Legal

Data Processing Addendum

Last updated 9 October 2026

Parties

This Data Processing Addendum (DPA) is between Assurestor and the other party to the Principal Services Agreement.

Background

(A) Assurestor provides the Services and Support to Partners, and to Customers referred to it by a Partner or Referrer, pursuant to Principal Services Agreements. Assurestor sells only through its Partners and does not sell to Partners’ own customers.

(B) The provision and use of the Services and Support involves the processing of Relevant Data by Assurestor, Partners and Customers.

(C) This DPA sets out the responsibilities of Assurestor, Partners and Customers with respect to the processing of Relevant Data in connection with the provision and use of the Services and Support.

1. Status and effect of this DPA

1.1 This DPA supplements and forms a binding part of the Principal Services Agreement.

1.2 Except as amended or varied by this DPA, the provisions of the Principal Services Agreement shall continue in full force and effect in accordance with its terms.

1.3 In the event of any conflict or inconsistency between the provisions of this DPA and the Principal Services Agreement, the provisions of this DPA shall prevail with regard to the parties’ obligations, rights and liability in connection with the processing of Relevant Data.

2. Definitions

2.1 The following definitions apply in this DPA:

Account Data:	information relating to Users and other Distributor, Partner and Customer staff that is uploaded to, stored in and/or transmitted to Assurestor via a Service Portal or other account required to access a Service, as described in Schedule 1.
Assurestor:	Assurestor Limited, a company incorporated in England and Wales with company number 08249507, whose registered office is at 44/54 Orsett Road, Grays, Essex, England, RM17 5ED.
Assurestor Control:	the deployment model under which Partner (or Customer) uses its own Engine licences and its own infrastructure, and Assurestor provides Control and the related orchestration, management, analytics and billing functions without storing Service Data.
Assurestor Hybrid:	the deployment model under which Partner uses Assurestor Control for some Services or Customers and the Assurestor Platform for others.
Assurestor Platform:	the deployment model under which Assurestor supplies the Engine licences and the infrastructure on which Service Data is stored, operated by or for Assurestor.
Assurestor’s Privacy Notice:	Assurestor’s privacy notice, available at https://www.assurestor.com/privacy-policy
Control:	the online portal operated by Assurestor through which Partners and, where applicable, Customers manage the Services and access live and analytics data about the Engines and Platforms they use, billing and support information such as issued invoices and support tickets, and Mia (formerly known as the My2Cloud Portal).
Controller Purposes:	the processing purposes carried out by the parties as controllers, as set out in Schedule 2.
Customer:	a person or entity that receives Services from Assurestor under a Customer Agreement following a referral by a Partner or Referrer, or receives Partner Services from a Partner under an agreement with that Partner.
Customer Agreement:	an agreement between Assurestor and a Customer for the provision of Services.
Customer Systems:	the hardware and software systems of Customers that interact with, or may reasonably be expected to interact with, the Services.
Data Protection Laws:	all laws applicable to the processing of Personal Data in connection with the Principal Services Agreement, including but not limited to the UK GDPR and the UK Data Protection Act 2018 and, if the processing of Personal Data in connection with the Principal Services Agreement is subject to the EU GDPR, the EU GDPR.
Data Security Measures:	the technical and organisational measures that Assurestor applies to Relevant Data under its information security management system certified to ISO/IEC 27001:2022, as summarised at https://www.assurestor.com/data-security-measures, details of which are available to Partners, and to Customers referred to Assurestor by a Partner, on request from their Assurestor account contact.
Direct Partner Agreement:	an agreement between Assurestor and a Partner for the provision of Services for onward sale to Customers as Partner Services.
Distributor:	a business entity that distributes Services to Partners pursuant to a Distributor Agreement.
Distributor Agreement:	an agreement between Assurestor and a Distributor for the provision of Services for onward sale by the Distributor to Partners.
Distributor-Partner Agreement:	an agreement between a Distributor and a Partner for the provision of a Service for onward sale by Partner to Customers as Partner Services.
Engine:	the third party backup and disaster recovery software used to provide a Service, being any of Asigra, CloudAlly, HYCU, Veeam and HPE Zerto, or such other software as Assurestor may make available from time to time.
EU:	the member states of the European Union, the member states of the European Economic Area and Switzerland.
EU GDPR:	the General Data Protection Regulation (Regulation (EU) 2016/679).
Mia:	the artificial intelligence assistant made available within Control.
Online Partner Service Terms:	the terms and conditions set out at the URL in the Distributor-Partner Agreement, which govern use of the Services by Partners who purchase Services from a Distributor pursuant to a Distributor-Partner Agreement.
Order Form:	an order form prepared by Assurestor and executed by Partner or Customer pursuant to and in accordance with the Principal Services Agreement.
Partner:	any managed service provider, agent, reseller, distributor, OEM or any other kind of sales channel that sells, licenses, markets or distributes the Services as Partner Services pursuant to a Direct Partner Agreement or Distributor-Partner Agreement.
Partner Agreement:	a Direct Partner Agreement or an agreement between Assurestor and a Partner pursuant to the Online Partner Service Terms.
Partner Area:	the password-protected partner area of the Assurestor website, managed and made available by Assurestor to enable Partners, Distributors and Referrers to access information about the Services.
Partner Services:	the provision by Partner of the Services, support of the Services and other services built on or related to the Services to Customers.
Permitted Purposes:	the purposes for which the parties may process Relevant Personal Data, as set out in Schedule 2.
Personal Data:	as defined in the UK GDPR.
Platform:	a platform managed by or for Assurestor (including infrastructure provided by Vendors, such as Amazon Web Services) and used by Assurestor to provide the Services under the Assurestor Platform or the Assurestor Platform element of Assurestor Hybrid, including the application and database software for the Services, the system and server software used to provide the Services, and the computer hardware on which that application, database, system and server software is installed. Infrastructure operated by or for a Partner or Customer under Assurestor Control is not a Platform.
Principal Services Agreement:	the applicable Customer Agreement or Partner Agreement.
Processor Purposes:	the processing purposes carried out by Assurestor and/or Partners as processors, as set out in Schedule 2.
Processor Terms:	the processing terms between controllers and processors required by Article 28 of the UK GDPR and EU GDPR, as set out in Schedule 3.
Referrer:	a business entity that refers potential Customers to Assurestor to receive Services under a Customer Agreement.
Region:	the geographic region specified in the applicable Order Form (or, where none is specified, the region determined under paragraph 5.3 of the Processor Terms) in which Service Data stored on the Platform for a Service using a region-locked Engine is located, as described in Schedule 4.
Relevant Data:	Account Data, Service Data, Usage Data and User Data.
Relevant Personal Data:	Personal Data comprised in Relevant Data.
Schedule:	a schedule to this DPA.
Service Data:	any data, programs or other information of Customers stored on Customer Systems and copied, or to be copied, to a Platform via the Services, as described in Schedule 1.
Service Portal:	any of Control, the Partner Area, the Support Portal and Service-specific portals.
Service Term:	the term for the provision of a Service by Assurestor to a Partner or Customer, being the term of the Order Form for the Service or the subscription term for the Service under the Online Partner Service Terms, as applicable.
Services:	any services made available by Assurestor from time to time and purchased by Partner or Customer under the Principal Services Agreement.
Support:	the provision of support in relation to the use of, and the identification and resolution of errors in, the Services.
Support Portal:	Assurestor’s support portal made available at https://support.assurestor.com.
Third Party Services:	software, platforms and services operated by third party providers with which the Services are integrated or on which the Services are built, as identified in the applicable Principal Services Agreement.
Transfer Mechanism:	a condition set out in Chapter V of the UK GDPR or EU GDPR for ensuring an adequate level of protection for Personal Data transferred to a third country, including an adequacy decision under Article 45, an appropriate safeguard under Article 46 or a derogation under Article 49.
UK:	the United Kingdom of Great Britain and Northern Ireland.
UK GDPR:	the EU GDPR as transposed into UK law (including by the Data Protection Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019).
Usage Data:	data related to use of the Services by Customers and Partners, as described in Schedule 1.
User:	an individual end user who uses the Services and/or has access to a Service Portal on behalf of a Customer, Partner or Distributor.
User Data:	data related to use of the Platform, Services and Service Portals by Users, as described in Schedule 1.
Vendor:	a provider of Third Party Services.

