--- title: Data Processing Addendum (DPA) description: "Effective date: January 1, 2026 This Data Processing Addendum (“DPA”) forms part of the agreement between [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) B.V. (“[Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/)”, “Processor”) and the customer entity that subscribes to the [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) service (“Customer”, “Controller”). This DPA applies to the…" url: "https://www.acceptmission.com/nl/knowledge/data-processing-addendum-dpa/" updated: "2026-04-15" category: "Privacy & Data Protection" --- # Data Processing Addendum (DPA) Effective date: January 1, 2026 This Data Processing Addendum (“DPA”) forms part of the agreement between [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) B.V. (“[Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/)”, “Processor”) and the customer entity that subscribes to the [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) service (“Customer”, “Controller”). This DPA applies to the extent [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) processes Personal Data on behalf of Customer in connection with the [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) software platform and related services (the “Service”). If you are accepting this DPA on behalf of an organization, you confirm you have authority to bind that organization. ## 1) Definitions For purposes of this DPA: - Applicable Data Protection Law means the GDPR and any applicable EU Member State laws, and where applicable the UK GDPR and UK Data Protection Act 2018, and Swiss data protection law. - Customer Personal Data means Personal Data contained in Customer Data that [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) processes on behalf of Customer as part of providing the Service. - Customer Data means data, content, files, and materials submitted to the Service by Customer or Authorized Users. - Authorized Users means individuals Customer permits to use the Service under Customer’s account. - Subprocessor means a third party engaged by [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) to process Customer Personal Data to support service delivery. - Security Incident means a confirmed accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. - Standard Contractual Clauses or SCCs means the European Commission approved standard contractual clauses for international transfers. ## 2) Scope, roles, and responsibilities ### 2.1 Customer as Controller Customer is the Controller of Customer Personal Data. Customer determines the purposes and means of processing, including what Customer Data is submitted, who has access, and how Customer Data is used within Customer’s organization. ### 2.2 [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) as Processor [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) processes Customer Personal Data only as a Processor and only to provide and secure the Service, in accordance with Customer’s documented instructions and this DPA. ## 3) Order of precedence If there is a conflict between documents, the following order applies unless explicitly stated otherwise in an Order Form: 1. Order Form or signed commercial agreement 2. This DPA (for processing of Customer Personal Data) 3. SaaS Terms or Customer Agreement 4. Applicable program terms (API, beta, pilots) if explicitly agreed for that program ## 4) Processing instructions ### 4.1 Documented instructions [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will process Customer Personal Data only on Customer’s documented instructions, including as needed to provide the Service and related support requested by Customer, unless processing is required by applicable law. Where legally permitted, [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will inform Customer of such legal requirement before processing. ### 4.2 Nature and purpose of processing Processing is performed to provide the Service, including hosting, storing, transmitting, securing, and making available Customer Data for collaboration and workflow features. ## 5) Confidentiality [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) ensures that persons authorized to process Customer Personal Data are subject to confidentiality obligations and receive instructions appropriate to their role. Access is limited to those who need it to provide the Service, following least privilege and need-to-know principles. ## 6) Security of processing [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) implements appropriate technical and organizational measures designed to protect Customer Personal Data in line with Article 32 GDPR. These measures are described at a high level in Appendix C. ## 7) Subprocessors ### 7.1 Authorization to use Subprocessors Customer provides general authorization for [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) to engage Subprocessors to support service delivery. [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) ensures Subprocessors are bound by obligations no less protective than those in this DPA. ### 7.2 Subprocessor list and updates The categories of Subprocessors and the current list used for service delivery are described in Appendix B. [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) may update Subprocessors. If a new Subprocessor is added or a Subprocessor is replaced, [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will provide advance notice to Customer where required by law. ### 7.3 Objections If Customer reasonably objects to a new Subprocessor on data protection grounds, Customer may notify [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) within the notice period. The parties will work in good faith to address the objection. If no reasonable [Solution](https://www.acceptmission.com/nl/encyclopedia/solution/) is available and the change is materially required to provide the Service, either party may terminate the affected subscription without penalty for the unused prepaid period. ## 8) Assistance to Customer Taking into account the nature of processing, [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will provide reasonable assistance to Customer with: - Responding to data subject requests relating to Customer Personal Data, where Customer cannot respond using the Service controls. - Security, breach notifications, and [Risk](https://www.acceptmission.com/nl/encyclopedia/risk/) assessments relevant to Customer’s use of the Service. - DPIAs and consultations with supervisory authorities, to the extent relevant to the Service and the information available to [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/). Customer remains responsible for responding to data subjects and supervisory authorities as Controller. ## 9) Security incident notification [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will notify Customer without undue delay after confirming a Security Incident involving Customer Personal Data. Where feasible, notification will occur within 48 hours of confirmation. The notification will include available information that supports Customer’s obligations, such as: - A description of the incident and likely impact - Categories of data involved (if known) - Measures taken or planned to address the incident - Recommended customer actions (if applicable) ## 10) Deletion or return of Customer Personal Data Upon termination or expiration of the Service, and on Customer request where available: - Customer may export Customer Data using available export tools. - [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will delete or return Customer Personal Data in accordance with Customer’s instructions, subject to applicable law and reasonable backup retention cycles. ## 11) Audits and compliance information [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may request a security or compliance review once per year, unless a Security Incident occurs, in which case Customer may request additional information relevant to the incident. On-site audits are subject to reasonable scope, timing, confidentiality safeguards, and cost allocation, and must not unreasonably disrupt [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) operations. ## 12) International transfers ### 12.1 Primary processing location Customer Personal Data is hosted and processed primarily in the European Economic Area, with standard hosting in West Europe, unless Customer selects an alternative region where available under an enterprise agreement. ### 12.2 Transfers outside the EU or EEA If Customer Personal Data is transferred outside the EU or EEA, [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) will ensure an appropriate transfer mechanism under Applicable Data Protection Law, such as: - SCCs, plus supplementary measures where required - For UK transfers, the UK International Data Transfer Addendum or other valid UK mechanism - For Swiss transfers, applicable Swiss recognized mechanisms ## 13) Liability Each party remains responsible for its own compliance with Applicable Data Protection Law. Liability relating to this DPA follows the limitation of liability provisions in the governing commercial agreement, unless mandatory law requires otherwise. ## 14) Term This DPA remains in effect for the duration [Accept Mission](https://www.acceptmission.com/nl/encyclopedia/accept-mission/) processes Customer Personal Data on behalf of Customer.