At akoyaGO, Inc., protecting client information is an important part of how we deliver and support our software solutions. This Data Protection Addendum outlines the responsibilities of akoyaGO and its clients regarding the processing, security, confidentiality, and handling of client information.
The Addendum is made publicly available for transparency and becomes contractually binding only when expressly incorporated into an applicable client agreement or otherwise agreed to in writing by the parties. Simply publishing this Addendum does not modify existing client agreements or independently create new contractual obligations.
Effective 10/15/2026 | Version 1.0
1.1 When incorporated by reference into a written agreement between akoyaGO, Inc. (“akoyaGO”) and a client (“Client”), or otherwise agreed to in writing by the parties, this Addendum governs akoyaGO’s Processing of User Information in connection with the products and services provided under that agreement (the “Agreement”). It supplements, and does not replace, the Agreement, the akoyaGO Terms of Service, or the akoyaGO Service Level Agreement, to the extent applicable.
1.2 Client determines the purposes for which User Information is collected and used. To the extent applicable under Data Protection Law, Client acts as Controller and akoyaGO acts as Processor or service provider for User Information Processed by akoyaGO on Client’s behalf.
1.3 The subject matter, duration, nature, purposes, and general categories of Processing are described in Schedule 1. The parties acknowledge that the actual categories of information depend on Client’s configuration and use of the Services.
“Controller” and “Processor” have the meanings assigned by applicable Data Protection Law, where those terms apply.
“Data Protection Law” means federal, state, and local privacy and data-security laws applicable to a party’s Processing of User Information under the Agreement. Jurisdiction-specific terms or instruments required by applicable law may be addressed separately in writing.
“Personal Information” means information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable natural person or household and that is protected as personal information or personal data under Data Protection Law.
“Process” or “Processing” means any operation performed on User Information, including collection, access, use, disclosure, storage, transmission, return, or deletion.
“Security Incident” means a confirmed unauthorized acquisition of, access to, use of, disclosure of, alteration of, or destruction of User Information in akoyaGO’s possession or control that compromises its security, confidentiality, or integrity. This includes incidents arising from akoyaGO accounts, credentials, or integrations with access to Client’s environment. Security Incident excludes unsuccessful attempts or events that do not compromise User Information, including routine scans, pings, unsuccessful login attempts, and blocked attacks. This definition does not narrow any mandatory notification duty imposed by applicable Data Protection Law.
“Services” means the products and services akoyaGO provides to Client under the Agreement.
“Subprocessor” means a third party engaged by akoyaGO to Process User Information on Client’s behalf in support of the Services.
“User Information” means Personal Information and Client Confidential Information (as defined in the Agreement) that akoyaGO Processes on Client’s behalf in connection with the Services. User Information does not include information independently obtained by akoyaGO outside the Services or information that has been aggregated or de-identified so that it cannot reasonably identify Client or an individual.
3.1 akoyaGO will Process User Information only as reasonably necessary to provide, secure, support, and maintain the Services for Client; to follow Client’s documented instructions consistent with the Agreement; or as required by applicable law. The Agreement and Client’s authorized use of the Services constitute Client’s documented instructions.
3.2 akoyaGO will not sell User Information or use it for unrelated advertising or for akoyaGO’s independent commercial benefit. Nothing in this Addendum prohibits akoyaGO from using aggregated or de-identified information for legitimate business purposes, provided that the information cannot reasonably identify Client or any individual. akoyaGO will not use User Information to train artificial intelligence models.
3.3 Client is responsible for the lawfulness, accuracy, and content of User Information; providing required notices; obtaining required consents or authorizations; configuring access within Client’s environment; and ensuring that its instructions and use of the Services comply with applicable law.
4.1 akoyaGO will limit access to User Information to personnel and Subprocessors who need access to perform the Services and who are subject to confidentiality obligations appropriate to their roles.
4.2 akoyaGO will maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect User Information against unauthorized access, use, disclosure, alteration, and destruction, taking into account the nature and sensitivity of the User Information and the nature of the Services.
4.3 Safeguards will be evaluated in light of the access and systems within akoyaGO’s control. Nothing in this Addendum represents that akoyaGO holds a particular security certification or guarantees that security incidents cannot occur.
4.4 akoyaGO’s current safeguards are summarized in Schedule 3.
5.1 The Services use Microsoft products and infrastructure, and the primary production environment containing User Information is hosted within Client’s Microsoft environment or another Microsoft-hosted environment provisioned for Client. Microsoft provides the underlying platform capabilities pursuant to Microsoft’s applicable terms and service commitments. akoyaGO does not independently operate Microsoft’s underlying infrastructure or make warranties on Microsoft’s behalf.
