Data Processing Agreement
This agreement describes how Aurex processes personal data on behalf of customers who use the Aurex ERP service.
Last updated: 5 October 2026
This policy is a draft pending legal review. It may change before it is finalised. For questions, please contact us.
Roles
The customer is the controller of the personal data it enters into Aurex, such as employee, customer and supplier records. Aurex acts as processor and handles that data only to provide the service and on the customer's documented instructions.
Purpose and scope
Aurex processes customer data to host, operate, secure, back up and support the ERP service, and to submit e-invoices to tax authorities when the customer enables that feature. Aurex does not sell customer data or use it for advertising.
Categories of data
- Contact details of the customer's users, customers and suppliers
- Employee records entered into HR and payroll modules
- Transaction records such as invoices, orders and payments
- Technical data such as sign-in times and audit logs
Security measures
- Encryption in transit over HTTPS
- Two-factor authentication and role-based permissions
- Separation of each company's records
- Audit logs of important changes
- Automated daily backups
Sub-processors
Aurex uses a small number of sub-processors to provide the service, such as infrastructure hosting and email delivery. The current list is available to customers on request.
Aurex will give customers at least 30 days' notice before adding or replacing a sub-processor. A customer may object on reasonable data-protection grounds, and Aurex will work with the customer to address the objection.
Customer rights and assistance
Aurex will help the customer respond to requests from individuals to access, correct or delete their data, and will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data.
Return and deletion
When the service ends, the customer has 30 days to export its data. After that, Aurex deletes the customer's data from production systems within 90 days. Copies held in backups are removed as those backups expire in their normal rotation, and are not used in the meantime.
Talk to the Aurex team
Tell us how your business runs and we will show you Aurex with your own processes.