Service policy · Last updated 2026-09-25
Data Processing Addendum
This Data Processing Addendum (DPA) forms part of the written agreement between Hubzoid and a customer for implementation services, together with any order or statement of work under it (the Agreement). It applies when Hubzoid processes Customer Personal Data on the customer's behalf in providing those services. Capitalized terms not defined in this DPA have the meanings given in the Agreement.
Section 01
Definitions
Customer means the organization that has entered into the Agreement with Hubzoid.
Customer Personal Data means personal data that Hubzoid processes on behalf of the Customer in providing the Services.
Data Protection Laws means the laws that apply to the processing of Customer Personal Data under the Agreement, which may include the EU General Data Protection Regulation (GDPR), the GDPR as it forms part of United Kingdom law (UK GDPR), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) and India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Customer Personal Data.
Services means the implementation services described in the Agreement, in which Hubzoid designs, builds, deploys and hands over internal agents for the Customer.
Standard Contractual Clauses means the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner.
Subprocessor means a third party engaged by Hubzoid to process Customer Personal Data.
Controller, processor, data subject, processing, data fiduciary, data principal, service provider and contractor have the meanings given in the applicable Data Protection Laws.
Section 02
Scope and application
This DPA applies only to Customer Personal Data that Hubzoid processes in providing the Services.
It does not apply to data processed by a Hubzoid deployment that the Customer operates on its own, including after handover, other than while Hubzoid accesses that deployment to provide the Services.
It also does not apply to personal data that Hubzoid processes as a controller for its own business purposes, such as the business contact details of Customer personnel. That processing is described in the Privacy Policy at /legal/privacy.
Section 03
Roles of the parties
The Customer is the controller of Customer Personal Data and, where the DPDP Act applies, the data fiduciary. Hubzoid is the Customer's processor and, where the DPDP Act applies, its data processor.
Where the Customer acts as a processor on behalf of a third-party controller, Hubzoid acts as the Customer's subprocessor, and the Customer confirms that its instructions to Hubzoid have been authorized by that controller.
Section 04
Processing instructions
Hubzoid processes Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless the law requires otherwise. In that case Hubzoid will inform the Customer of the legal requirement before processing, unless the law prohibits it.
The Agreement, this DPA and the Customer's configuration of the agents and systems within the scope of the Services are the Customer's complete instructions at the date of the Agreement. Additional instructions must be given in writing and be consistent with the Agreement.
Hubzoid will inform the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.
Section 05
Customer responsibilities
The Customer is responsible for having a lawful basis for the processing, for providing any notices and obtaining any consents that Data Protection Laws require, and for the accuracy of Customer Personal Data.
The Customer selects and contracts directly with the model providers, cloud providers and other services that its agents use, and is responsible for its agreements with them. These providers are not Hubzoid Subprocessors.
The Customer will not provide special categories of personal data, health information, payment card data or other regulated data for processing in the Services unless the Agreement expressly covers that data and the controls it requires.
Section 06
Hubzoid personnel
Hubzoid ensures that everyone it authorizes to process Customer Personal Data is bound by an appropriate duty of confidentiality and receives access only to the extent needed to provide the Services.
Section 07
Access to Customer environments
The Services are carried out in the Customer's own environment. Hubzoid accesses that environment only with the Customer's approval, for a defined period and with the least access needed for the task. Hubzoid's access is revoked at handover. Any later access for support is approved by the Customer for a defined period.
Hubzoid does not copy Customer Personal Data out of the Customer's environment unless the Customer instructs it to or a copy is strictly necessary to provide the Services and the Customer has agreed.
Section 08
Security
Hubzoid implements and maintains the technical and organizational measures described in Annex B. They are designed to protect Customer Personal Data against Personal Data Breaches, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.
Hubzoid may update these measures over time, provided that an update does not reduce the overall level of protection.
Section 09
Subprocessors
The Customer gives Hubzoid general authorization to engage the Subprocessors listed at /legal/subprocessors.
Hubzoid will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those in this DPA. Hubzoid remains responsible to the Customer for each Subprocessor's performance of those obligations.
Hubzoid will notify the Customer by email at least 30 days before a new Subprocessor begins processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period, and the parties will then work in good faith to find a solution. If they cannot, the Customer may terminate the affected Services by written notice, and Hubzoid will refund any prepaid fees for Services not yet performed.
Section 10
International transfers
Hubzoid may process Customer Personal Data outside the country where the Customer is located, including when Hubzoid personnel access the Customer's environment from India. Any such transfer will comply with Data Protection Laws.
Where Customer Personal Data is transferred from the European Economic Area to a country that has not been recognized as providing adequate protection, the Standard Contractual Clauses are incorporated into this DPA by reference. Module Two applies where the Customer is a controller, and Module Three applies where the Customer is a processor. Clause 7 applies. Under Clause 9, Option 2 applies, with the notice period set out in Subprocessors. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the law and courts of Ireland apply. Annex I is completed with the information in Annex A, and Annex II with the information in Annex B.
Where Customer Personal Data is transferred from the United Kingdom, the UK Addendum applies, completed with the information in this DPA and its annexes. Where it is transferred from Switzerland, the Standard Contractual Clauses apply with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and references to member states include Switzerland.
If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses prevail.
Section 11
Personal Data Breaches
Hubzoid will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed and a contact point for more information. Hubzoid will provide further information as it becomes available.
Hubzoid will take reasonable steps to contain and remedy the breach and will cooperate with the Customer so that it can meet its obligations to notify supervisory authorities, including the Data Protection Board of India, and affected individuals. Notifying a Personal Data Breach is not an admission of fault or liability.
