Data Processing Addendum

1. Roles

The Tenant is the Controller of Personal Data of its Customers. Hub is a Processor acting solely on documented instructions from the Controller. The Tenant warrants that it has a lawful basis under applicable law to instruct Hub to process the Personal Data.

2. Scope, nature, purpose, and duration

Hub processes Personal Data to operate the Service: deliver and store messages across connected channels, optionally apply AI features when enabled by the Tenant, support troubleshooting, and meet legal obligations. Processing continues for the term of the Tenant's subscription, plus 30 days after termination unless the Tenant requests immediate deletion.

3. Categories of data subjects and Personal Data

• Data subjects: Customers (end-users) of the Tenant, and Tenant staff using the Service.
• Categories: identifiers (phone, username, profile name, avatar), message content (text, media, reactions), conversation metadata, and operational data (IP, audit logs).

4. Sub-processors

Tenant grants general authorization to engage Sub-processors. Hub maintains a current list at /securityand notifies Tenants of material additions at least 30 days before they take effect. The Tenant may object on reasonable grounds, in which case Hub will work in good faith to provide an alternative or, failing that, allow the Tenant to terminate the affected Service.

5. Sub-processor flow-down

Hub imposes data protection obligations on each Sub-processor that are no less protective than those in this DPA. Hub remains liable to the Tenant for the acts and omissions of its Sub-processors.

6. International transfers

Where Personal Data is transferred outside the European Economic Area, Hub relies on the European Commission's Standard Contractual Clauses (Decision 2021/914) and applicable supplementary measures, or on another transfer mechanism recognized under GDPR Chapter V.

7. Security

Hub implements appropriate technical and organisational measures consistent with GDPR Art. 32, summarized at /security. The Tenant agrees that the listed measures provide an appropriate level of security taking into account the nature of the data and the risks of processing.

8. Personal data breach

Hub notifies the Tenant without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting the Tenant's data. Notification includes nature, categories, approximate volume, likely consequences, and measures taken or proposed.

9. Data subject rights

Hub assists the Tenant in fulfilling requests from data subjects (access, correction, erasure, restriction, portability, objection). Tenants administer most rights through the Hub dashboard; for matters Hub cannot resolve through tooling, Hub will respond to written instructions within 10 business days.

10. Confidentiality and personnel

Hub ensures that personnel authorized to process Personal Data are bound by confidentiality and are trained on data protection.

11. Audit

Hub provides on request the information necessary to demonstrate compliance with this DPA, including the latest pen-test executive summary under NDA. The Tenant may conduct an audit no more than once per 12 months on 30 days' written notice and at its own expense; in lieu of an on-site audit Hub may provide a recent third-party assessment.

12. Return or deletion

Upon termination, Hub deletes or returns Personal Data within 30 days, except as required by law for retained log records.

13. Liability and order of precedence

In case of conflict between the Terms and this DPA, this DPA prevails for matters of personal data processing. Liability is governed by the Terms.

14. Contact

Data protection inquiries: privacy@arzan.cloud.