5.2 akoyaGO is responsible for the portions of the Services and User Information within akoyaGO’s possession or control. Client is responsible for its users, credentials, permissions, endpoint security, Microsoft licensing, configurations under Client’s control, and its compliance with Microsoft’s terms.
5.3 In performing implementation, support, troubleshooting, migration, or other authorized work, akoyaGO may access User Information within Client’s environment or temporarily Process copies within systems controlled by akoyaGO or authorized Subprocessors. The protections in this Addendum apply to User Information so Processed, subject to the respective parties’ control and responsibilities. akoyaGO retains such copies only as long as needed for the work and will not use them in non-production environments without Client’s written approval. akoyaGO personnel access Client’s environment using named accounts with multi-factor authentication, and Client may review and revoke that access.
5.4 The Services utilize Microsoft cloud infrastructure and platform services. Microsoft maintains independent security and compliance certifications and audit reports applicable to its services, which may be available to Client through Microsoft’s established compliance documentation resources. Such certifications and reports relate to Microsoft’s services and controls and do not constitute independent certification or audit of akoyaGO’s own operations or controls.
5.5 Certain components of the Services, including web portals and integration services, are hosted and operated by akoyaGO in Microsoft Azure. These components transmit User Information between Client’s Microsoft environment and end users. The only User Information they store outside Client’s environment is each portal user’s email address, which identifies the user’s portal account. akoyaGO is responsible for the security of those components.
6.1 Client authorizes akoyaGO to use Subprocessors as reasonably necessary to provide and support the Services. akoyaGO will require each Subprocessor that Processes User Information to be bound by written confidentiality and data-protection obligations appropriate to the services it performs.
6.2 akoyaGO will require its Subprocessors to comply with the data-protection obligations applicable to the services they perform. Any responsibility of akoyaGO for a Subprocessor’s acts or omissions remains subject to the limitations and exclusions of liability in the Agreement. akoyaGO is not responsible for products or services selected, contracted for, or controlled directly by Client.
6.3 akoyaGO’s current Subprocessors are listed in Schedule 2. akoyaGO will update Schedule 2 when its Subprocessors change. This provision does not create a right to approve each Subprocessor unless separately agreed in writing or required by applicable law.
7.1 akoyaGO will notify Client without undue delay after confirming a Security Incident affecting User Information within akoyaGO’s possession or control, and within any period expressly required by applicable Data Protection Law. Where applicable law requires notification or action before confirmation, that legal requirement controls.
7.2 To the extent reasonably available and legally permitted, akoyaGO’s notice will describe the nature of the Security Incident, the categories of affected User Information, the measures taken or planned to contain and remediate it, and a point of contact for follow-up. akoyaGO may provide information in phases as its investigation progresses.
7.3 akoyaGO will take commercially reasonable steps to investigate, contain, and remediate a Security Incident and will provide Client with reasonable cooperation and information within akoyaGO’s possession or control. Client is responsible for determining and fulfilling its notification obligations, except to the extent applicable law expressly requires akoyaGO to provide notice. Assistance beyond the foregoing may be separately scoped and treated as billable services.
7.4 Notification or cooperation under this Section is not an admission of fault or liability.
8.1 Taking into account the nature of the Processing and the functionality of the Services, akoyaGO will provide reasonable assistance, at Client’s request, with a valid request by an individual to exercise rights under Data Protection Law. Client is responsible for verifying, evaluating, and responding to the request. Assistance beyond standard product functionality or support may be treated as billable services under the Agreement.
8.2 Upon reasonable written request, akoyaGO will provide information reasonably necessary to demonstrate compliance with this Addendum, subject to confidentiality restrictions and reasonable security safeguards. akoyaGO is not required to permit onsite inspections, disclose information that would compromise its systems or other clients, waive privilege, or disclose third-party confidential information, except to the extent applicable law requires otherwise.
9.1 Client may export User Information using available product functionality during the term. In connection with offboarding, akoyaGO will provide its then-current standard export instructions and reasonable assistance consistent with its established offboarding process. Work beyond standard assistance, including custom exports, transformation, reconciliation, or extended transition services, may require an approved New Work Scope & Estimate and additional fees.
9.2 Client’s licensed access ordinarily ends when the Agreement terminates. Any limited post-termination access will be governed by the Agreement or another writing signed by the parties and will not include continued rights to operate or use akoyaGO’s proprietary solution or functionality except as expressly stated.