2.2 Terms relating to the processing of Personal Data such as processing, controller, processor, data subject and supervisory authority have the meanings given to them in the applicable Data Protection Law.

3. Purposes for processing Relevant Personal Data

3.1 Assurestor, Customers and Partners may process Relevant Personal Data as reasonably necessary for the Permitted Purposes set out in Schedule 2.

4. Roles of the parties

4.1 Schedule 2 sets out the roles of the parties as controllers, processors or sub-processors in respect of the processing of Relevant Personal Data.

5. Application of Processor Terms

5.1 The Processor Terms shall apply to the processing of Service Data, which is processed by Assurestor and Partners only for Processor Purposes.

5.2 The Processor Terms shall not apply to the processing of Account Data, which is processed by the parties only for Controller Purposes, User Data, which is processed by Assurestor only for Controller Purposes or Usage Data, which does not contain Personal Data.

5.3 Where a Service is provided under Assurestor Control (including the Assurestor Control element of Assurestor Hybrid), Service Data is stored on infrastructure operated by or for Partner (or Customer) and not on a Platform. In that case: (a) Assurestor does not store Service Data and processes it only to the extent that the use of Control or the provision of Support involves access to, or the performance of any operation on, Service Data on the instructions of Customer or Partner on behalf of Customer, and the Processor Terms apply to that processing; and (b) Partner (or Customer) is responsible for the security of its own infrastructure and Engine licences, for its engagement of any Engine vendor or infrastructure provider it contracts with directly, and for its own compliance with the Data Protection Laws in respect of them.

6. Data security

6.1 Assurestor shall apply the Data Security Measures to Relevant Data.

6.2 Customer and Partner shall take reasonable steps to ensure that:

6.2.1 no unauthorised person gains access to the Platform or Services via a User account; and

6.2.2 persons it authorises to use the Platform and Services as Users have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, are adequately trained in data security and are reliable and aware of the confidential nature of Service Data and Account Data.

7. Data sharing

7.1 Assurestor may share:

7.1.1 Relevant Data with Vendors, to the extent necessary for the provision of the Services or Third Party Services;

7.1.2 Service Data and Account Data with any subcontractor appointed by Assurestor to provide Support, to the extent necessary for the provision of the Support requested;

7.1.3 User Data with any providers of services used by Assurestor in connection with the Services, such as web analytics, to the extent necessary for the provision of those services to Assurestor;

7.1.4 Account Data, User Data and Service-related information (including any Service Data comprised in it) with the provider of the artificial intelligence model used to provide Mia and Assurestor’s AI support agents, as identified in Schedule 4, to the extent necessary to answer questions put to Mia by Users and to triage and respond to Support requests, provided that Partner may restrict the information available to Mia, or switch Mia off, in Control; and

7.1.5 Relevant Data with other third parties if Assurestor is under a duty to disclose data in order to comply with any legal obligation, in connection with a merger or sale of Assurestor’s business or to protect the rights, property, or safety of Assurestor, Distributors, Partners, Customers, Users or others, provided that Assurestor must only share Relevant Data with such recipients if and to the extent necessary for the relevant processing purpose and in accordance with the Data Protection Laws.

7.2 Assurestor shall comply with its obligations as a processor under the Processor Terms when sharing Service Data.

8. Data retention and deletion

8.1 Assurestor shall retain Relevant Data in accordance with the retention and deletion provisions set out in Schedule 1.

9. Assurestor’s obligations

9.1 Assurestor shall comply with its obligations as a controller under the Data Protection Laws when processing Account Data or User Data for the Controller Purposes. Further information about Assurestor’s processing for the Controller Purposes is set out in Assurestor’s Privacy Notice.

9.2 Assurestor shall comply with its obligations as a processor under the Data Protection Laws and the Processor Terms when processing Service Data for the Processor Purposes.

10. Customer obligations

10.1 Customer shall comply with its obligations as a controller under the Data Protection Laws when processing Relevant Personal Data, including, without limitation, ensuring that it:

10.1.1 has a legal basis for that processing; and

10.1.2 provides data subjects with information about that processing.

10.2 Customer shall comply with its obligations as a controller under the Processor Terms when processing Service Data via the Services.

11. Partner obligations

11.1 Partner shall comply with its obligations as a controller under the Data Protection Laws when processing Account Data for the Controller Purposes.

11.2 Partner shall comply with its obligations as a processor under the Data Protection Laws when processing Service Data for the Processor Purposes on behalf of Customers and:

11.2.1 Partner shall comply with all Partner obligations set out in the Processor Terms;

11.2.2 Partner shall enter into binding data processing terms with its Customers that comply with the Data Protection Laws and are consistent with the Processor Terms;

11.2.3 Partner shall be responsible for obtaining and providing Assurestor with the Customer’s processing instructions and authorisation for international transfers of Service Data and engagement of sub-processors by Assurestor to process Service Data (Instructions and Authorisations);

11.2.4 Partner shall ensure that all Instructions and Authorisations it provides to Assurestor are in accordance with the Customer’s processing instructions, the data processing terms between Partner and the Customer and the Data Protection Laws;

11.2.5 Partner warrants that all Instructions and Authorisations set out in the Processor Terms and any document agreed between Assurestor and Partner in writing in respect of the Processor Purposes are in accordance with the Customer’s processing instructions, the data processing terms between Partner and the Customer and the Data Protection Laws;

11.2.6 Assurestor may treat all Instructions and Authorisations contained in the Processor Terms and any document agreed between Assurestor and Partner in writing in respect of the Processor Purposes as the Customer’s processing instructions;

11.2.7 Partner shall indemnify Assurestor in respect of any losses, damages, claims, penalties or other liabilities incurred by Assurestor arising out of a breach of the warranty in Clause 11.2.5.

12. Co-operation between the parties

12.1 Each party shall co-operate with the other, to the extent reasonably requested, in relation to:

12.1.1 any request by a data subject to exercise any of their rights as a data subject under the Data Protection Laws in respect of Relevant Personal Data;

12.1.2 any other communication from a data subject concerning the processing of their Personal Data comprised in Relevant Data; and

12.1.3 any communication from a supervisory authority concerning the processing of Relevant Personal Data.

13. Liability in respect of data processing

13.1 Each party’s liability to the other in respect of any breach of this DPA shall be governed by the liability provisions of the Principal Services Agreement.

14. Notices under this DPA

14.1 Any notice or other communication required under this DPA, including under the Processor Terms, shall be given in accordance with the notice provisions of the Principal Services Agreement and this Clause 14.

14.2 Notices between the parties to the Principal Services Agreement shall be sent directly to each other using the notice address details in the Principal Services Agreement.

14.3 For notices to be given to Customer as a controller of Service Data if the Services are provided to Customer under a Customer Agreement:

14.3.1 Assurestor shall send notices directly to Customer using the notice address details in the applicable Customer Agreement; and

14.3.2 Customer shall send notices directly to Assurestor using the notice address details in the applicable Customer Agreement.

14.4 For notices to be given to Customers as controllers of Service Data if the Services are provided to Customers under a Partner Agreement:

14.4.1 Assurestor shall send notices to Partner using the notice address details in the applicable Partner Agreement;

14.4.2 Partner shall forward Assurestor’s notices to its Customers who are affected by the notice; and

14.4.3 Partner shall receive and respond to all responses to the notices from its Customers in accordance with the services agreement and data processing terms between Partner and each Customer.

14.5 If the Services are provided to Customers under a Partner Agreement, provided that Assurestor has complied with this Clause 14, Assurestor shall have no liability to Partners or Customers in respect of the delivery of notices under this DPA to Customers or the outcome of the notices, including the use of new sub-processors and international transfers of Service Data pursuant to the Processor Terms.

15. Effect of termination of the Principal Services Agreement

15.1 Upon termination of the Principal Services Agreement, the obligations in this DPA shall survive and continue to have effect in respect of any Relevant Data retained by Assurestor after termination.

16. Changes in laws

16.1 If any changes or prospective changes to the Data Protection Laws or other applicable laws result or will result in one or both parties not complying with those laws in relation to their processing of data pursuant to the Principal Services Agreement, the parties shall use their reasonable endeavours to promptly agree such variations to this DPA and/or the Principal Services Agreement as may be necessary to remedy such non-compliance.

