Accesstive

GDPR overview

Accesstive is established in Dresden, Germany, so it operates inside the EU and no Article 27 representative is required; the privacy notice still carries an unfilled placeholder where European office details would go. The notice and terms, both dated 21 May 2025, name GDPR, CCPA, AODA, the RPwD Act, the UK Equality Act 2010 and the German BFSG, set out the legal bases used, and list the full set of data subject rights, all exercised through privacy@accesstive.com. The Trust Center adds self-service DSAR tooling, an EU data residency option and GDPR/CCPA mapping. Two gaps stand out: the sub-processor list promised at accesstive.com/sub-processors returns a 404, and SOC 2 Type II is presented as a Q4 2025 target rather than an obtained certification.

Who owns the data?

Section 15 of the terms is unambiguous: the customer owns their website content and data, and Accesstive uses it only to deliver the services. Accesstive keeps the intellectual property in the platform itself, its software, widgets and guidelines, and the customer may not remove Accesstive branding from the widget. The roles are split under the GDPR: Accesstive acts as controller for account and marketing data, and as processor for the Service Data a customer submits, handled only on that customer's instructions and covered by a data processing agreement. When the agreement ends, the licence stops and Accesstive deletes the customer's data unless the law requires it to be kept.

Reuse rights

Customers keep full reuse rights over their own content and data: nothing in the terms requires them to ask Accesstive for permission to use, export or republish the audit findings, remediation records, accessibility statements or VPAT documents produced for their site, and the Trust Center advertises self-service export from the dashboard. The limits run the other way. Accesstive grants only a limited, non-exclusive, non-transferable and revocable licence to its own platform, forbids copying, reverse-engineering, sublicensing or resale of the services, and requires written permission before its logos, widgets or materials are reused. Accesstive states it neither sells nor rents personal data, and processes customer-submitted Service Data solely on the customer's instructions.

Data retention & training

Hosting summary

Accesstive states that all data is stored and processed in Germany by ALL-INKL.COM (Neue Medien Munnich, Hauptstrasse 68, 02742 Friedersdorf), and network checks corroborate this: the site resolves to 85.13.164.156, an address operated by that provider in Dresden. The data centres are described as ISO-certified, and the Trust Center specifies ISO 27001, a WAF and DDoS protection, daily full backups and segmented virtual private clouds across multiple availability zones. Compliance is claimed against the GDPR, the German BFSG and EN 301 549, with an EU data residency option advertised. Encryption is stated as AES-256 at rest and TLS in transit, although the privacy notice says TLS 1.2 while the Trust Center says TLS 1.3. One inconsistency deserves attention: the sign-up form lets a new customer choose between an EU and a US hosting region, which the privacy notice and terms, both promising storage exclusively in Germany, never mention. Clarify this with the vendor if data residency is contractually binding for you.