Data Processing Agreement

Last updated: October 12, 2026

Version 1.1. This Data Processing Agreement (the "DPA") forms part of Our Terms and Conditions. It applies whenever We process Customer Personal Data for You, and it needs no separate signature. You can save or print this page at any time. If Your organization needs a copy signed by both parties, email support@axiospec.com.

If Your workspace existed before this version was published on Our website, this DPA applies to it from the day it was published, unless You object by email to support@axiospec.com within 30 days of that day.

1. Parties and definitions

This DPA is between CaliTech LLC d/b/a Axiospec, a Tennessee limited liability company, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States ("We", "Us" or "Our"), and the customer that accepted Our Terms and Conditions for a workspace ("You" or "Your").

Customer Personal Data means personal data that You or Your users put into a workspace and that We process for You to provide the Service.
Data Protection Law means every data protection law that applies to Customer Personal Data. That includes the GDPR (Regulation (EU) 2016/679), the UK GDPR read with the Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP).
Standard Contractual Clauses means the clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0, in force from 21 March 2022.
Personal data, processing, controller, processor, data subject, supervisory authority and personal data breach have the meanings the GDPR gives them.

If this DPA and the Terms and Conditions conflict about Customer Personal Data, this DPA governs. If this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses govern.

2. Roles

You are the controller of Customer Personal Data. We process it on Your behalf as Your processor. If You are yourself a processor for another controller, We act as Your subprocessor.

We are an independent controller of the account data We need to run Our relationship with You. That covers Your users' names and email addresses for sign-in, billing and support. Our Privacy Policy covers that data. This DPA does not.

Annex A describes the processing: its subject, duration, nature and purpose, the categories of data subjects and the categories of personal data.

3. Your instructions

We process Customer Personal Data only on Your documented instructions, including on transfers to a third country. The only exception is where EU or Member State law, UK law or Swiss law that applies to Us requires otherwise. In that case We tell You before We process, unless that law forbids it on important grounds of public interest. A request from a public authority under any other law is handled as section 10 says.

Your instructions are the Terms and Conditions, this DPA, the settings You choose in the Service, and any further written instruction We agree with You.

We tell You immediately if, in Our opinion, an instruction breaks Data Protection Law. We do not give legal advice.

You are responsible for having a lawful basis for the personal data You put into the Service. That includes data about people who are not Your users. The Service has free-text fields, photographs and vendor contact records, and You decide what goes into them.

4. Confidentiality

Everyone We allow to process Customer Personal Data is bound by a duty of confidentiality. Today that is one person, the owner of CaliTech LLC. We will tell You if that changes in a way that widens access.

5. Security

We apply the technical and organisational measures in Annex B. We chose them with regard to the state of the art, the cost, the nature, scope, context and purposes of the processing, and the risk to data subjects.

Annex B also says what is not in place. Do not read a gap in it as a control We have not named.

We may change a measure, as long as the change does not lower the overall level of security.

6. Subprocessors

You give Us general written authorisation to use subprocessors. Annex C lists them.

At least 30 days before a new subprocessor starts processing Customer Personal Data, We tell You in writing. We email the administrators of every workspace, and We update Our Subprocessors page. You may object on reasonable data protection grounds within 30 days of the notice. If We cannot resolve Your objection, You may end the affected part of the Service and We refund the fees You prepaid for the rest of the period.

Each subprocessor is bound by written data protection terms. These are the standard terms each vendor publishes. We do not negotiate separate terms with any of them. We remain fully liable to You for how each subprocessor performs.

Push notifications to an iPhone also pass through Apple Push Notification service, which Apple requires every iPhone app to use. Apple is not Our subprocessor and is not bound by data protection terms with Us. It receives the device token and the text of the alert. That text names an instrument and says it is due, overdue or quarantined, and names no person, so no Customer Personal Data needs to reach Apple. If the name of an instrument includes a person's name, that name reaches Apple with an alert about it. Your users can stop alerts reaching Apple by switching off Push notifications in the app's Notification settings.

Dictation in the mobile apps uses the speech recognition service of the user's own phone. That service is not Our subprocessor, and We receive only the text it returns.