Schedule 1 to the Assurestor Data Processing Addendum

Data descriptions and retention periods

Data type	Description	Data subjects	Retention period	Start of retention period
Service Data	Fully determined by Customer. It includes any data, programs or other information of Customer stored on Customer Systems and copied, or to be copied, to a Platform via the Services.	Any individual to whom Personal Data comprised in Service Data relates.	Determined by Customer or Partner according to its use of the Services, subject to earlier deletion as a result of termination of the applicable Service Term by either party or suspension of a Service by Assurestor in accordance with the Principal Services Agreement. Service Data held on immutable storage is retained until the retention period applied to it expires, as described in paragraph 8.2 of the Processor Terms.	The date that Customer or Partner copies Service Data to a Platform via the Services.
Account Data	Names, usernames, work email addresses, work telephone numbers, job titles, authorisation in respect of the Services and Support, access credentials.	Users and other Customer, Partner and Distributor staff.	Account Data will remain in the Service Portal account(s) while the account is active and will be deleted within 90 days of closure of the account.	Creation of the account on the Service Portal.
User Data	Identification numbers, unique IDs, IP addresses, error reports, pages visited, browser information.	Users and other Customer, Partner and Distributor staff.	Control sign-in records are retained for up to 12 months and Control audit logs for 30 days. Other User Data will remain in the Service Portals for no longer than the duration of the Principal Services Agreement.	Date of collection.
Usage Data	Service usage information and counters used for billing purposes.	N/A (Usage Data does not contain Personal Data).	Usage Data will remain in Control for up to 12 months whilst the Principal Services Agreement is in force.	Date of collection.

Schedule 2 to the Assurestor Data Processing Addendum

Permitted Purposes for processing Relevant Personal Data

		Customer	Assurestor	Partner
Service Data	Purpose	Using the Services and obtaining Support in accordance with the Customer Agreement or equivalent agreement with Partner.	Providing the Services and Support in accordance with the applicable Principal Services Agreement.	Providing the Partner Services in accordance with the applicable Principal Services Agreement.
Service Data	Role	Controller	Processor under a Customer Agreement. Sub-processor under a Partner Agreement.	Processor
Account Data	Purpose	Accessing and using the Services and obtaining Support in accordance with the Customer Agreement or equivalent agreement with Partner. Accessing Service-related information via Control and Support Portal.	Enabling access to the Services by Customers and Partners and providing Support to Customers and Partners in accordance with the Principal Services Agreement. Marketing Assurestor products and services and providing information about the Services to Partners and Distributors via the Partner Area. Providing Service-related information, such as scheduled maintenance, changes to Services and changes to authentication processes, to Customers and Partners via Control and Support Portal.	Accessing and using the Services and obtaining Support itself and/or on behalf of its Customers in accordance with the applicable Principal Services Agreement. Accessing information made available by Assurestor via the Partner Area. Accessing Service-related information via Control and Support Portal.
Account Data	Role	Controller	Controller	Controller
User Data	Purpose	No access to User Data.	Developing and improving the Services and other Assurestor products and services. Managing and monitoring access to and use of the Services, Platform and Service Portals by Partners and Customers for the purposes of: ensuring compliance with the terms of the applicable Principal Services Agreement ensuring the security, integrity, resilience and operationality of the Services and Platform.	No access to User Data.
User Data	Role	N/A	Controller	N/A
Usage Data	Purpose	Accessing data about Customer’s use of the Services and validating the fees charged for the Services.	Monitoring use of the Services by Partners and Customers for the purposes of: billing providing Partners and Customers with live and analytics data about the Platforms they, and in the case of Partners, their Customers, use complying with reporting obligations to Vendors regarding use of Third Party Services by Customers and Partners.	Accessing data about its and its Customers’ use of the Services and validating the fees charged for the Services.
Usage Data	Role	N/A (Usage Data does not contain Personal Data).	N/A (Usage Data does not contain Personal Data).	N/A (Usage Data does not contain Personal Data).

Schedule 3 to the Assurestor Data Processing Addendum

Processor Terms

1. Detail of the processing of Service Data in connection with the Principal Services Agreement

Subject matter
Pursuant to the Principal Services Agreement, Service Data is stored on the Platform and processed via the Services for backup and/or disaster recovery purposes, as determined by Customer or Partner on behalf of Customer according to their instructions and use of the Services.
Nature
Customer or Partner on behalf of Customer processes Service Data via the Services as a result of using the Services. Assurestor processes Service Data as a result of operating the Platform and providing the Services to Customers and Partners and may also process Service Data in connection with the provision of Support or professional services if and to the extent that the provision of Support or those services involves access to Service Data or the performance of any operation on Service Data, such as deleting, updating, restoring, copying and exporting Service Data. Partner processes Service Data as a result of providing Partner Services to Customers and may also process Service Data in connection with the provision of Support or professional services as part of the Partner Services if and to the extent that the provision of Support or those services involves access to Service Data or the performance of any operation on Service Data.
Purpose
The provision of the Services by Assurestor to Customers and Partners under the Principal Services Agreement.
Categories of data subjects
Fully determined by Customer. It includes any individual to whom Personal Data comprised in Service Data relates.
Types of Personal Data
Fully determined by Customer. It includes any Personal Data comprised in Service Data.
Duration of processing
The applicable Service Term.

2. Processing Instructions

2.1 Assurestor shall only process Service Data on the documented instructions of Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement), including with regard to transfers of Service Data outside the UK or EU, as set out in these Processor Terms or any other document agreed by the parties in writing (Processing Instructions).

2.2 Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement) instructs Assurestor to process Service Data as reasonably necessary for the purpose of providing the Services in accordance with the Principal Services Agreement and to transfer Service Data outside the UK or EU in the circumstances, and subject to the Transfer Mechanisms, set out in Schedule 4 of this DPA.

