Data processing addendum
Last updated: 14 March 2026
This Data Processing Addendum (“DPA”) forms part of the agreement (the “Agreement”) between Acutro Ltd (“Acutro”, “we”, “us” or “our”) and the customer (“Customer” or “Controller”) for the provision of the Acutro Platform and related services (the “Services”).
This DPA applies only where Acutro acts as Processor of Personal Data on behalf of the Customer as Controller. It replaces any conflicting data processing terms in the Agreement. It does not apply where Acutro acts as Controller or where the Customer uses the Services to process data as a processor on behalf of third parties.
By signing the Agreement or using the Services, the Customer agrees to the terms of this DPA.
1. Definitions
Capitalised terms have the meanings given in the UK GDPR, EU GDPR, and the Agreement. Additional definitions:
- Applicable Data Protection Laws: the UK GDPR, Data Protection Act 2018, EU GDPR (where applicable in EMEA), and any other data protection laws applicable to the Processing.
- Personal Data: any information relating to an identified or identifiable natural person Processed by Acutro on behalf of the Customer (including building telemetry, occupancy data, access logs or visitor records that may relate to individuals).
- Processing: any operation performed on Personal Data.
- Sub-processor: any third party (including Acutro Affiliates) appointed by Acutro to Process Personal Data.
2. Roles and scope
The Customer is the Controller and remains fully responsible for:
- ensuring it has a lawful basis for Processing;
- providing privacy information to Data Subjects;
- obtaining any required consents; and
- responding to Data Subject requests.
Acutro is the Processor and shall Process Personal Data only in accordance with the Customer’s documented instructions (the Agreement and the Customer’s use of the Services being the complete and final instructions) and Applicable Data Protection Laws.
Acutro shall promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws (unless prohibited by law).
The subject matter, duration, nature, purpose, types of Personal Data and categories of Data Subjects are set out in Annex 1.
3. Customer warranties and responsibilities
The Customer warrants that:
- it has all necessary rights and lawful bases to provide Personal Data to Acutro;
- the Processing instructions are lawful and do not infringe third-party rights; and
- it will not submit (and will instruct users not to submit) special category data or prohibited data (e.g. health data under HIPAA/COPPA equivalents) unless expressly authorised in writing.
The Customer shall indemnify Acutro against all claims, losses and costs arising from any breach of these warranties.
4. Security
Acutro shall implement commercially reasonable technical and organisational measures appropriate to the risk, as described in Annex 2. Acutro may update these measures provided there is no material degradation in overall security.
No method of transmission or storage is 100% secure. Acutro does not guarantee absolute security. Transmission of Personal Data is at the Customer’s own risk. The Customer is responsible for configuring the Services securely and keeping account credentials confidential.
5. Sub-processors
The Customer grants Acutro general authorisation to engage Sub-processors (including Affiliates and cloud providers such as AWS). Acutro shall ensure Sub-processor agreements contain equivalent data protection obligations.
A current list of Sub-processors is available on request. Acutro shall notify the Customer of any new or replacement Sub-processor (by email or via the Platform). The Customer may object on reasonable data protection grounds within 10 business days. If the parties cannot resolve the objection within 30 days, the Customer may terminate the affected part of the Services without penalty.
Acutro remains liable for the acts and omissions of its Sub-processors.
6. Data Subject rights and assistance
Acutro shall notify the Customer without undue delay of any Data Subject request it receives. Acutro shall provide commercially reasonable assistance to enable the Customer to respond to Data Subject requests, conduct DPIAs or respond to supervisory authorities.
The Customer shall reimburse Acutro for all reasonable costs incurred in providing such assistance.
7. Personal Data breach
Acutro shall notify the Customer without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data breach. The notification shall include available details to assist the Customer with its obligations. Acutro shall investigate and take reasonable steps to mitigate the breach.
Notification of a breach is not an admission of fault or liability. The Customer is responsible for any required notifications to Data Subjects or supervisory authorities.
