Connect With
Accelera
Want a Quotation or a Demo of our Services?
Don't want to wait?
Data Processing Agreement
Effective date: November 4, 2026. Last updated: November 4, 2026.
- Purpose and scope
This Data Processing Agreement ("DPA") sets the rules for how Accelera, Inc. ("Accelera") processes Personal Data on behalf of its customer ("Customer") when providing the Services.
Parties
Accelera, Inc., 5700 Tennyson Pkwy, Suite 300, Plano, TX 75024, USA, and the Customer that has accepted the Accelera Terms of Service or signed an Order with Accelera.
How this DPA applies
This DPA forms part of the Terms of Service and every Order. It applies automatically when Accelera processes Customer Personal Data, without a separate signature. Customers that need a countersigned copy can request one at privacy@accelera.io.
Scope
This DPA covers Customer Personal Data that Accelera processes as a processor or service provider, including through:
• Business Central Apps (Credit Card and Loan Account App, 3PL and Logistics service, payment processing service)
• Logistics Services (3PL storage and fulfillment, warehouse automation, and transportation arranged through carriers)
• Professional Services (implementation, consulting, and support)
It does not cover data Accelera handles as an independent controller or business, such as website visitors, marketing contacts, Customer account and billing contacts, App telemetry, and licensing data. Those are covered by the Accelera Privacy Policy.
Order of precedence
For Customer Personal Data, this DPA prevails over the Terms of Service, any Order, and the Privacy Policy. Where Standard Contractual Clauses apply, they prevail over this DPA.
- Definitions
Capitalized terms not defined here have the meaning in the Terms of Service.
- Roles and details of processing
Roles
Customer is the controller (or business) of Customer Personal Data, and Accelera is its processor (or service provider). Where Customer is itself a processor for its own clients, Accelera acts as Customer's subprocessor, and Customer confirms that its instructions are authorized by its clients.
Instructions
Accelera processes Customer Personal Data only on Customer's documented instructions. The Terms of Service, Orders, this DPA, and Customer's use and configuration of the Services are Customer's complete instructions. Accelera will tell Customer if it believes an instruction violates Data Protection Laws.
Details of processing
Special categories
The Services are not designed to process special category or sensitive Personal Data beyond financial account data, and Customer will not send other sensitive data unless the parties agree in writing.
Duration
For the term of the Terms of Service and any Order, plus the return and deletion period in Section 7.
- Accelera's obligations
Accelera will:
• Process Customer Personal Data only for the business purposes in Section 3 and on Customer's instructions, unless the law requires otherwise (in which case Accelera will tell Customer first, unless the law forbids it).
• Make sure everyone authorized to process Customer Personal Data is bound by confidentiality.
• Use Customer Personal Data obtained through Plaid only to provide the features Customer requested, and never for advertising, credit, lending, or eligibility decisions.
• Not use Customer Personal Data or Customer's business records to train general-purpose artificial intelligence models.
• Not use telemetry to collect the contents of Customer's business records.
U.S. state law service provider terms
As a service provider or processor under the CCPA, the Texas Data Privacy and Security Act, and similar laws, Accelera will not:
• Sell or share Customer Personal Data (including for cross-context behavioral advertising)
• Retain, use, or disclose it for any purpose other than the business purposes in this DPA, or outside the direct business relationship with Customer
• Combine it with Personal Data from other sources, except as Data Protection Laws allow for service providers
Accelera will comply with Data Protection Laws, give Customer the same level of privacy protection they require, and notify Customer if it can no longer meet its obligations. Customer may take reasonable and appropriate steps to stop and remedy any unauthorized processing.
De-identified data
If Accelera creates de-identified or aggregated data from Customer Personal Data, it will take reasonable measures to keep it de-identified, publicly commit not to re-identify it, and contractually require any recipient to do the same.
- Subprocessors
Authorization
Customer generally authorizes Accelera to use subprocessors, including those listed below. Accelera will have a written contract with each subprocessor that protects Customer Personal Data at least as well as this DPA, and Accelera stays responsible for its subprocessors' performance.
Current subprocessors
The names of the payment processor, SMS provider, and email provider currently in use are available on request at privacy@accelera.io.
Carriers
Independent carriers act under their own tariffs and bills of lading and, for information they collect directly (such as delivery signatures and GPS location), under their own privacy policies. Accelera shares only the shipment details each carrier needs and requires carriers to use them only to move the freight.
Changes
Accelera will notify Customer at least 30 days before adding or replacing a subprocessor, by email to Customer's account contact. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if they cannot resolve it, Customer may end the affected Service and receive a refund of prepaid fees for the unused period. In an emergency, such as a subprocessor's sudden failure, Accelera may make the change first and notify Customer promptly.