9.3 Following termination and completion of offboarding, akoyaGO will remove its user accounts, application registrations, and integration credentials from Client’s Microsoft environment and will delete any copies of User Information made under Section 5.3, and the portal email addresses described in Section 5.5, within 21 days, subject to applicable law. Client remains responsible for User Information retained within its Microsoft environment. Any User Information retained by akoyaGO remains protected under this Addendum and may be used only for the purpose requiring its retention.
10.1 akoyaGO maintains commercially reasonable business-continuity and incident-management procedures appropriate to its operations. Upon reasonable request, akoyaGO may provide a summary of relevant practices, subject to confidentiality and security considerations.
10.2 Availability, support, backup, recovery, maintenance, response times, remedies, and service credits are governed exclusively by the Agreement and the akoyaGO Service Level Agreement. This Addendum does not create any recovery-time objective, recovery-point objective, restoration guarantee, additional service level, or additional remedy.
11.1 The limitations of liability, exclusions of damages, disclaimers, and remedies stated in the Agreement apply fully to this Addendum and to all claims arising from or relating to data protection, confidentiality, security, Security Incidents, Subprocessors, data return, or deletion, to the extent permitted by applicable law.
11.2 Nothing in this Addendum creates or expands any indemnification obligation, creates an uncapped category of liability, or increases either party’s liability beyond the limitations expressly stated in the Agreement, except to the extent such limitation is prohibited by applicable law.
12.1 If this Addendum conflicts with the Agreement, this Addendum controls only to the limited extent necessary to address the Processing and protection of User Information. The Agreement controls with respect to fees, payment, intellectual property, warranties, indemnification, limitations and exclusions of liability, termination, service levels, remedies, and all other matters unless this Addendum expressly identifies a specific provision of the Agreement that it modifies.
12.2 If mandatory Data Protection Law requires a different result, that mandatory requirement applies only to the extent necessary.
13.1 This Addendum remains in effect while akoyaGO Processes User Information on Client’s behalf under the Agreement. Sections that by their nature should survive—including confidentiality, retained-data protections, liability, and order of precedence—survive termination for as long as applicable.
14.1 akoyaGO may update this Data Protection Addendum from time to time to reflect changes in its services, data protection practices, or applicable legal and regulatory requirements. When updates are made, akoyaGO will revise the “Effective Date” at the top of the published Addendum.
14.2 Publication of a revised Addendum does not, by itself, amend an existing Agreement or replace a version previously incorporated into an Agreement. A revised version applies to Client only when incorporated into its Agreement or otherwise agreed to in writing by the parties, except where mandatory law requires otherwise.
Subject matter: User Information Processed in connection with akoyaGO’s provision and support of the Services.
Duration: The term of the Agreement and any limited period of authorized post-termination Processing or legally required retention.
Nature and purposes: Transmission of User Information between Client’s Microsoft environment and end users through akoyaGO-operated portals and services; and authorized access, viewing, configuration, implementation, support, maintenance, troubleshooting, migration, return, and deletion, as applicable to the Services and Client’s instructions.
Categories of individuals: Client personnel, contacts, applicants, donors, grantees, portal users, reviewers and committee members, references, event attendees, payees, and other individuals whose information Client elects to maintain or Process through the Services. These may include minors.
Categories of User Information: Contact, account, application, grant-related, donation-related, and other information Client submits or makes available in connection with the Services. The specific categories and sensitivity depend on Client’s use and configuration. Client determines what information it collects through the Services, which may include sensitive information.
Processing locations and transfers: akoyaGO-operated services and akoyaGO personnel Process User Information in the United States. User Information stored in Client’s Microsoft environment resides in the geographic region selected for that environment. Any mandatory jurisdiction-specific transfer mechanism must be addressed separately where required.
akoyaGO uses the following Subprocessors:
Client-enabled integrations (not akoyaGO Subprocessors):
These integrations run under accounts Client holds directly and are governed by Client’s own agreements with those providers. Client’s Dynamics 365 and Power Platform environment is likewise provided under Client’s agreement with Microsoft.
akoyaGO maintains the following safeguards for the systems and access within its control:
The following Microsoft resources are provided for informational purposes only and are not incorporated into this Addendum. They offer additional information regarding Microsoft’s data protection practices, security controls, certifications, and service commitments.
Microsoft’s certifications, audit reports, and contractual commitments apply to Microsoft’s products and services and do not constitute independent certification or audit of akoyaGO’s operations or controls.
If you have questions about this Data Protection Addendum or akoyaGO’s data protection practices, please contact us:
Email: privacy@akoyago.com
Website: www.akoyago.com
To report a suspected security issue, email security@akoyago.com.
Please do not include sensitive information (such as passwords or full payment details) in your initial email to us.