7. Help with requests and assessments

Requests from data subjects. The Service lets You read, correct, export and delete records yourself. Where it cannot, We do it by hand on Your written request. If a data subject writes to Us about Customer Personal Data, We pass the request to You without undue delay and tell the person We have done so. We do not answer it ourselves.

Assessments. We give reasonable help with data protection impact assessments and prior consultations under Articles 35 and 36 of the GDPR, based on the information We have.

8. Personal data breaches

We notify You without undue delay after We become aware of a personal data breach affecting Customer Personal Data. We give You the information in Article 33(3) of the GDPR as it becomes available, and We may give it in stages. We follow Our written breach notification procedure.

9. Deletion and return

When the Service ends, You choose whether We delete Customer Personal Data or return it to You, and We then delete the remaining copies, unless the law requires Us to keep them. The exports on Our Data Export Formats page are how We return data.

When an account deletion is requested, sign-in stops and billing is cancelled at once. The data is then kept for 730 days so You can export it or change Your mind, and then it is purged, including stored files. You may ask in writing for an immediate purge instead, and We carry it out by hand. If You switch providers under the section of the Terms and Conditions on switching and exporting data, the timing in that section applies instead of the 730 days.

Names in completed calibration records. A completed calibration record carries the names of the person who performed it and of anyone who reviewed it. Those names are part of a SHA-256 hash chain that makes the record tamper-evident. Removing a name breaks the chain for every later record and destroys the evidential value of Your own records. So We cannot remove such a name while the workspace exists. The names are deleted with the workspace when it is purged.

Copies in database backups are kept for 14 days and are removed within two days after that. They are not restored except for disaster recovery or where the law requires it.

10. International transfers

We process Customer Personal Data in the United States, in the AWS us-east-1 region. Subprocessors process it in the places Annex C gives. We are not certified under the EU-US Data Privacy Framework.

European Economic Area. Where Data Protection Law requires appropriate safeguards for Customer Personal Data that reaches Us, Module Two (controller to processor) of the Standard Contractual Clauses applies between You as data exporter and Us as data importer. Where You are a processor for another controller, Module Three (processor to processor) applies instead. The Clauses are incorporated into this DPA by reference, with the choices in Annex D. For Customer Personal Data We act only on Your instructions, and Data Protection Law applies to You as the party that sends it to Us. That is the case these clauses were written for. We are directly subject to the GDPR for the account data We control under Our Privacy Policy, and these clauses are not used for that data.

United Kingdom. Where UK data protection law applies, the UK Addendum applies with the choices in Annex D, and it is incorporated into this DPA by reference.

Switzerland. Where the FADP applies, the Standard Contractual Clauses apply with the Swiss changes in Annex D.

Requests from public authorities. If a public authority asks Us for Customer Personal Data, We follow the approach on Our Subprocessors page and Clause 15 of the Standard Contractual Clauses where they apply.

11. Audits

We make available the information You need to show that this DPA and Article 28 of the GDPR are met, and We allow for and contribute to audits.

CaliTech LLC is a one-person company, so audits work like this. We give You Our security and data handling document and Our subprocessors list. We answer Your security questionnaire in writing. We answer follow-up questions in writing. You may also audit on site once a year, on 30 days' notice, at Your own cost, under reasonable confidentiality terms. Where the Standard Contractual Clauses apply, nothing in this section limits the audit rights they give You.

We hold no SOC 2 report and no ISO/IEC 27001 certification, and no outside firm has tested the Service for security weaknesses.

12. Term and liability

This DPA applies for as long as We process Customer Personal Data for You.

Each party's liability under this DPA is subject to the limits in the Terms and Conditions, except where the law does not allow liability to be limited. Nothing in this DPA limits a party's liability under the Standard Contractual Clauses, or the rights they give data subjects.

13. Changes to this DPA

We may update this DPA. We give at least 30 days' notice of a material change, by email or by a notice in the Service. We do not change it to lower the protection of Customer Personal Data, unless the law requires it. Each version carries a version number and a date.