2.3 Assurestor shall promptly inform Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement), if, in Assurestor’s opinion, any Processing Instruction infringes the Data Protection Laws. Once Assurestor has informed Customer or Partner under this Paragraph 2.3, Assurestor shall have no further liability to Customer or Partner in respect of the relevant processing being found to infringe the Data Protection Laws.

2.4 Notwithstanding any other provision of these Processor Terms, Assurestor may process Service Data otherwise than in accordance with the Processing Instructions if and to the extent that Assurestor is required to do so by applicable law. In such a case, Assurestor shall inform Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement) of the legal requirement before processing, unless that law prohibits such information.

3. Security

3.1 Assurestor shall ensure that persons it authorises to process Service Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and shall take reasonable steps to ensure that such persons are reliable and aware of the confidential nature of Service Data.

3.2 Assurestor, Customer and Partner shall each implement appropriate technical and organisational measures to ensure an appropriate level of security for Service Data, including but not limited to:

3.2.1 in Assurestor’s case, applying the Data Security Measures to Service Data; and

3.2.2 in Customer’s and Partner’s case, taking reasonable steps to ensure that: (i) no unauthorised person gains access to the Platform or Services via a User account; and (ii) persons it authorises to use the Platform and Services as Users have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, are adequately trained in data security and are reliable and aware of the confidential nature of Service Data.

4. Sub-processors

4.1 Assurestor must not engage any third party sub-processor to process Service Data without the prior specific or general written authorisation of Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement).

4.2 Assurestor is authorised by Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement) to engage, as sub-processors with respect to Service Data, the Vendors identified in Schedule 4 of this DPA ("Authorised Sub-Processors").

4.3 Assurestor shall inform Customer (if the Services are provided to Customer under a Customer Agreement) or Partner (if the Services are provided to Customer under a Partner Agreement) at least 14 days in advance of any intended changes concerning the addition or replacement of any Authorised Sub-Processor (the date of this notice being the “Notification Date”). Assurestor shall have no obligation to notify Customers directly if the Services are provided to them under a Partner Agreement. If the Services are provided to Customer under a Customer Agreement and Customer objects to a new sub-processor, Customer may terminate the Order Form for the Service(s) affected by the change in sub-processor by giving written notice to Assurestor within 14 days of the Notification Date (“the Notice Period”). Such termination shall take effect at the end of the Notice Period or 7 days after the date of Customer’s termination notice, whichever is later, and shall be subject to the provisions of the Customer Agreement relating to consequences of termination of an Order Form. This termination right is Customer’s sole and exclusive remedy if Customer objects to any new or replacement Authorised Sub-Processor. If no termination notice is received by Assurestor, Customer shall be deemed to have authorised the new sub-processor. Any addition to or replacement of an Authorised Sub-Processor under this Paragraph 4.3 shall be deemed to be an Authorised Sub-Processor. If the Service is provided to Customer under a Partner Agreement and Customer objects to a new sub-processor, Partner shall respond to the objection in accordance with the data processing terms between Partner and Customer, and Assurestor shall have no liability to Partner or Customer in respect of such new sub-processor.

4.4 Subject to Clause 13 of this DPA, Assurestor shall ensure that each Authorised Sub-Processor it engages to process Service Data is engaged pursuant to a written agreement containing equivalent legal obligations to those imposed on Assurestor by these Processor Terms and where an Authorised Sub-Processor fails to fulfil such obligations Assurestor shall remain fully liable to Customer (if the Services are provided to Customer under a Customer Agreement) or Partner (if the Services are provided to Customer under a Partner Agreement) for the performance of that Authorised Sub-Processor’s obligations.

5. International transfers of Service Data

5.1 Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement) authorises and instructs Assurestor to transfer Service Data outside the UK or EU in the circumstances, and subject to the Transfer Mechanisms, set out in Schedule 4 of this DPA.

5.2 Where a Service is provided on the Assurestor Platform using a region-locked Engine (including HYCU), Assurestor shall store the Service Data stored on the Platform for that Service only in the Region and shall not replicate or move that Service Data to a different Region except on the documented instructions of Customer (or Partner on behalf of Customer) or where required by applicable law, in which case paragraph 2.4 of these Processor Terms applies. For HYCU, the region lock applies to the data mover compute and the storage used for the Service, which are operated by Assurestor; the location of HYCU’s R-Cloud management plane, which processes metadata only, is as described in Schedule 4. Assurestor shall not make the Service available to a Customer, or allow Service Data to flow, until the HYCU subscription used for it has been established for the Region. Access to Service Data by Vendor or Assurestor support staff located outside the Region is permitted only as described in Schedule 4.

5.3 The Region for each Service shall be specified in the Order Form. Where no Region is specified, the Region shall be the UK. Assurestor may make additional Regions available from time to time and shall list them in Schedule 4.

6. Assistance with Customer controller obligations

6.1 Assurestor shall, insofar as possible and taking into account the nature of the processing, take appropriate technical and organisational measures to assist Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement) with the fulfilment of Customer’s controller obligation to respond to requests exercising a data subject's rights under the Data Protection Laws in respect of Service Data. Assurestor may charge Customer (if the Services are provided to Customer under a Customer Agreement) or Partner (if the Services are provided to Customer under a Partner Agreement) at its standard time-based charging rates for any work performed by Assurestor at the request of Customer or Partner in connection with responding to such requests where the Customer or Partner is able to respond to such requests itself using the functionality of the Services.

