Skip to content
InterchangeGate
Talk to us

Data processing agreement

Version 1.0 · 26 October 2026. This agreement forms part of the Customer terms between Athri & Aurva Limited, trading as InterchangeGate (the processor) and the customer named on the order form (the controller). It applies whenever we process personal data in customer data on your behalf, and meets Article 28 of the UK GDPR.

1. Roles and scope

1.1 You are the controller and we are the processor of personal data in customer data. Annex 1 describes the processing.

1.2 You confirm you have a lawful basis for the processing and have given any notices needed for us to process the personal data.

1.3 Words such as personal data, processing, data subject and personal data breach have the meanings in the UK GDPR and the Data Protection Act 2018 (together, data protection law). Where the EU GDPR applies to you, references to the UK GDPR include it.

2. Our obligations

We will:

  1. process personal data only on your documented instructions, which are the Customer terms, this agreement, your flow configuration and your written requests, including for transfers outside the UK, unless the law requires otherwise (in which case we'll tell you first, unless the law forbids it);
  2. tell you promptly if we believe an instruction breaks data protection law;
  3. ensure everyone who may access personal data is bound by confidentiality;
  4. take the security measures in Annex 2;
  5. assist you, taking into account the nature of the processing, in responding to data subjects exercising their rights, mainly by giving you access through the portal and exports;
  6. assist you with security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the nature of processing and the information available to us;
  7. at the end of the agreement, return the personal data through the export in clause 12.6 of the Customer terms and then delete it, unless the law requires us to keep it;
  8. make available the information you reasonably need to show compliance with Article 28, and allow and contribute to audits (see clause 5).

3. Sub-processors

3.1 You give general authorisation for us to use the sub-processors listed on our Sub-processors page.

3.2 We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we'll discuss it in good faith; if we can't resolve it, you may end the affected flows or the agreement without penalty before the change.

3.3 We will put written terms in place with each sub-processor that protect personal data at least as well as this agreement, and we remain responsible to you for their performance.

4. Personal data breaches

4.1 We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data.

4.2 We will give you the information you reasonably need to assess the breach and meet your own notification duties, and will take reasonable steps to contain and fix it.

4.3 Telling you about a breach is not an admission of fault.

5. Information and audits

5.1 We will answer reasonable written questions about our data protection practices and provide our security summary.

5.2 If that information isn't enough to show compliance, you may audit us once a year, or after a personal data breach, with 30 days' notice, during business hours, and at your own cost. The auditor must be bound by confidentiality and not be a competitor of ours.

6. International transfers

We host and process customer data in the UK. We will only transfer personal data outside the UK (including through a sub-processor) under UK adequacy regulations, the ICO's international data transfer agreement or addendum, or another lawful safeguard, and we will list each such transfer on our Sub-processors page.

7. Liability and order of documents

7.1 Liability under this agreement is subject to the limits in clause 11 of the Customer terms. This does not limit either party's liability to data subjects under data protection law.

7.2 On personal data, this agreement takes priority over the rest of the Customer terms.

Annex 1 — Details of processing

ItemDetail
Subject matterReceiving, translating, validating, storing and delivering business documents between the controller, its systems and its trading partners
DurationThe term of the Customer terms, plus the deletion period after it ends
Nature and purposeHosting, format conversion, transmission over AS2, SFTP and email, status tracking, error handling, support, encrypted backups, and AI-assisted mapping, testing and error investigation (Anthropic's Claude, on anonymised samples wherever possible)
Types of personal dataNames, job titles, business email and phone numbers, delivery and invoice addresses, and any personal data the controller or its partners include in documents (for example, home delivery addresses on drop-ship orders)
Special category dataNone expected. The controller will not send special category or criminal offence data.
Data subjectsEmployees and contacts of the controller and its trading partners; the controller's end customers where named in documents

Annex 2 — Security measures