Data Processing Agreement

Last updated 11 October 2026

1. Parties and status

This Data Processing Agreement (“DPA”) forms part of the agreement (“Main Agreement”) between:

• Accelamos, a trading name of Open Energy Software Ltd, company number 16111131, registered at 128 City Road, London, England, EC1V 2NX (“Accelamos”); and
• the accountancy practice named in the Main Agreement (“Practice”).

If this DPA and the Main Agreement conflict on personal data, this DPA prevails.

2. Definitions

Terms in this DPA have the meaning given in the UK GDPR unless defined here.

• Data Protection Law: the UK GDPR, the Data Protection Act 2018, PECR, and, where the Practice’s processing is subject to it, the EU GDPR, each as amended.
• Practice Personal Data: personal data Accelamos processes on behalf of the Practice, including data of the Clients, their staff, clients and suppliers. Includes Practice’s staff.
• Client: Clients of the Practice.
• Client Systems: systems belonging to or used by the Clients, such as mailboxes, accounting platforms and supplier portals, that the Practice connects to the service.
• Customer: any other Accelamos customer
• Practice Systems: the Practice’s own systems connected to the service.
• Context Layer: the firm-specific model Accelamos builds for the Practice, including codified rules, workflows, procedures, decisions, memory, embeddings and any other structure derived from Practice Personal Data or from the Practice’s staff.
• Derived Data: the Context Layer, and any output, summary, embedding, classification, inference or other data created from Practice Personal Data.
• Sub-processor: a third party engaged by Accelamos that processes Practice Personal Data.

3. Roles

3.1The Practice is the controller. Accelamos is the processor.

3.2The Practice is responsible for having a lawful basis for the processing, for the accuracy and lawfulness of its instructions, and for its own relationship, engagement terms and transparency obligations with its Clients.

3.3Accelamos is an independent controller only for its own account, billing, security and usage-record data about Practice staff (names, work emails, billing details, login and usage logs). That is covered by Accelamos’s privacy notice, not this DPA.

3.4Where the Practice acts as a processor for its own Clients, the Practice confirms that its Client terms authorise the engagement of Accelamos as a sub-processor, and this DPA operates as the processor-to-sub-processor terms.

4. Instructions

4.1Accelamos processes Practice Personal Data only on the Practice’s documented instructions. The Main Agreement, this DPA, the Annexes, and the Practice’s configuration and use of the service are those instructions.

4.2Annex 1 sets out the subject matter, duration, nature, purpose, data types and data subjects.

4.3If Accelamos believes an instruction breaches Data Protection Law, it will tell the Practice promptly and may suspend the affected processing until the instruction is withdrawn, amended or confirmed.

4.4Accelamos will not process Practice Personal Data for its own purposes, except as set out in clause 6.

5. Connecting Client systems

5.1Where the Practice connects a Client System, the Practice confirms that it holds the Client’s valid authority to do so and to have Accelamos access that system, and that the Client has been informed as Data Protection Law requires. The connection is a documented instruction from the Practice.

5.2The Practice will keep a record of that authority and give it to Accelamos on reasonable request.

5.3Accelamos will limit access to what the Practice’s configured task needs. In particular, Accelamos will:

• use the narrowest permission scopes the connected system supports, and where the system supports it, restrict access to designated mailboxes, folders or data sets rather than whole accounts;
• retrieve data per task rather than bulk-copying a mailbox or account;
• not retain content beyond what the task and the Context Layer require, as described in Annex 1;
• not use access to a Client System for any purpose other than the Practice’s instructed tasks; and
• stop accessing a Client System promptly after the Practice withdraws the connection or the Client revokes authority.

5.4The Practice will not instruct Accelamos to process special category data or criminal offence data except as described in Annex 1 or agreed in writing. If such data is unavoidably present in a connected system, Accelamos will not intentionally extract, classify or retain it, and will delete it if it is identified in stored data.

6. Improving the service, the Context Layer and no cross-Customer use

6.1The Context Layer and all Derived Data are Practice Personal Data (to the extent they contain personal data) and are held solely for the Practice. They are not used for any other Customer.

6.2Accelamos will not:

• use Practice Personal Data or Derived Data to train, fine-tune or improve any model or system used for any other Customer, or any general-purpose model;
• make Practice Personal Data or Derived Data, or anything from which the Practice or its Clients could be identified, available to another Customer;
• sell, rent or license Practice Personal Data or Derived Data; or
• use Practice Personal Data to build products or services unrelated to the Main Agreement.

6.3Accelamos may use service telemetry that contains no Practice Personal Data and no Client content (for example error rates, latency, feature usage counts) to operate and improve the service. Accelamos remains controller of that telemetry.

6.4Any cross-Customer learning, benchmarking or pooled improvement requires a separate written agreement with the Practice, specifying what data is used, how it is anonymised and what the Practice may withdraw. Nothing in the Main Agreement or this DPA implies consent to it.

