Legal

Data processing terms

Last updated 19 October 2026 · Terms · Privacy notice

This page summarises the Data Processing Agreement (DPA) that forms part of every Olodu customer agreement. The DPA signed with your Order Form governs; ask for it before you sign and we will send the full text.

Roles

You, the customer, are the controller of personal data in your systems. Abraxas Group Limited is your processor when Olodu works on those systems, and acts only on your documented instructions: the agreement, the Order Form and the requests you approve in the portal.

What we process

Personal data that happens to be in the systems in scope (for example user accounts, email settings, logs and application data), processed to operate, maintain, secure and change those systems: DevOps, reliability, patching, engineering work, access management, activity records, and AI inference through approved subprocessors.

Our commitments

  • Confidentiality. Everyone working on your account is bound to confidentiality.
  • Security measures. Scoped, short-lived, least-privilege access; read-only by default; approval before risky changes; saved state and rollback; an append-only, hash-chained activity record; removal of secrets before any text reaches an AI model; and withdrawal of our access by you at any time.
  • No training. We do not use your data to train AI models, and we require the same of the model providers we use, with the shortest data retention they offer.
  • Breach notice. We tell you without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting your data, with what we know and what we are doing about it.
  • Help with your obligations. We help you answer data subject requests, carry out impact assessments and work with regulators, as far as the processing allows.
  • Audits. We make available the information needed to show we comply, including the activity record.
  • Deletion. When the service ends we delete or return the personal data we hold for you, except where the law requires us to keep it, or where it forms part of the activity record, which we keep for at least one year.

Subprocessors

We use a small number of subprocessors: our hosting provider, and AI model providers for inference. Each is bound by terms at least as protective as the DPA. The current list is attached to your DPA. We give you at least 30 days' notice before adding or replacing a subprocessor, and you may object on reasonable data protection grounds.

International transfers

Where personal data leaves the European Economic Area or the United Kingdom, we use an approved transfer mechanism such as the European Commission's standard contractual clauses, and record the arrangements in your DPA.

Questions

Your security or legal team can write to us for the full DPA, the subprocessor list, or answers to a security questionnaire.