6.2 Assurestor shall assist Customer (if the Services are provided to Customer under a Customer Agreement) or Partner on behalf of Customer (if the Services are provided to Customer under a Partner Agreement) in ensuring compliance with the obligations relating to security of the processing of Personal Data, the notification of Personal Data breaches to the supervisory authority, the communication of Personal Data breaches to the data subject, data protection impact assessments and prior consultation in relation to high-risk processing under the Data Protection Laws in respect of Service Data. Assurestor shall report any Personal Data breach relating to Service Data to Customer (if the Services are provided to Customer under a Customer Agreement) or Partner (if the Services are provided to Customer under a Partner Agreement) without undue delay following Assurestor becoming aware of the breach. Assurestor may charge Customer (if the Services are provided to Customer under a Customer Agreement) or Partner (if the Services are provided to Customer under a Partner Agreement) at its standard time-based charging rates for any work performed by Assurestor at the request of Customer or Partner pursuant to this Paragraph 6.2, except where such work is necessitated by a breach by Assurestor of its obligations under these Processor Terms or the Data Protection Laws.

7. Information and audit

7.1 Assurestor shall make available to Customer (if the Services are provided to Customer under a Customer Agreement) or Partner (if the Services are provided to Customer under a Partner Agreement) on request copies of Assurestor’s current ISO/IEC 27001:2022, ISO 22301 and Cyber Essentials Plus certificates and, subject to appropriate confidentiality undertakings, a summary of the findings of its most recent external ISO/IEC 27001 audit, to demonstrate the compliance of Assurestor with its obligations under these Processor Terms and the Data Protection Laws.

7.2 Assurestor shall allow for and contribute to audits, including inspections, conducted by Customer or Partner on behalf of Customer or another auditor mandated by Customer or Partner on behalf of Customer in respect of the compliance of Assurestor's processing of Service Data with these Processor Terms and the Data Protection Laws. Partner or Customer must give Assurestor at least 14 days’ written notice of an audit unless the audit is required as a result of a Personal Data breach affecting Service Data or a breach by Assurestor of its obligations under these Processor Terms or the Data Protection Laws, in which case Partner or Customer must give Assurestor reasonable written notice. The audit must take place within Business Hours (as defined in the Principal Services Agreement). Audits shall not be carried out more than once in any 12-month period unless an audit is required as a result of a Personal Data breach affecting Service Data or a breach by Assurestor of its obligations under these Processor Terms or the Data Protection Laws. Assurestor may charge Customer (if the Services are provided to Customer under a Customer Agreement) or Partner (if the Services are provided to Customer under a Partner Agreement) at its standard time-based charging rates for any work performed by Assurestor at the request of Customer or Partner on behalf of Customer pursuant to this Paragraph 7.2, except where such work is necessitated by a breach by Assurestor of its obligations under these Processor Terms or the Data Protection Laws.

8. Return and deletion of Service Data

8.1 Customer acknowledges (if the Services are provided to Customer under a Customer Agreement), and Partner shall make Customer aware (if the Services are provided to Customer under a Partner Agreement), that because the purpose of the Services is the backup and storage of Service Data on the Platform, after the end of the provision of a Service to Customer, Assurestor shall delete all Service Data stored on the Platform in accordance with the data retention and deletion provisions set out in Schedule 1 and shall delete any copies of it in its possession or control save to the extent that applicable law requires storage of the relevant Personal Data.

8.2 Where Service Data is held on immutable storage (including storage subject to Object Lock in compliance mode), it cannot be deleted by Assurestor or any other person before the retention period applied to it under the applicable backup or archive policy expires. Customer acknowledges (if the Services are provided to Customer under a Customer Agreement), and Partner shall make Customer aware (if the Services are provided to Customer under a Partner Agreement), that such Service Data will be deleted on, or as soon as reasonably practicable after, expiry of that retention period, and that until then Assurestor shall continue to apply the Data Security Measures to it and shall not access or otherwise process it except to store and delete it or as required by applicable law.

Schedule 4 to the Assurestor Data Processing Addendum

Vendors and international transfers

This Schedule sets out the Vendors of Third Party Services used by Assurestor in the provision of the Services and the components they provide, the countries to which Service Data is transferred and the Transfer Mechanism used to protect any Service Data transferred out of the UK or EU. Where a Service is provided under Assurestor Control, this Schedule applies only to the extent that Assurestor supplies the relevant Engine licences or infrastructure; Partner (or Customer) remains responsible for any Engine vendor or infrastructure provider it engages directly.

Asigra (formerly Backup2Cloud)

Vendor	Component	Purpose	Country(ies)	Transfer Mechanism
Zadara Ltd	Cloud Compute and storage services	Provision of compute and storage services, located in Assurestor’s data centres, for the storage of Service Data.	Service Data is stored on Zadara storage infrastructure located in Assurestor’s data centre(s) in the region selected by Customer or by Partner on behalf of Customer. Zadara support staff may access Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.	Standard Contractual Clauses as referenced in Zadara’s customer data processing terms.