6.5Autonomous updates to the Context Layer’s memory are processing under this DPA. Changes to firm procedures or workflows that alter how work is performed require approval by an authorised Practice user before they take effect, and Accelamos will keep a record of each approval.

6.6Accelamos will not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. The Practice is responsible for configuring the service so that its use does not amount to such processing.

7. Confidentiality and personnel

Accelamos will ensure that people authorised to process Practice Personal Data are bound by confidentiality obligations and have access only where they need it to provide the service.

8. Security

8.1Accelamos implements the technical and organisational measures in Annex 2, and any others appropriate to the risk, considering the state of the art, costs, and the nature, scope and purpose of the processing.

8.2Accelamos will not materially reduce the level of protection in Annex 2 during the term. It will tell the Practice of material changes.

8.3Accelamos will tell the Practice in writing, at the point of contracting, which independent security certifications and assessments it holds.

9. Sub-processors

9.1The Practice gives general authorisation for the Sub-processors on the list referred to in Annex 3.

9.2Accelamos will give at least 30 days’ written notice before adding or replacing a Sub-processor. The Practice may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith, the Practice may terminate the affected services without penalty and receive a pro-rata refund of prepaid fees.

9.3Accelamos will bind each Sub-processor by a written contract giving materially the same protection as this DPA, and remains liable for their performance.

9.4For each Sub-processor that provides AI model services, Accelamos will ensure the contract prohibits use of Practice Personal Data to train or improve the provider’s models, and limits retention to what is needed to provide the service, and not more than 30 days / zero retention where available. The list states the position for each.

10. International transfers

10.1Accelamos will not transfer Practice Personal Data outside the UK (or, where the EU GDPR applies, outside the EEA) except to the recipients and locations on the list referred to in Annex 3, and only under one of the following, as stated on that list for each recipient: an adequacy regulation or decision (including the UK-US data bridge, where the recipient is certified); the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or the EU Standard Contractual Clauses.

10.2Accelamos will not begin a transfer to any recipient for which no safeguard in 10.1 is in place. The list identifies any recipient for which a safeguard is pending, and processing by that recipient will not start until it is confirmed.

10.3Where a transfer relies on a mechanism that is invalidated or withdrawn, Accelamos will tell the Practice promptly and either put a valid mechanism in place or stop the transfer.

10.4Accelamos will carry out and keep a transfer risk assessment where Data Protection Law requires, and give a summary to the Practice on request.

11. Data subject requests

11.1Accelamos will help the Practice respond to requests from individuals exercising their rights, so far as possible given the nature of the processing, including by providing a means to locate, export, correct and delete data within the Context Layer and stored records.

11.2If Accelamos receives a request directly, it will not respond on the Practice’s behalf, will tell the Practice within 5 working days, and will direct the individual to the Practice.

12. Assistance with compliance

Taking into account the nature of the processing and the information available to it, Accelamos will assist the Practice with its obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO, including by providing the information in Annexes 1 to 3 and responding to reasonable DPIA questions within 10 working days.

13. Personal data breaches

13.1Accelamos will notify the Practice without undue delay, and in any case within 24 hours, after becoming aware of a personal data breach affecting Practice Personal Data.

13.2The notice will describe, as far as known: what happened; the categories and approximate number of individuals and records affected; the likely consequences; the measures taken or proposed; and a contact point. Where information is not available at once, it will follow in stages without further undue delay.

13.3Accelamos will take reasonable steps to contain and remediate the breach, preserve relevant logs, and cooperate with the Practice’s investigation and any notification to the ICO or individuals. The Practice decides whether and how to notify regulators and individuals. Accelamos will not notify them or name the Practice publicly without the Practice’s written consent, unless the law requires it.

14. Return and deletion

14.1On termination or expiry, Accelamos will, at the Practice’s choice, return or delete Practice Personal Data, including the Context Layer and other Derived Data, and delete existing copies unless the law requires storage. Without an instruction within 30 days of the end of the agreement, Accelamos will delete it.

14.2Deletion from live systems will be completed within 30 days of the instruction or end date. Backups are overwritten within 35 days, during which the data is not accessed or used other than to restore the service. Accelamos will confirm deletion in writing on request.

14.3During the term, Accelamos will delete or return data on the schedule in Annex 1. Credentials and access tokens for a Client System are deleted immediately if the system rejects them or the Practice or Client revokes the connection.

14.4Anonymised data is outside this DPA only where it has been anonymised to the standard in the ICO’s guidance on anonymisation, such that no individual, and no Practice or Client, is identifiable by anyone, including by Accelamos using reasonable means. The Practice’s Context Layer is not anonymised data.

15. Audit

15.1Accelamos will make available the information reasonably necessary to show compliance with this DPA and Article 28 of the UK GDPR, and will allow and contribute to audits, including inspections, by the Practice or an auditor it appoints.

15.2Audits require 30 days’ written notice, take place in business hours, are subject to reasonable confidentiality terms, and are limited to once in any 12 months unless required by a regulator, or following a personal data breach. Accelamos may first respond with a completed security questionnaire and relevant evidence, and the Practice will take that into account before requiring an on-site audit.

16. Practice obligations

The Practice will: give lawful instructions; ensure it has a lawful basis and has provided any required notices for the processing described in Annex 1; not upload or connect data it has no right to; keep its users’ credentials secure; and tell Accelamos promptly of anything that affects Accelamos’s ability to comply with this DPA.

17. Liability

17.1Each party’s liability under this DPA is subject to the limits and exclusions in the Main Agreement.

17.2Nothing in this DPA limits liability to an individual under Article 82 of the UK GDPR, or any liability that cannot lawfully be limited. Each party’s share of any such liability is determined by its responsibility for the damage, and Article 82(5) applies between them.

18. Changes to this DPA

18.1Accelamos will give the Practice at least 30 days’ written notice of any change to this DPA, with a description of the change. A change that reduces protection for Practice Personal Data, or expands Accelamos’s rights to use it, takes effect only with the Practice’s written agreement.

18.2Changes required by law may take effect on shorter notice, to the extent needed.

19. Term and governing law

This DPA starts on the effective date of the Main Agreement and lasts as long as Accelamos processes Practice Personal Data. Clauses that by nature survive, including 13, 14 and 17, survive. It is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

20. Contact

Data protection contact: alex@accelamos.ai. Practice contact: as stated in the order form.

Annex 1: Details of processing

Subject matter

Provision of the Accelamos service: building and maintaining a firm-specific Context Layer, and executing the Practice’s instructed coordination tasks (for example collecting documents and information from Clients and their systems, chasing outstanding items, and preparing work for staff).

Duration

Term of the Main Agreement, plus the deletion period in clause 14.

Nature

Receipt, retrieval via connected systems, storage, structuring, classification, matching, summarisation, generation of messages, transmission to data subjects on the Practice’s behalf, and deletion.

Purpose

To provide the service to the Practice, as instructed by it.

Data subjects

Practice staff; the Practice’s Clients (sole traders, partners, directors, shareholders); Client employees, clients and suppliers; other individuals appearing in connected systems and documents.

Personal data

Names, contact details, roles; Client and client records and identifiers (e.g. company numbers, UTRs where provided); financial and transactional data; invoices, receipts, bank and payroll-related documents; correspondence and metadata from connected mailboxes within the configured scope; message content exchanged via SMS, WhatsApp or email; the Practice’s internal procedures and staff decisions to the extent they identify individuals.

Special category / criminal offence data

None intentionally processed. May be incidentally present in documents or correspondence; see clause 5.4.

Context Layer storage

The firm-specific Context Layer: rules, workflows, procedures, decisions and memory, plus embeddings derived from Practice Personal Data. Embeddings are treated as personal data. Raw retrieved content is kept for 30 days after task completion; structured outputs for the term of the Main Agreement.

Retention schedule

Raw retrieved Client content: 30 days after task completion. Messages: for the term of the Main Agreement. Audit records: 6 years. Credentials: per clause 14.3.

Annex 2: Security measures

The measures below are those in place today.

• Encryption. In transit (TLS 1.3) and at rest, for all Customer data. Credentials and tokens for connected systems are stored encrypted.
• Access control. Access to Customer content is limited to staff who need it for their role.
• Tenant isolation. Each Practice’s data and Context Layer is logically separated from every other Practice’s, and is never combined or used to inform another Practice’s service.
• Client system access. Minimum permission scopes; per-task retrieval; sessions and tokens stored per Client and not shared between Clients.
• AI controls. No Client data is used for model training by Accelamos or its model providers (clause 9.4). Procedure-level changes require human approval (clause 6.5). Emails and messages are not sent to a Client without approval by a Practice user.
• Audit record. A record is kept of each email approved and sent, including who approved it and when.
• Incident response. Personal data breaches are handled and notified under clause 13.

Annex 3: Sub-processors and transfers

Accelamos keeps a current list of its Sub-processors. For each one, the list states the service it provides, where it processes Practice Personal Data, the transfer safeguard relied on under clause 10, and its model training and data retention position. Accelamos gives the list to the Practice before the Practice first connects any system, and on request at any time. The list forms part of this Annex, and changes to it are made under clause 9.2.

Note on messaging platforms: where a Client interacts with the service via WhatsApp or SMS, the platform provider processes the message under its own terms, as an independent controller or a processor depending on the provider. The Practice should tell its Clients this in its own privacy notice.

Signatures

Customers who want a signed copy can request one at alex@accelamos.ai. Accelamos countersigns on request.