Akoya CRM · Customer agreements

Data Processing Addendum

Effective November 8, 2026 · Version 2026-11-08.1

4.1 Scope and instructions

This Addendum applies when Akoya processes personal information in Customer Data on behalf of the Customer. It forms part of the accepted service agreement when incorporated into the accepted Terms or separately executed. The Customer is the controller or business, or acts on behalf of one; Akoya is the processor or service provider to the extent those roles apply. Akoya’s independent account, billing, and security activities remain subject to applicable law and the Privacy Notice.

The Customer instructs Akoya to host, organize, retrieve, analyze, research, prepare drafts, and process the data as needed for the features the Customer enables. The accepted service description, feature settings, and support instructions document that scope. Akoya will not use processor data for an unrelated purpose, sell or share it for targeted advertising, or combine it across customers except where permitted for the agreed service or by law. Akoya will notify the Customer if an instruction appears unlawful and may suspend the affected processing pending resolution.

4.2 Customer responsibilities

The Customer must have a lawful basis for the information and instructions, give required notices, obtain required consent, and use appropriate settings. This includes contact research, outreach, and uploads. The Customer must not use the Service for prohibited sensitive data or authorize unlawful processing. Each party remains responsible for the legal duties that apply to it; this Addendum does not shift every privacy obligation to the Customer.

4.3 Confidentiality and security

Akoya will restrict access to personnel and providers who need it for authorized purposes and are bound by confidentiality. We maintain measures appropriate to the processing, including authenticated access, workspace membership checks, separation of customer workspaces, protected network connections, and server-side credential handling. We will maintain appropriate procedures for patching, backup and recovery, and incident response. Customers may request information about the measures applicable to their use. No particular certification or service-level guarantee applies unless separately agreed.

4.4 Providers processing on Akoya’s behalf

The Customer authorizes providers listed in the provider list in section 4.9 for the stated activities. Akoya will impose appropriate written privacy, security, and confidentiality duties and remain responsible for their performance of delegated processing obligations. We will provide at least 30 days’ notice of a material new subprocessor where practicable. A Customer may raise a reasonable data-protection objection within that period; we will work toward a practical alternative or termination of the affected service with an appropriate unused-prepayment refund if no alternative is available.

4.5 Incidents and assistance

Akoya will notify the Customer without undue delay after becoming aware of a personal-data breach involving unauthorized access to, loss of, or disclosure of Customer Data. Initial notice may be incomplete and will be supplemented as facts are confirmed. We will provide reasonably available information about the nature, affected data, likely consequences, response measures, and a contact, and cooperate with lawful response duties. This is not a promise to detect every incident immediately.

Taking account of the service and information available, Akoya will reasonably assist with data-subject requests, security inquiries, assessments, and regulator consultations applicable to the processing. We will promptly direct requests received on the Customer’s behalf to the Customer unless law requires a different response. The parties will coordinate to avoid duplicate or inconsistent responses.

4.6 Evidence, audits, and corrective action

Akoya will make reasonably necessary information available to demonstrate its processing obligations and notify the Customer if it can no longer meet them. The Customer may take reasonable steps to verify and remedy unauthorized processing. Reviews should ordinarily begin with current documents and remote evidence. Where law requires further audit, the parties will agree a proportionate process that protects other customers, security, and confidential information without obstructing a mandatory right.

4.7 End of processing and transfers

On termination or a valid deletion instruction, Akoya will return or delete Customer Data under the export and deletion provisions in the Terms and Privacy Notice, except narrowly retained information legally required or necessary for permitted security, billing, dispute, or suppression purposes. Backup copies remain protected and are removed through the applicable backup cycle, subject to legal retention requirements. If a restore occurs, applicable deletion instructions must be reapplied before restored information is used in ordinary operations.

Akoya will not undertake a restricted international transfer without the required contractual and legal safeguards. Any standard contractual clauses, U.K. addendum, or jurisdiction-specific supplement must be separately identified, completed, and incorporated where applicable. This Addendum by itself does not claim global compliance or substitute for those instruments. If it conflicts with the main agreement about processor obligations, this Addendum controls; non-waivable law controls both.

4.8 Processing description

4.9 Providers and processing roles