8. Data Portability, Return and Deletion of Personal Data (Data Freedom)
Acutro is committed to a data freedom model and supports traditional exit strategies that enable Customers to migrate their data easily when they cease using the Services, avoiding vendor lock-in.
Upon termination or expiry of the Agreement for any reason, and provided the Customer submits a written export request within sixty (60) days of the effective date of termination, Acutro shall make the Customer’s Personal Data available in a structured, commonly used and machine-readable format (such as CSV, JSON or another suitable industry-standard format for smart building telemetry data).
Acutro shall use reasonable endeavours to provide the export within a further sixty (60) days of receiving the complete request. Reasonable professional services fees may apply for assistance beyond the standard self-service export functionality available in the Platform.
Following successful export (or if no such request is received within the 60-day window), and at the Customer’s written election, Acutro shall securely delete or return all remaining copies of the Personal Data (except backup copies, which shall be deleted in the ordinary course of business) and shall, upon request, provide a written certificate of deletion. This is subject to any legal retention obligations. The terms of this DPA shall continue to apply until all Personal Data has been returned, exported or deleted.
9. Audits
Upon the Customer’s written request (no more than once per calendar year), Acutro shall provide information or allow an audit to demonstrate compliance.
Audits:
- require at least 90 days’ prior notice and a detailed audit plan;
- must be conducted during business hours, without unreasonable disruption;
- are at the Customer’s sole expense (including Acutro’s reasonable costs); and
- are subject to confidentiality obligations and Acutro’s security policies (no copying of records or access to other customers’ data).
Acutro may satisfy the audit obligation by providing a recent SOC 2 Type II or ISO 27001 report (or equivalent).
10. International transfers
Acutro is based in the United Kingdom. Where Personal Data is transferred outside the UK/EEA, appropriate safeguards are in place (UK IDTA, EU Standard Contractual Clauses (2021/914) as supplemented by the UK Addendum, or other approved mechanisms). The Customer consents to such transfers by using the Services.
Full details are in Annex 3.
11. Aggregated and anonymised data
Acutro may aggregate, de-identify or anonymise Personal Data. Once anonymised, the data is no longer Personal Data and Acutro may use, disclose and exploit it freely for any purpose (including product development, benchmarking and commercial use) without restriction or further notice.
12. Liability
Acutro’s total aggregate liability arising out of or in connection with this DPA (including any breach) shall be subject to the limitation of liability provisions in the Agreement (or, if none, capped at the total fees paid by the Customer in the 12 months preceding the claim). This cap applies even if the Agreement contains no separate limitation clause.
13. Term and termination
This DPA continues for the duration of the Agreement and survives termination until all Personal Data has been deleted or returned.
14. Governing law
This DPA is governed by the laws of England and Wales. Disputes shall be subject to the exclusive jurisdiction of the English courts.
Annex 1 – Details of Processing
Subject matter and purpose: Provision of the Acutro smart buildings Platform (real-time telemetry, energy optimisation, occupancy insights, asset performance).
Duration: Term of the Agreement plus any post-termination retention.
Categories of Data Subjects: Employees, contractors, visitors and occupants of Customer buildings.
Categories of Personal Data: Names, emails, phone numbers, access credentials, IP addresses, device IDs, location/occupancy data derived from sensors, access logs, visitor records (where provided).
Special categories: None (unless expressly authorised in writing; processed only as Processor under Customer instructions).
Annex 2 – Technical and Organisational Measures
Reference to Acutro’s Security Practices (available on request). Includes encryption in transit/rest, access controls, logging, regular testing, ISO 27001-aligned processes (or equivalent), and staff confidentiality obligations.
Annex 3 – International Transfers & Sub-processors
- Standard Contractual Clauses (Module 2: Controller-to-Processor) and UK International Data Transfer Addendum incorporated by reference.
- Current Sub-processors list available on request or via the Platform.