HPE Zerto (formerly DR2Cloud)

Vendor	Component	Purpose	Country(ies)	Transfer Mechanism
Hewlett-Packard Limited (UK) and its affiliates, including Zerto, a Hewlett Packard Enterprise company	HPE Zerto Software for MSPs, including consumption metering, HPE Zerto analytics and HPE Tech Care support	Licensing and consumption metering of the HPE Zerto Software, optional analytics and monitoring, and support of the HPE Zerto Software. HPE does not store Service Data. Replicated Service Data remains on the Zadara storage described below. HPE may access Service Data, or diagnostic logs containing Personal Data, only where Assurestor provides it to HPE for support, on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.	Metering, licensing and analytics data is processed by HPE on Amazon Web Services infrastructure, which may be located outside the UK. Support may be provided by Zerto UK Limited (England), Zerto Germany GmbH (Germany), Zerto, Inc. (USA), Zerto AUS Pty Ltd (Australia) and Ciklum S.A. (Ukraine), with Salesforce.com and OwnBackup Ltd (USA) used for support case records. The full list is in the HPE Zerto sub-processor list.	The HPE Data Privacy and Security Addendum, which incorporates the standard contractual clauses for processors and HPE’s Binding Corporate Rules for Processors for transfers within the HPE group.
Zadara Ltd	Storage services located in Assurestor’s data centres	Storage of Service Data protected or replicated using the Engine.	Service Data is stored on Zadara storage infrastructure located in Assurestor’s regional data centre(s) selected by Customer or by Partner on behalf of Customer. Zadara support staff may access Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.	As the transfer of Service Data to the selected datacentre is initiated and agreed by Customer or Partner on behalf of Customer, the Customer or Partner on behalf of Customer is responsible for complying with the transfer rules under Data Protection Laws. Any access to Service Data by Zadara support staff from outside the UK is subject to the Standard Contractual Clauses as referenced in Zadara’s customer data processing terms.

Vendor

Component

Purpose

Country(ies)

Transfer Mechanism

Hewlett-Packard Limited (UK) and its affiliates, including Zerto, a Hewlett Packard Enterprise company

HPE Zerto Software for MSPs, including consumption metering, HPE Zerto analytics and HPE Tech Care support

Licensing and consumption metering of the HPE Zerto Software, optional analytics and monitoring, and support of the HPE Zerto Software.

HPE does not store Service Data. Replicated Service Data remains on the Zadara storage described below. HPE may access Service Data, or diagnostic logs containing Personal Data, only where Assurestor provides it to HPE for support, on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.

Metering, licensing and analytics data is processed by HPE on Amazon Web Services infrastructure, which may be located outside the UK.

Support may be provided by Zerto UK Limited (England), Zerto Germany GmbH (Germany), Zerto, Inc. (USA), Zerto AUS Pty Ltd (Australia) and Ciklum S.A. (Ukraine), with Salesforce.com and OwnBackup Ltd (USA) used for support case records.

The full list is in the HPE Zerto sub-processor list.

The HPE Data Privacy and Security Addendum, which incorporates the standard contractual clauses for processors and HPE’s Binding Corporate Rules for Processors for transfers within the HPE group.

Zadara Ltd

Storage services located in Assurestor’s data centres

Storage of Service Data protected or replicated using the Engine.

Service Data is stored on Zadara storage infrastructure located in Assurestor’s regional data centre(s) selected by Customer or by Partner on behalf of Customer. Zadara support staff may access Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.

As the transfer of Service Data to the selected datacentre is initiated and agreed by Customer or Partner on behalf of Customer, the Customer or Partner on behalf of Customer is responsible for complying with the transfer rules under Data Protection Laws. Any access to Service Data by Zadara support staff from outside the UK is subject to the Standard Contractual Clauses as referenced in Zadara’s customer data processing terms.

Where Assurestor supplies HPE Zerto licences only and Partner deploys and operates HPE Zerto on its own infrastructure, Assurestor does not store or process Service Data in connection with that Service. In that case the HPE terms passed through to Partner under its agreement with Assurestor, including the HPE Data Privacy and Security Addendum, govern any processing of personal data by HPE, and Partner’s licence ends if Assurestor’s agreement with HPE expires or is terminated.

CloudAlly (formerly SaaS2Cloud)

Vendor	Component	Purpose	Country(ies)	Transfer Mechanism
CloudAlly Limited (an OpenText company)	CloudAlly Cloud-to-Cloud Backup Service	Online backup system that enables Customers to backup and archive cloud-based data.	Service Data is stored in the AWS regional datacentre(s) selected by Customer or by Partner on behalf of Customer. Support staff from CloudAlly Limited (Israel) and OpenText Inc. (USA) may access Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.	Standard Contractual Clauses as referenced in the OpenText Customer DPA.

HYCU

Vendor	Component	Purpose	Country(ies)	Transfer Mechanism
Amazon Web Services EMEA SARL	Assurestor-owned AWS accounts: a shared data mover compute account for each Region, and a dedicated member account for each Customer holding immutable (Object Lock) storage	Ephemeral data mover compute that copies Service Data from the Customer’s SaaS application, and immutable storage of the backup copies with HYCU-managed encryption.	Service Data is region-locked: the data mover compute and the storage for a Customer are in the same Region, and Service Data is not replicated or moved outside that Region except as described in paragraph 5.2 of the Processor Terms. For the UK Region, Service Data is processed and stored in the AWS Europe (London) region (eu-west-2). Additional Regions may be made available by Assurestor and, if selected, will be specified in the Order Form.	None required where the Region is the UK, as Service Data processed by AWS is not transferred outside the UK. Where a Region outside the UK is selected by Customer or by Partner on behalf of Customer, the transfer of Service Data to that Region is initiated and agreed by Customer or Partner on behalf of Customer, who is responsible for complying with the transfer rules under the Data Protection Laws.
HYCU Ltd (Ireland) and its affiliates, including HYCU, Inc.	HYCU R-Cloud control plane (orchestration, catalogue and user interface), operated by HYCU and hosted on Google Cloud Platform	Scheduling and orchestration of the backup and restore of Customer SaaS application data. The control plane processes instructions, job state and metadata about Service Data (such as item names in the backup catalogue); it does not store backup copies of Service Data.	Assurestor holds a separate HYCU R-Cloud subscription for each Region, and each subscription’s management plane is hosted in the location designated for it. HYCU’s Data Processing Addendum provides for hosting in the EU or the US at Assurestor’s designation. HYCU’s own sub-processors are listed in Annex III of its Data Processing Addendum and include Google Cloud Platform (hosting), Zendesk (support tickets, US) and AskNicely (customer experience, US and EU). HYCU support staff may access Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.	The UK Addendum to the Standard Contractual Clauses, as incorporated in HYCU’s Data Processing Addendum (clause 7.2).

