Data processing agreement

1. The parties and their roles

This document is published by AVE17 LTD and governs an order placed on ave17.com, ave17.de, ave17.fr, ave17.es, ave17.it, ave17.uk, ave17.us, ave17.ca or ave17.eu. ave17.ge is a different seller under a different law. It is not operated by AVE17 LTD. Nothing is sold through it yet. Its own details will be published there.

Controller

You, the customer. You decide why and how the personal data in your deployment is processed.

Processor

AVE17 LTD, registered in England and Wales, number 17254143, 128 City Road, London, EC1V 2NX. ICO registration ZC225076.

This agreement is made under Article 28 of the UK GDPR and the Data Protection Act 2018, and the words controller, processor, personal data, processing and data subject carry the meanings Article 4 gives them. It is in writing in electronic form, which Article 28(9) allows. It forms part of our terms of service and takes effect when the service starts. Where they conflict on data protection, this agreement wins.

2. What is processed, and why

Subject matter

Operating the infrastructure you have asked us to run.

Duration

For as long as the service runs, plus the deletion period in section 9.

Nature and purpose

Installation, configuration, maintenance, monitoring, backup, restoration and fault diagnosis. Nothing else.

Data subjects

Your users, and anyone they communicate with through the deployment.

Categories of data

Account identifiers and profile data; message content, files and media held by the deployment; connection metadata, including addresses and timestamps; logs generated by the software.

Special category data

We do not knowingly process it. If your use involves it, tell us before the service starts so the arrangement can be assessed.

Where a deployment uses end-to-end encryption, the content of encrypted conversations is not accessible to us at all. Everything else in the list above is technically accessible to whoever administers the server, and while we maintain it, that includes us.

3. Our obligations

• We process personal data only on your documented instructions, including this agreement, your support requests, and any instruction of yours about transfers outside the United Kingdom
• If we believe an instruction breaks data protection law, we tell you and do not carry it out
• Everyone with access is bound by confidentiality that survives the end of their engagement
• We keep the security measures in section 6, and review them
• We help you answer requests from data subjects, and we help with impact assessments and consultations with the regulator, so far as is reasonable
• We tell you about a personal data breach without undue delay, as set out in section 8
• We delete or return the data at the end, as set out in section 9
• We give you what you need to demonstrate compliance, and we submit to audits under section 10

Where the law of the United Kingdom requires us to process your data for something you have not asked for, we tell you what the law requires before we do it, unless that same law forbids us to tell you on important grounds of public interest.

4. Sub-processors

You give general authorisation for the sub-processors listed below. We remain fully responsible for their acts and omissions.

OVH

OVH SAS, France. Provides the physical infrastructure and data-centre operations. Data stays within the EEA.

Every sub-processor is engaged under a written contract that puts it under the same data protection obligations this agreement puts on us, and no lesser ones. Where a sub-processor fails to meet them, that failure is ours to answer for and not yours to chase. Where a deployment runs on infrastructure you hold, there is no sub-processor at all: the machine is yours and we act on it. Before adding or replacing a sub-processor we give you 30 days notice, in writing, to the address your contract names for notices. There is no list to subscribe to and no feed: the notice is sent to you rather than published for you to find. If you object on reasonable data-protection grounds within that period, you may end the affected service without penalty.

5. International transfers

Our infrastructure is in France (EEA), at OVH SAS. The systems are administered remotely by the director; access stays within AVE17 LTD.

6. Security measures

These are the measures we actually apply, described plainly enough to be checked:

• Only the ports a deployment needs are open; everything else is closed at the firewall
• Automatic blocking of repeated failed logins and known bad actors
• Administrative access over SSH with keys only, no passwords, and hardening well past the defaults
• Components isolated from one another at the operating-system level, and containers run without unnecessary privilege
• Encryption in transit throughout, with certificates renewed on a schedule and monitored
• Backups taken on a defined schedule, encrypted, with restoration tested rather than assumed
• Every administrative login and command recorded in logs on your own server, where you can read them
• Maintenance restores a known-good configuration, so undocumented changes do not persist
• Access withdrawn on request between pieces of work

The automation is open source and its actions appear in your own audit trail.

7. Your obligations

• You confirm you have a lawful basis for the processing you ask us to perform
• You provide the privacy information your own users are entitled to
• You do not send us personal data through channels that are not part of the service
• You tell us before introducing special category data or data about children

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we notify you without undue delay and in any case within 24 hours of becoming aware. The notification describes what happened, which data and roughly how many people are affected, the likely consequences, and what we are doing about it.

Reporting to the regulator and to affected people is your decision as controller. We give you what you need to make it and to meet your own 72-hour deadline.

9. Deletion and return

On termination we hand over the deployment as it stands: database, file store and configuration, in their working formats, not converted into a farewell archive.

Personal data we hold as processor is deleted within 30 days of termination, including from backups as they rotate out. If you want it deleted sooner, say so and we will do it. We keep data beyond that only where the law requires, and we tell you if that happens.

Backups, after deletion

35 days

Deployment data, after termination

30 days

Records the law makes us keep

seven years

10. Audit

You may verify our compliance. In the first instance we answer questions in writing and provide the evidence we have, which for most of section 6 is your own server's logs and the published source of the automation.

Where that is not enough, you may audit us, or appoint an independent auditor, on 30 days notice, no more than once a year unless a breach or a regulator says otherwise. Audits happen during working hours and must not disrupt other customers. You bear the cost unless the audit finds a material failure on our side.

11. Liability and law

Liability under this agreement is subject to the limits in our terms of service, except where data protection law does not allow it to be limited.

Article 82 of the UK GDPR gives a data subject a claim against a processor directly, for damage caused by processing that broke a processor obligation or went against your lawful instructions. Nothing here limits that, and nothing here shifts it onto you.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over it.

In force

This document has been in force since 10 November 2026.

10 November 2026

Updated.

5 September 2026

Updated.

28 August 2026

Updated.

24 August 2026

Updated.