Annex A. Description of the processing

Item	Description
Subject matter	Running a hosted register of measuring and test equipment and of the calibrations performed on it
Duration	The term of the Terms and Conditions, plus the deletion periods in section 9
Nature and purpose	Storing, organising, retrieving, displaying, exporting and sending records of instruments and calibrations on Your instructions
Data subjects	Your employees and contractors who use the Service; people named on Your records who have no account, such as contacts at outside calibration laboratories; people You add as reminder recipients; people who appear in uploaded photographs
Personal data	Names, business email addresses, business phone numbers, roles and site access; sign-in records; site addresses, which for a home workshop are a home address; names and free text on instruments, custody entries, calibration records, gage studies and uploaded files; names printed on certificates; operator readings in gage studies, which can show how an employee performs
Special categories	None should be present. You agree not to enter any.
Frequency	Continuous for the term

Annex B. Technical and organisational measures

What is in place

Encryption in transit. HTTPS only, with TLS 1.2 or later. Plain HTTP is redirected. The database accepts only encrypted connections.
Encryption at rest. The database, file storage, queues and stored secrets are encrypted at rest with keys managed by AWS.
Network isolation. The database is not reachable from the internet and accepts connections only from the application. The application runs in private subnets with no public address. Every storage bucket blocks public access. A web application firewall with AWS managed rules and rate limits sits in front of the site.
Access control. Passwords are stored only as salted PBKDF2-SHA256 hashes and checked in constant time. Two-factor authentication is available, with hashed recovery codes and trusted devices You can revoke. Repeated failed sign-ins slow down. Roles are checked on the server on every request. Workspaces can use their own single sign-on over OIDC or SAML 2.0.
Separation of workspaces. Every record carries its workspace. The server reads the workspace from a signed token and applies it to the queries that read workspace records. Files are stored under each workspace's own prefix.
Integrity. Completed calibration records cannot be edited or deleted. A database trigger refuses edits and deletes, also for direct database commands. Only the workspace purge turns it off, inside its own transaction. Corrections are added as new records with a written reason. An optional review step stops the person who recorded a calibration from approving it.
Logging. Activity in Our AWS account is logged in all regions, with integrity checks, and kept for 365 days. Each workspace has an activity log with the person, the time, the fields changed and the IP address. The calibration ledger is chained with SHA-256, and You can verify the chain without Us.
Backups. The database is backed up every day. Backups are kept for 14 days and are removed within two days after that. The database can be restored to any point inside the 14 days.
Monitoring. Alarms for database load, application errors, slow responses, failed background jobs and errors at the content delivery network are sent to an on-call address.

What is not in place

No SOC 2 report, no ISO/IEC 27001 certification and no outside penetration test.
No encryption keys managed by customers.
The database runs in one availability zone. A failure of that zone needs a restore, not an automatic failover.
No uptime commitment, no recovery point or recovery time objective, and no documented restore drill.
No object versioning on the bucket that holds uploaded files. A file that is overwritten or deleted cannot be recovered from storage.
No storage-level log of who downloaded which file.
Application logs are kept for 30 days. For a request that reaches Our servers from India, a copy of its log lines is kept for 180 days, as India's CERT-In Directions ask. Log lines now name a person by a pseudonymous code, the first 10 characters of an unsalted SHA-256 hash of the email address, and not by the address. Anyone who already knows an address can work out its code. Lines written before that change can hold email addresses, mostly from the sign-up, invitation and account deletion paths, and any address that an error message repeated, which can be an address in Customer Personal Data such as a reminder recipient. The last of them is deleted in early November 2026, when its 30 days run out. A single log line cannot be picked out and deleted.
No least-privilege access inside Our AWS account. The role that deploys the Service holds full administrator rights.
No separation of duties, no formal access review and no security training programme. CaliTech LLC is one person.
No full incident response plan. A written breach notification procedure exists and has not yet been tested in a drill.

Annex C. Subprocessors

The subprocessors We use, what each one receives and where it processes data are listed on Our Subprocessors page. That page, as it stands at any time, is Annex C of this DPA and Annex III of the Standard Contractual Clauses. Of the parties in its table, these process Customer Personal Data: Amazon Web Services, Sentry, Google for Firebase Cloud Messaging, and Google for Google Workspace when You send Us files or support email. The others receive only data We control Ourselves, under Our Privacy Policy. The services that page describes as belonging to the phone are not subprocessors.

Annex D. Transfer terms

Standard Contractual Clauses, Modules Two and Three

The same choices apply to Module Two and to Module Three.