- Security and security incidents
Security measures
Accelera will maintain administrative, technical, and physical safeguards appropriate to the risk, including:
Accelera may update these measures as long as the overall level of protection does not decrease.
Security incidents
If Accelera becomes aware of a Security Incident, it will:
• Notify Customer without undue delay and no later than 72 hours after becoming aware of it
• Describe the nature of the incident, the data and Data Subjects affected (as far as known), likely consequences, and steps taken or planned
• Take reasonable steps to contain, investigate, and reduce the harm
• Give Customer reasonable information and help so Customer can meet its own notice obligations to regulators and individuals
Accelera will not notify Customer's Data Subjects or regulators about an incident affecting Customer Personal Data without Customer's approval, unless the law requires it. Notice of an incident is not an admission of fault.
- Assistance, audits, transfers, and deletion
Data Subject requests
If Accelera receives a request from a Data Subject about Customer Personal Data (for example, to access, correct, or delete it), Accelera will refer the person to Customer and will not respond directly except to confirm the referral, unless the law requires otherwise. Taking into account the nature of the processing, Accelera will help Customer respond, including through the features of the Services. Much of the data lives in Customer's own Business Central environment, where Customer can act on requests directly.
Other assistance
Accelera will give reasonable help with Customer's data protection assessments, consultations with regulators, and security obligations, to the extent they relate to Accelera's processing. Accelera may charge reasonable fees for help beyond what the Services already provide.
Audits
Accelera will make available the information reasonably needed to show compliance with this DPA. Customer may audit compliance as follows:
• First, by reviewing Accelera's written answers to a reasonable security questionnaire and any available third-party audit reports or certifications
• If those are not enough, or a regulator requires it, by an on-site or remote audit once per year, on at least 30 days' notice, during business hours, by Customer or an independent auditor bound by confidentiality
• Each party pays its own costs, unless the audit finds a material breach of this DPA by Accelera
International transfers
Accelera processes Customer Personal Data in the United States. If Customer sends Personal Data from the EEA, UK, or Switzerland, the parties agree that the SCCs (Module 2, controller to processor, or Module 3, processor to processor, as applicable), with the UK addendum where needed, apply and are incorporated by reference, with Accelera as data importer. Shipments that cross borders require sharing shipment details with carriers, customs brokers, and customs authorities in the countries involved.
Return and deletion
When the Services end, Customer may ask Accelera within 30 days to return Customer Personal Data that Accelera holds outside Customer's Business Central environment. After that, Accelera will delete or de-identify it, following the retention periods in the Privacy Policy, unless the law requires Accelera to keep it (in which case Accelera will keep protecting it under this DPA). Specifically:
• Plaid access tokens are revoked when the account is disconnected or the Services end
• Financial data held in Accelera's systems is deleted or de-identified within 30 days after disconnection or termination
• Shipment records, bills of lading, and proof of delivery are kept for 3 years, or longer if needed for claims, audits, or law
• Data in Customer's Business Central environment remains under Customer's control
- Customer obligations and general terms
Customer obligations
Customer will:
• Have a lawful basis, and give all notices and get all consents required by Data Protection Laws, for Accelera to process Customer Personal Data, including data about its employees, customers, consignees, and account holders
• Make sure its instructions comply with Data Protection Laws
• Authorize bank and card connections only for accounts it is entitled to connect
• Not send Accelera sensitive Personal Data beyond what the Services require
• Manage its own users, permissions, and Business Central environment securely
Liability
Each party's liability under this DPA is subject to the exclusions and limits in Section 9 of the Terms of Service, to the extent Data Protection Laws allow. This DPA does not limit either party's liability to Data Subjects under the SCCs or Data Protection Laws.
Term
This DPA lasts as long as Accelera processes Customer Personal Data under the Terms of Service.
Changes
Accelera may update this DPA to reflect changes in Data Protection Laws or the Services, with at least 30 days' notice for material changes. Updates will not reduce the overall protection of Customer Personal Data.
Governing law and disputes
This DPA is governed by the governing law and dispute resolution terms of the Terms of Service, except where the SCCs or Data Protection Laws require otherwise.
Contact
Privacy questions and requests: privacy@accelera.io
Security incidents: security@accelera.io
Accelera, Inc.
Attn: Privacy
5700 Tennyson Pkwy, Suite 300
Plano, TX 75024, USA
Signatures (optional)
This DPA applies without signature. Customers that need a signed copy may sign below.