Section 12
Data subject requests
Taking into account the nature of the processing, Hubzoid will provide reasonable assistance to enable the Customer to respond to requests from individuals exercising their rights under Data Protection Laws.
If Hubzoid receives a request directly from an individual about Customer Personal Data, it will promptly forward the request to the Customer. Unless the Customer authorizes otherwise, Hubzoid will not respond except to confirm that the request has been passed to the Customer.
Section 13
Impact assessments and consultations
Hubzoid will provide reasonable information and assistance to help the Customer carry out data protection impact assessments, and any prior consultations with supervisory authorities, that relate to the Services.
Section 14
Audits and information
Hubzoid will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. Hubzoid may first respond with documentation and written answers to reasonable security questionnaires.
If that information does not reasonably satisfy the Customer's obligations, the Customer may audit Hubzoid's compliance with this DPA on reasonable advance written notice, no more than once in any 12-month period, during normal business hours and under appropriate confidentiality obligations. These limits do not apply where a supervisory authority requires an audit or following a confirmed Personal Data Breach. Each party bears its own costs of an audit.
Section 15
AI models and training
Hubzoid will not use Customer Personal Data to train, fine-tune or improve any AI model, or to provide services to any other customer.
The Customer selects the model providers its agents use. Prompts and other data sent to those providers are processed under the Customer's own agreements with them.
Section 16
US state privacy laws
Where the CCPA or a similar US state privacy law applies, Hubzoid acts as a service provider or contractor. Hubzoid will not sell or share Customer Personal Data. It will not retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship with the Customer. It will not combine Customer Personal Data with personal information it receives from other sources, except as the law permits.
Hubzoid will comply with the applicable obligations of those laws, provide the level of privacy protection they require and notify the Customer if it determines that it can no longer meet its obligations. The Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.
Section 17
India
Where the DPDP Act applies, Hubzoid processes Customer Personal Data only under this DPA and the Agreement, protects it with reasonable security safeguards, informs the Customer of any Personal Data Breach so that the Customer can notify the Data Protection Board of India and affected data principals, and erases Customer Personal Data when the Customer instructs it to do so.
Section 18
Return and deletion
When the Services end, or earlier at the Customer's request, Hubzoid will return or delete Customer Personal Data held on Hubzoid systems within 30 days and will confirm the deletion in writing on request. Hubzoid may keep a copy only where the law requires it. Any such copy remains protected by this DPA and is used for no other purpose.
Customer Personal Data in the Customer's environment remains under the Customer's control, and Hubzoid's access to that environment is revoked.
Section 19
Liability, precedence and term
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws do not permit such a limitation.
If this DPA conflicts with the Agreement, this DPA prevails in relation to the processing of Customer Personal Data. This DPA remains in effect for as long as Hubzoid processes Customer Personal Data.
Section 20
Annex A: details of processing
Subject matter and duration. Processing of Customer Personal Data to provide the Services, for the term of the Agreement and until the data is returned or deleted as described in this DPA.
Nature and purpose. Accessing, configuring, connecting, testing, deploying and supporting the Customer's Hub and internal agents, including connecting agents to the Customer's knowledge and systems, reviewing agent runs and access decisions to test and correct them, and onboarding the Customer's team.
Categories of data subjects. The Customer's personnel and other people authorized to use its agents, and individuals whose personal data appears in the knowledge, documents and systems the Customer connects to its agents, such as the Customer's customers, suppliers and other contacts.
Categories of personal data. Identity and access data, such as names, work email addresses, user identifiers, roles and group membership. Business contact details. The content of documents, messages and records in connected systems, as determined by the Customer. Records of agent activity, such as conversations, workflow runs, tool calls and access decisions.
Special categories of data. None, unless the Agreement expressly provides otherwise and describes the additional safeguards that apply.
Frequency. Continuous for the duration of the Services.
Retention. For the duration of the Services, after which the data is returned or deleted as described in Return and deletion.
Subprocessors. As listed at /legal/subprocessors.
Competent supervisory authority. For transfers under the Standard Contractual Clauses, the authority determined in accordance with Clause 13.
Section 21
Annex B: technical and organizational measures
Single-tenant deployment. Each Customer's Hub and agents are deployed as a separate instance in infrastructure the Customer controls.
Controlled access. Hubzoid access to Customer environments is approved by the Customer, limited in time and scope, granted to named individuals and revoked at handover.
Access to tools and data. Agents are configured so that access to restricted tools is checked at the time of each call against the verified identity of the person or service making the request, and each decision is logged. A restricted call that cannot be logged does not run.
Credentials. Credentials for Customer systems are stored in the Customer's environment, in locations that agents' file tools cannot read, and are not shared through email or chat.
Change management. Hub context, agent instructions and tool code are kept under version control, and changes are reviewed and tested before deployment.
Testing. Agents are tested against agreed evaluation cases before deployment and after significant changes.
Encryption. Connections that Hubzoid makes to Customer systems are encrypted in transit. Hubzoid devices used for the Services use full-disk encryption.
Hubzoid systems and accounts. Hubzoid business accounts use multi-factor authentication, devices are kept up to date with security patches, and access is removed promptly when a person no longer needs it.
Personnel. Hubzoid personnel are bound by confidentiality obligations and receive guidance on handling personal data securely.
Incident response. Hubzoid maintains a documented incident response procedure with defined escalation paths and the notification timelines set out in this DPA.
Vulnerability management. Hubzoid operates the vulnerability disclosure process at /legal/vulnerability-disclosure and publishes security fixes to the open-source software in new releases.
Documentation. On request, Hubzoid provides a description of the deployment architecture for the Services, including the data flows that leave the Customer's environment.