Clause 7 (docking clause) does not apply.
Clause 9(a): Option 2, general written authorisation, with at least 30 days' written notice as section 6 says.
Clause 11(a): the optional wording on an independent dispute resolution body does not apply.
Clause 13: the competent supervisory authority is the one that Clause 13(a) designates for You as data exporter.
Clause 17: Option 1. The Clauses are governed by the law of Ireland.
Clause 18(b): disputes go to the courts of Ireland.
Annex I.A: the data exporter is You, with the name, address and contact details in Your account, acting as controller for the use of the Service, or under Module Three as processor for Your own controller. The data importer is CaliTech LLC d/b/a Axiospec, at the address in section 1, contact support@axiospec.com, acting as processor, or under Module Three as Your subprocessor. Accepting the Terms and Conditions counts as signing, on the date You accept them.
Annex I.B: Annex A of this DPA.
Annex I.C: the authority named under Clause 13 above.
Annex II: Annex B of this DPA.
Annex III: Annex C of this DPA.
Clause 8.3: on request, We send You or a data subject a copy of the Clauses, with the choices above and the annexes filled in, free of charge. If Your account has no postal address, We ask You for one.

UK Addendum

Table 1: the parties and their details are those in Annex I.A above.
Table 2: the Approved EU SCCs are the Standard Contractual Clauses incorporated by this DPA, Modules Two and Three, with the choices above.
Table 3: the Appendix Information is in Annexes A, B and C of this DPA.
Table 4: neither party may end the UK Addendum under its Section 19.
Mandatory Clauses: "Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses."

Switzerland

Where a transfer is subject to the FADP, the Federal Data Protection and Information Commissioner is the competent supervisory authority under Clause 13. Where the GDPR also applies, it acts alongside the EU authority.
Where the FADP applies, references to the GDPR are read as references to the FADP.
The term "Member State" does not stop data subjects in Switzerland from bringing a claim where they usually live, as Clause 18(c) allows.

Annex E. Quebec

This annex applies to Customer Personal Data when You are subject to Quebec's Act respecting the protection of personal information in the private sector (chapter P-39.1, the "Quebec Act"). It adds to the rest of this DPA. If the two conflict for that data, this annex governs. For customers in Quebec, the Canadian French version governs.

The written mandate and agreement. This DPA, with this annex, is the written mandate under section 18.3 of the Quebec Act. It is also the written agreement under section 17 for communicating Customer Personal Data outside Quebec, to Us in the United States and through Us to the subprocessors in Annex C.
Protection measures. We protect the confidentiality of Customer Personal Data with the measures in section 4 and Annex B.
Use only for the mandate. We use Customer Personal Data only to carry out this mandate, which is to provide the Service on Your instructions under section 3.
Nothing kept after the mandate. We do not keep Customer Personal Data after the mandate ends, unless the law requires it. Section 9 sets out how it ends. After a deletion request the data stays for 730 days, so You can export it or change Your mind, and is then purged. You can ask in writing for an immediate purge instead. Either way, copies in database backups are kept for 14 days after the purge and are removed within two more days, under section 9. You agree that the mandate runs until the purge and until those backup copies are removed.
Notice of a violation or an attempt. We notify Your person in charge of the protection of personal information without delay of any violation or attempted violation, by any person, of an obligation concerning the confidentiality of Customer Personal Data. This is wider than section 8, which covers personal data breaches only. Some subprocessors do not tell Us about attempts that fail, so for them this covers the attempts We can detect. We send the notice to the person You name to Us for this. If You name nobody, We send it to the administrators of Your workspace.
Verification. Your person in charge of the protection of personal information may conduct any verification relating to that confidentiality, on the terms of section 11.
The assessment. We assessed the privacy factors of these communications, as section 17 asks (Quebec transfer assessment, version 1.1 of 7 October 2026). It concluded that they may continue on the conditions it sets. This annex takes its results into account: the measures in Annex B, the subprocessors in Annex C and the risks it accepts. We send You a copy on request, for Your own assessment.

Translation Interpretation

This Data Processing Agreement may have been translated if We have made it available to You on our Service. You agree that the original English text shall prevail in the case of a dispute.

There is one exception. For customers in Quebec, the French version governs. It is published in Canadian French at axiospec.com/fr-CA/dpa and is available to You before You accept it.

Contact Us

Questions about this DPA go to support@axiospec.com.