return Client Personal Data.
• Make Client Personal Data available for export.
• Delete Client Personal Data.
• Render Client Personal Data inaccessible.

Xapner may retain information where:

• Required by law.
• Necessary for legal claims.
• Stored temporarily in secure backups.
• Retained as part of required business records.
• Properly anonymised.

Backup copies may remain until overwritten according to standard retention cycles, provided they remain protected and are not restored except where necessary.

17. AUDITS

On reasonable written request, Xapner will provide information reasonably necessary to demonstrate compliance with this Addendum.

Where required by law, the Client may conduct an audit, subject to:

• Reasonable notice.
• Normal business hours.
• Appropriate confidentiality.
• No access to another client’s information.
• No unreasonable disruption.
• Reasonable frequency.
• Use of an independent qualified auditor where appropriate.
• Reimbursement of reasonable costs for extensive assistance.

An audit is not required where equivalent information from an independent assessment reasonably satisfies the request, unless law requires otherwise.

18. RECORDS

Each party will maintain records required for its role under Applicable Data Protection Law.

Xapner may retain evidence of:

• Instructions.
• Access.
• Security events.
• Subprocessors.
• Breach response.
• Deletion.
• Compliance activities.

19. SPECIAL-CATEGORY DATA

The Client must not provide health information, biometric information, criminal-offence information, or other highly sensitive data unless:

• The processing is expressly included in the scope.
• A lawful basis and additional condition exist.
• Appropriate safeguards are agreed.
• Security requirements are documented.
• Relevant impact assessments have been completed.

20. CHILDREN’S DATA

The Client must disclose before processing begins if the Services will involve children’s Personal Data.

The Client remains responsible for:

• Age-appropriate privacy information.
• Parental consent where required.
• Age assurance where required.
• Appropriate design and safeguards.
• Limiting collection and profiling.
• Compliance with children’s privacy requirements.

21. DIRECT MARKETING

Where Services involve email, SMS, telephone, WhatsApp, social media, advertising, or other direct marketing:

The Client is responsible for:

• Establishing lawful contact permissions.
• Maintaining suppression lists.
• Honouring opt-outs.
• Providing required sender identification.
• Ensuring marketing claims are accurate.
• Complying with communications and advertising laws.
• Ensuring purchased or uploaded contact lists are lawful.

Xapner may refuse to process a list where lawfulness or consent is not reasonably demonstrated.

22. CLIENT SYSTEM ACCESS

Where the Client gives Xapner access to a system:

• The Client authorises access for the Services.
• Access should use individual accounts where possible.
• Permissions should be limited.
• Credentials should be revoked when no longer required.
• The Client should not send passwords through insecure channels.
• The Client must notify Xapner of access restrictions and security requirements.

23. LIABILITY

Liability under this Addendum is subject to the limitation provisions in the main Agreement, except where a limitation is prohibited by Applicable Data Protection Law.

Nothing limits responsibility for a party’s own fraud or another liability that cannot legally be limited.

24. PRIORITY

If this Addendum conflicts with the main Agreement on the protection or processing of Client Personal Data, this Addendum takes priority for that issue.

Mandatory transfer clauses take priority where legally required.

25. DURATION

This Addendum begins when Xapner first processes Client Personal Data and continues until that processing ends.

Provisions relating to confidentiality, security, deletion, legal compliance, and liability survive where necessary.

26. GOVERNING LAW

Unless mandatory transfer clauses require otherwise, this Addendum is governed by the law governing the main Agreement.

27. ANNEX 1: PROCESSING DESCRIPTION

Subject matter:

Provision of the Services described in the applicable Order Document.

Duration:

For the duration of the Services, plus any agreed transition, backup, support, retention, or legal-compliance period.

Nature of processing may include:

• Collection.
• Recording.
• Organisation.
• Structuring.
• Storage.
• Retrieval.
• Consultation.
• Use.
• Transmission.
• Configuration.
• Hosting.
• Support.
• Alteration.
• Analysis.
• Import.
• Export.
• Deletion.
• Destruction.

Purposes may include:

• Website operation.
• Software operation.
• Customer relationship management.
• Communications.
• Hosting.
• Support.
• Maintenance.
• Marketing operations.
• Automation.
• Data migration.
• Integration.
• Analytics.
• Security.
• Other purposes documented in the Order Document.

Categories of Data Subjects may include:

• Client employees.
• Client contractors.
• Client representatives.
• Client customers.
• Prospective customers.
• Website visitors.
• Application users.
• Suppliers.
• Business contacts.
• Marketing contacts.
• Other persons identified in the Order Document.

Categories of Personal Data may include:

• Name.
• Email address.
• Telephone number.
• Address.
• Account information.
• Customer records.
• Enquiry information.
• Transaction information.
• Support information.
• Communications.
• Technical information.
• Device information.
• Marketing preferences.
• Other data identified in the Order Document.

Special-category data:

Not intended unless expressly agreed in writing.

Frequency:

As required to provide the Services.

28. ANNEX 2: TECHNICAL AND ORGANISATIONAL MEASURES

Measures may include, as appropriate:

• Unique user accounts.
• Strong password requirements.
• Multi-factor authentication.
• Least-privilege access.
• Access review.
• Secure credential handling.
• Encryption in transit.
• Encryption at rest where supported.
• Firewall protection.
• Malware protection.
• Secure hosting.
• Logging.
• Monitoring.
• Backup.
• Restoration procedures.
• Patch management.
• Change control.
• Secure development.
• Code review.
• Vulnerability remediation.
• Incident management.
• Supplier due diligence.
• Confidentiality agreements.
• Staff and contractor guidance.
• Data minimisation.
• Retention controls.
• Secure deletion.
• Environment separation where appropriate.
• Business continuity.
• Recovery planning.

The measures applied to a specific project depend on the agreed scope, risks, infrastructure, budget, and Client requirements.

29. ANNEX 3: SUBPROCESSOR INFORMATION

Xapner may maintain a current list of material Subprocessors separately.

For each material Subprocessor, the list should identify:

• Provider name.
• Service supplied.
• General processing location.
• Processing purpose.
• Transfer safeguard where applicable.

The Client may request the current list by emailing hey@xapner.com.