Legal — GDPR Art. 28
Data Processing Agreement
Between the Customer (Controller, 〔company name, registered address, company number〕) and Axiom Revenue Labs (Processor, 〔registered address, company number — pending CRO incorporation〕), effective 〔date〕.
Template v1.0 — 14 October 2026. This page is a scaffold for review; an executed DPA is completed per engagement with placeholders filled and both parties’ signatures. It does not itself form a binding agreement.
1.Subject Matter, Duration, Nature and Purpose
The Customer (Controller) appoints Axiom Revenue Labs (Processor) to process personal data solely to deliver the services agreed in the underlying engagement: structural diagnostics of revenue automation, brand-guarded content operations, and grant-completion workflows. Processing duration equals the engagement term plus any statutory retention period. Processing is automated where possible; no human review of Customer personal data occurs except for support at the Customer’s request.
2.Categories of Data and Data Subjects
Categories of data: business contact data (name, business email, business phone, company, role); funnel answers provided by the Customer’s business representatives; workflow schema content provided for diagnostic purposes. Categories of data subjects: employees and representatives of the Customer; the Customer’s prospects and customers where lawfully provided by the Customer. Axiom Revenue Labs does not process special categories of personal data (Art. 9 GDPR) and instructions to do so will be declined.
3.Processor Obligations (Art. 28(3) GDPR)
Axiom Revenue Labs processes personal data: (a) only on documented instructions from the Customer; (b) only by personnel bound to confidentiality; (c) implementing appropriate technical and organisational measures per Art. 32 (see Section 6); (d) respecting conditions for engaging subprocessors (see Section 4); (e) assisting the Customer with data subject requests, breach notifications, and data protection impact assessments within a reasonable timeframe; (f) deleting or returning all personal data at the end of the engagement at the Customer’s choice, and deleting existing copies unless EU or Irish law requires storage.
4.Sub-processors
The Customer grants general authorisation for sub-processing by the parties listed at axiomrevenuelabs.com/security (Subprocessor List, reviewed quarterly). Axiom Revenue Labs will notify the Customer of intended additions or replacements with no less than 14 days’ notice; the Customer may object on reasonable data-protection grounds within that window. Where objection is upheld and no workable alternative exists, the affected processing may be terminated without penalty.
5.International Transfers
Personal data is processed within the EU/EEA except where a listed sub-processor operates outside it (currently: newsletter delivery to the US). Transfers rely on adequacy decisions or appropriate safeguards, including Standard Contractual Clauses, and — where required — supplementary technical measures.
6.Security Measures (Art. 32)
Row-Level Security tenant isolation at the database layer; Zero Trust network access with per-request identity checks; TLS in transit and encryption at rest for backups and credential stores; append-only audit logging of state changes; tested encrypted backups in the EU; data minimisation by design. Details: axiomrevenuelabs.com/security.
7.Personal Data Breach Notification
Axiom Revenue Labs will notify the Customer without undue delay — and in any event within 72 hours of becoming aware — of any personal data breach affecting the Customer’s data, with sufficient detail to meet the Customer’s Art. 33 obligations and to document the breach under Art. 33(5).
8.Audits and Inspections
Axiom Revenue Labs will make available all information reasonably necessary to demonstrate compliance with Art. 28 and will allow, contribute to, and not object to audits — including inspections by the Customer or a mandated auditor — at reasonable intervals and with reasonable notice. Third-party audit summaries (e.g. SOC 2, when issued) will be provided on request.
9.Liability and Term
Liability follows the underlying engagement agreement, subject to mandatory law. This DPA forms part of that agreement and terminates with it, subject to the return-and-delete obligations in Section 3(f). Governing law: Ireland.
To execute this DPA for your engagement, or for questions on any clause: