Data Processing Agreement

Overview of Xirgo's standard customer data processing terms

1. Status of this page

This page summarises the principal terms in Xirgo's standard Personal Data Processing Agreement (PDPA). It is not itself an executed agreement and does not replace or amend the customer-specific PDPA, Master Services and Services Agreement (MSSA), Standard Contractual Clauses, UK transfer mechanism, or other signed terms. Where there is any difference, the executed contractual documents control.

The full standard PDPA can be requested by sending an email to: privacy@xirgo.com with the subject line including the phrase “PDPA”.

2. Roles, processing purposes and instructions

Where Xirgo processes Personal Data for a customer under the standard PDPA, the customer is the data controller and Xirgo is the data processor for the covered processing. The relevant annex identifies the business purposes, Personal Data categories, data subject types, processing duration, authorised persons, permitted transfer locations and approved subprocessors.

• Xirgo processes Personal Data only as necessary for the agreed business purposes and in accordance with written instructions from authorised customer representatives.
• Xirgo must promptly notify the customer if, in Xirgo's opinion, a customer instruction would not comply with applicable privacy and data protection requirements.
• If law requires Xirgo to process or disclose Personal Data, Xirgo must first inform the customer and give the customer an opportunity to object or challenge the requirement, unless the law prohibits that notice.
• Where Xirgo collects Personal Data for a customer, the collection notice or method must be specifically pre-approved by the customer in writing.

3. Confidentiality, personnel and security

Access to customer Personal Data is limited to personnel who need access to perform their duties and only to the data necessary for those duties. Relevant personnel are informed of the confidential nature and use restrictions of Personal Data, are subject to confidentiality obligations, and receive privacy and data protection training relevant to their role.

Xirgo implements appropriate technical and organisational measures designed to protect Personal Data against unauthorised or unlawful processing, access, copying, modification, storage, reproduction, display or distribution, and against accidental loss, unavailability, destruction or damage. The standard PDPA also requires reasonable precautions to preserve data integrity and support effective backup and restoration.

4. Security incidents and breach response

The parties must promptly notify one another when they become aware of unauthorised or unlawful processing or a Security Breach. Xirgo cooperates with the customer in investigating and responding to the incident and makes relevant records, logs, files and other information available as required by the PDPA.

• Xirgo must not inform a third party of a Security Breach without the customer's prior written consent, except where law or regulation requires disclosure.
• The customer has the sole right under the standard PDPA to determine whether notices are provided to data subjects, regulators, law enforcement or others, and whether remedies are offered to affected data subjects, subject to applicable law.
• The standard PDPA allocates reasonable breach-response costs between the parties and requires Xirgo to reimburse actual reasonable customer expenses to the extent a Security Breach was caused by Xirgo, subject to the agreement's stated exceptions and conditions.

5. International transfers

The PDPA annex identifies the countries in which Xirgo may receive, access, transfer or store Personal Data. Xirgo must not receive, access, transfer or store Personal Data outside those listed countries without the customer's prior written consent.

Where a transfer requires the European Commission Standard Contractual Clauses (SCCs), the parties complete and execute the applicable SCCs and take the other actions required to legitimise the transfer, including any needed supplementary measures or supervisory-authority consultations. UK-specific transfer terms are addressed through the applicable UK agreement version or transfer mechanism.

6. Subprocessors

• The customer is given full details of a proposed subprocessor and a 10-day opportunity to object.
• Subprocessors must be engaged under written terms containing obligations substantially equivalent to the PDPA requirements, and Xirgo remains liable to the customer for the subprocessor's performance of those obligations.
• Xirgo maintains control over Personal Data entrusted to subprocessors and lists approved subprocessors in the applicable annex.
• On the customer's written request and at the customer's expense, Xirgo will audit a subprocessor's compliance with its obligations relating to the customer's Personal Data and provide the customer with the audit results.

7. Data subject requests, return and destruction

Xirgo must immediately notify the customer of complaints, notices or communications relating to the covered processing or compliance obligations. If Xirgo receives a data subject access request or similar rights request, the standard PDPA requires notification to the customer within five working days and requires Xirgo to provide cooperation and assistance.

At the customer's request, Xirgo provides a copy of or access to customer Personal Data in its possession or control. On termination or expiry, Personal Data is securely destroyed or returned as directed, subject to limited retention where required for compliance, regulatory or audit purposes.

8. Records and audit

Xirgo keeps detailed, accurate and current records of covered Personal Data processing, including access, control, security, approved subprocessors and affiliates, and processing purposes. The parties review the PDPA annex information annually and update it when needed to reflect current practices.

• The customer and its third-party representatives may audit Xirgo's compliance with the PDPA on at least 30 days' notice, at the customer's expense, during the term and for two years after termination.
• The standard notice period does not apply where the customer reasonably believes a Security Breach has occurred or is occurring, or that Xirgo is in breach of the PDPA or applicable privacy and data protection requirements.
• The PDPA also provides for Xirgo to conduct its own audit following a Security Breach or compliance breach and, on the customer's written request and at the customer's expense, to conduct information-security audits as described in the agreement.

9. Termination, warranties, indemnity and notices

The PDPA remains in force while the MSSA remains effective or while Xirgo retains Personal Data covered by the MSSA. Failure by Xirgo to comply with the PDPA is treated as a material breach for the purposes stated in the agreement, and the PDPA also addresses suspension or termination where legal or regulatory changes prevent compliant processing.

The standard PDPA contains mutual and provider warranties concerning lawful processing, personnel, security and compliance, together with an indemnification provision covering specified failures by Xirgo or persons acting on its behalf. The exact scope of warranties, indemnity, liability and remedies is governed only by the executed contractual terms.

Formal notices under the PDPA must be in writing and delivered to the contacts specified in the executed agreement. The source templates contain jurisdiction-specific notice provisions and contact placeholders; no public privacy email address is asserted by this page.

10. Agreement details

Customer-specific terms are completed in the agreement annexes before execution, including processing purposes, data categories, data subject types, duration, authorised persons, transfer locations and mechanisms, and approved subprocessors. Xirgo maintains EU (with and without adequacy agreement), UK and US versions of its PDPA template for the relevant contractual context.