Vendor

Component

Purpose

Country(ies)

Transfer Mechanism

Amazon Web Services EMEA SARL

Assurestor-owned AWS accounts: a shared data mover compute account for each Region, and a dedicated member account for each Customer holding immutable (Object Lock) storage

Ephemeral data mover compute that copies Service Data from the Customer’s SaaS application, and immutable storage of the backup copies with HYCU-managed encryption.

Service Data is region-locked: the data mover compute and the storage for a Customer are in the same Region, and Service Data is not replicated or moved outside that Region except as described in paragraph 5.2 of the Processor Terms.

For the UK Region, Service Data is processed and stored in the AWS Europe (London) region (eu-west-2).

Additional Regions may be made available by Assurestor and, if selected, will be specified in the Order Form.

None required where the Region is the UK, as Service Data processed by AWS is not transferred outside the UK.

Where a Region outside the UK is selected by Customer or by Partner on behalf of Customer, the transfer of Service Data to that Region is initiated and agreed by Customer or Partner on behalf of Customer, who is responsible for complying with the transfer rules under the Data Protection Laws.

HYCU Ltd (Ireland) and its affiliates, including HYCU, Inc.

HYCU R-Cloud control plane (orchestration, catalogue and user interface), operated by HYCU and hosted on Google Cloud Platform

Scheduling and orchestration of the backup and restore of Customer SaaS application data. The control plane processes instructions, job state and metadata about Service Data (such as item names in the backup catalogue); it does not store backup copies of Service Data.

Assurestor holds a separate HYCU R-Cloud subscription for each Region, and each subscription’s management plane is hosted in the location designated for it.

HYCU’s Data Processing Addendum provides for hosting in the EU or the US at Assurestor’s designation.

HYCU’s own sub-processors are listed in Annex III of its Data Processing Addendum and include Google Cloud Platform (hosting), Zendesk (support tickets, US) and AskNicely (customer experience, US and EU). HYCU support staff may access Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.

The UK Addendum to the Standard Contractual Clauses, as incorporated in HYCU’s Data Processing Addendum (clause 7.2).

Veeam (formerly Veeam2Cloud)

Vendor	Component	Purpose	Country(ies)	Transfer Mechanism
Zadara Ltd	Storage services located in Assurestor’s data centres	Storage of Service Data protected or replicated using the Engine.	Service Data is stored on Zadara storage infrastructure located in Assurestor’s regional data centre(s) selected by Customer or by Partner on behalf of Customer. Zadara support staff may access Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.	As the transfer of Service Data to the selected datacentre is initiated and agreed by Customer or Partner on behalf of Customer, the Customer or Partner on behalf of Customer is responsible for complying with the transfer rules under Data Protection Laws. Any access to Service Data by Zadara support staff from outside the UK is subject to the Standard Contractual Clauses as referenced in Zadara’s customer data processing terms.

All Services

Vendor	Component	Purpose	Country(ies)	Transfer Mechanism
Anthropic Ireland, Limited and its affiliate Anthropic, PBC	AI model used by Mia and by Assurestor’s AI support agents	Answering questions put to Mia by Users about their Services in Control. Assisting Assurestor in triaging and responding to Support requests. Partner may restrict the information available to Mia, or switch Mia off, in Control.	United States. Anthropic may not train models on this information. Inputs and outputs are retained by Anthropic for 30 days, during which they may be accessed by Anthropic for safety and security purposes, and are then deleted. Anthropic’s sub-processors are listed at anthropic.com/subprocessors.	The UK Addendum to the Standard Contractual Clauses, as incorporated in Anthropic’s Data Processing Addendum.
N/A	N/A	Provision of Support to Customers and Partners.	Assurestor staff based in the UK may access Service Data if and to the extent that the provision of Support or professional services involves access to Service Data or the performance of any operation on Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.	No Transfer Mechanism is required under the UK GDPR. Transfers of Service Data from the EU to Assurestor staff based in the UK are covered by the European Commission’s adequacy decision in respect of the UK under the EU GDPR.

Vendor

Component

Purpose

Country(ies)

Transfer Mechanism

Anthropic Ireland, Limited and its affiliate Anthropic, PBC

AI model used by Mia and by Assurestor’s AI support agents

Answering questions put to Mia by Users about their Services in Control.

Assisting Assurestor in triaging and responding to Support requests.

Partner may restrict the information available to Mia, or switch Mia off, in Control.

United States.

Anthropic may not train models on this information. Inputs and outputs are retained by Anthropic for 30 days, during which they may be accessed by Anthropic for safety and security purposes, and are then deleted.

Anthropic’s sub-processors are listed at anthropic.com/subprocessors.

The UK Addendum to the Standard Contractual Clauses, as incorporated in Anthropic’s Data Processing Addendum.

N/A

Provision of Support to Customers and Partners.

Assurestor staff based in the UK may access Service Data if and to the extent that the provision of Support or professional services involves access to Service Data or the performance of any operation on Service Data, but only on and in accordance with the instructions and authorisation of Customer or Partner on behalf of Customer.

No Transfer Mechanism is required under the UK GDPR. Transfers of Service Data from the EU to Assurestor staff based in the UK are covered by the European Commission’s adequacy decision in respect of the UK under the EU GDPR.