Version V005 · 10 November 2026. Download this document

A.C.E Complete Data Processing Addendum

Version V005 — 10 November 2026

This addendum applies only where A.C.E Tailored processes personal data on a client’s behalf in providing the agreed website, permitted content/social-account processing, AI Receptionist website/phone processing or explicitly authorised booking connection. It sits with the accepted Service Terms and completed customer schedules. A.C.E’s own sales, account administration, billing, contractual records, support, fraud prevention, security and business records are separate controller activities outside this processor addendum.

1 Parties and roles

The client named in Schedule 1 is the controller for the client personal data described there. Nicholas Barnes trading as A.C.E Tailored is the processor for that data. Each party remains responsible for its own duties under applicable UK data protection law. The client decides the purposes and lawful basis, supplies privacy information and gives lawful documented instructions. A.C.E processes the data only to provide the specified services under those instructions, except where applicable UK law requires otherwise. Client personal data means personal data A.C.E processes on the client’s behalf under the completed schedules. This does not include information A.C.E holds for its own independent business purposes. A payment-provider record is not automatically client personal data merely because it relates to A.C.E’s billing.

2 Processing instructions

The accepted service scope and Schedule 1 are the initial documented instructions. Further instructions must be in writing and within the agreed services. A.C.E will tell the client before processing required by law unless the law prohibits notice. If A.C.E believes an instruction infringes applicable data protection law, it will promptly inform the client and pause the affected instruction where appropriate while the parties resolve it. A.C.E will not use client personal data for its own marketing, profiling, enrichment, sale or training an AI service without a separate lawful basis and written arrangement. The client must not instruct A.C.E to process health, other special-category, children’s or similarly sensitive booking data unless A.C.E has expressly accepted a separately assessed, documented arrangement.

3 People and security

A.C.E will ensure that anyone it authorises to access client personal data is subject to confidentiality, receives access only as needed and follows documented instructions. A.C.E will implement technical and organisational measures appropriate to the risks, with the measures actually in operation recorded in Schedule 3. The parties will review those measures when the scope or risk changes. A.C.E will notify the client without undue delay after becoming aware of a personal data breach affecting client personal data. It will provide available facts promptly, investigate, contain the incident and supply further information in phases as it becomes available. The client assesses and makes any required notification to the ICO or affected people, with A.C.E’s reasonable assistance.

4 Assistance and requests

Taking account of the processing and information available to it, A.C.E will reasonably assist the client with data subject requests, security, breach assessment, data protection impact assessments and required prior consultation. If A.C.E receives a request relating to client personal data, it will promptly pass it to the client and will not answer substantively without instruction unless law requires it.

5 Subprocessors

A.C.E will use a subprocessor for client personal data only with the client’s prior specific or general written authorisation and a written contract imposing protection equivalent to the relevant duties in this addendum. If general authorisation is used, A.C.E will give advance notice of a proposed change and a meaningful opportunity to object on reasonable data protection grounds. A.C.E remains responsible to the client for the subprocessor’s performance of its data protection obligations. Schedule 2 is the authoritative list for this client. A provider is not authorised merely because its product is mentioned in a sales page, technical stack or old draft. A.C.E will not route client personal data to a provider until its actual role, processing, location, onward transfers and written terms are verified and entered in Schedule 2.

6 International access and transfers

A.C.E will process client personal data outside the UK, or permit access from outside the UK, only on documented client instructions and where applicable transfer requirements and safeguards are established. The country, recipient, transfer mechanism and relevant safeguards must be recorded in Schedule 2 or Schedule 4 before the transfer begins. Remote access can itself be a transfer and must be assessed.

7 End of service and records

At the end of the processing services, A.C.E will, at the client’s choice, return or delete client personal data and delete existing copies unless law requires storage. The client-specific return format, deadline, backup treatment and any legal exception must be completed in Schedule 4 before processing begins. Data awaiting return or deletion will be restricted from ordinary use and protected. A.C.E will provide reasonable completion evidence on request. Separate A.C.E records needed for its own billing, tax, contract, security or legal purposes are handled in its controller capacity under its own retention rules. This clause does not permit retaining client website enquiries, booking data or credentials for those purposes without an independent lawful basis. A payment dispute does not permit A.C.E to withhold client personal data as leverage.

8 Demonstrating compliance

A.C.E will make available information reasonably needed to demonstrate compliance with the processor obligations and will allow and contribute to reasonable audits or inspections by the client or its appointed auditor, subject to proportionate confidentiality, security and scheduling safeguards. These safeguards will not prevent the client’s statutory audit rights. Any audit cost allocation requires a separate written agreement that does not obstruct those rights.

9 Precedence and change

This addendum controls client personal data where it conflicts with the Service Terms. The parties will record a material change in processing, suppliers, locations or security measures before it takes effect. The schedules are part of this addendum and must reflect the actual client service. A blank schedule does not authorise processing.

Schedule 1 Processing details

Client legal name and address: [COMPLETE] Service Order ID and scope version: [COMPLETE] Subject matter and purpose: [WEBSITE FORMS / WEBSITE AND PHONE ENQUIRIES / APPROVED BOOKING CONNECTION / CLIENT-APPROVED CONTENT OPERATIONS / HOSTING / SUPPORT — COMPLETE ACTUAL SCOPE] Duration, start date and end event: [COMPLETE] Nature of operations: [COLLECT / TRANSMIT / STORE / VIEW / SUPPORT / DELETE — SPECIFY] Categories of data subjects: [VISITORS / ENQUIRERS / CLIENT STAFF / OTHER — SPECIFY] Types of personal data: [NAME / CONTACT / ENQUIRY CONTENT / TECHNICAL IDENTIFIERS / OTHER — SPECIFY] Sensitive, special-category or children’s data: [Specify none, or identify the separately assessed and expressly accepted arrangement] Controller instructions and contact for urgent matters: [COMPLETE]

Additional instructions for A.C.E Complete: identify telephone usage metadata separately from call audio/transcripts; do not enable recording, calendar access or special-category processing by implication. Specify each integration’s granted permissions, revocation procedure and responsible human. A permission failure or withdrawal holds the affected function; it does not authorise switching to another Client’s account. No model training on Client Personal Data is permitted by the service package alone.

Schedule 2 Authorised subprocessors

No provider is approved by this uncompleted template. For each provider receiving client personal data, record: legal provider name; specific service and data categories; controller/processor/subprocessor role; UK and overseas processing/access locations; onward providers; international transfer mechanism and safeguards if required; written contract reference; authorisation date; notice and objection record. An unverified entry means the affected processing must not begin.

Schedule 3 Technical and organisational measures

Record only measures actually implemented and verified for this service: named account owners; multi-factor authentication; least-privilege access; credential storage and revocation; transport protection; hosting and form configuration; software updates; logging; backup and restoration; supplier controls; incident response; secure deletion; periodic check dates. Measure owner, evidence and last verification date: [COMPLETE PER MEASURE]. Unverified controls must not be represented as active.

Schedule 4 Client-specific instructions and exit

Form, booking or account data flows and approved destinations: [COMPLETE] Retention in active systems and backup cycle: [State the agreed retention instructions and verified backup cycle] Return format, recipient and method: [COMPLETE] Deletion deadline and evidence method: [COMPLETE] Law-required retention exception, if any: [IDENTIFY BASIS OR NONE] Data subject request and incident contacts: [COMPLETE] Client approval of schedules and changes: [NAME / DATE / ACCEPTANCE RECORD]

Version and completed schedules

A.C.E Complete Data Processing Addendum V005, dated 10 November 2026. The schedules are completed and approved by the authorised Client controller and A.C.E before the specified processing begins. They identify the actual service, providers, permissions, security measures and exit instructions for that Client. Amendments are versioned and recorded without overwriting earlier accepted instructions. A blank schedule does not authorise processing.