Data Processing Agreement

Scope and roles

This Data Processing Agreement ("DPA") forms part of the Hanse Platform Terms (the "Terms") between Hanse and the Customer. It applies whenever Hanse processes personal data contained in Customer Data on the Customer's behalf. Capitalised terms not defined here have the meaning given in the Terms or in the GDPR.

For that personal data, the Customer is the controller and Hanse is the processor. Where the Customer is itself a processor acting for its own customers, Hanse is a sub-processor, and the Customer confirms its controller has authorised Hanse's appointment.

"Data Protection Law" means the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and any other data protection law that applies to the processing.

If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

Hanse's obligations

Hanse will:

• process personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the Service, unless the law requires otherwise. In that case Hanse will inform the Customer first, unless the law prohibits it
• tell the Customer if it believes an instruction breaches Data Protection Law
• ensure everyone authorised to process the personal data is bound by confidentiality
• not use personal data in Customer Data to train or improve any models, or for any purpose of its own
• taking into account the nature of the processing, assist the Customer through appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. If Hanse receives such a request directly, it will pass it to the Customer and not respond itself, except to confirm the request was forwarded
• provide reasonable assistance with the Customer's data protection impact assessments and prior consultations with supervisory authorities, to the extent the Customer cannot do this with information already available to it

The Customer is responsible for having a lawful basis for the processing and for giving data subjects any required notices. The Customer will not submit special category data or data relating to criminal convictions unless it has assessed that the Service is appropriate for that data and has a lawful basis to do so.

Security

Hanse will implement and maintain the technical and organisational measures in Annex 2 to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Hanse may update these measures over time, provided the overall level of protection is not reduced.

The Customer is responsible for the security of its own systems, its account credentials and API keys, and for configuring the Service, including regions and routing rules, in a way that meets its own requirements.

Sub-processors

The Customer gives Hanse general authorisation to engage sub-processors. The current list is available on request, as set out in Annex 3.

Hanse will notify the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the account admin or through a notice in the Service. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service, and Hanse will refund any unused paid Credits for it.

Hanse will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for each sub-processor's performance of those obligations.

International transfers

Hanse processes Customer Data within the European Economic Area ("EEA") by default, and will not move processing outside the EEA unless the Customer configures the Service to do so or a sub-processor requires it, as disclosed in the sub-processor list.

Where personal data is transferred to a country outside the EEA without an adequacy decision, the transfer is governed by the Standard Contractual Clauses adopted by European Commission Decision 2021/914 ("SCCs"), which are incorporated by reference:

• Module Two (controller to processor) applies where the Customer is a controller
• Module Three (processor to processor) applies where the Customer is a processor
• Clause 7 (docking clause) applies; Clause 9 option 2 applies, with the notice period in section 4 of this DPA; the optional wording in Clause 11 does not apply
• for Clauses 17 and 18, the governing law and courts are those of [EU MEMBER STATE]
• Annexes I and II of the SCCs are completed by Annexes 1 to 3 of this DPA

For transfers from the United Kingdom, the SCCs apply as varied by the UK International Data Transfer Addendum issued by the Information Commissioner (version B1.0), with Table 4 set so that either party may end the Addendum as permitted by its Section 19. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

Hanse may rely on an adequacy decision, including the EU-US Data Privacy Framework, where a sub-processor is certified under it.

Personal data breaches

Hanse will notify the Customer without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting Customer Data.

The notice will describe, as far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Hanse will provide further information as it becomes available and take reasonable steps to contain and remedy the breach.

Notifying a breach is not an acknowledgement of fault or liability by Hanse.

Audits and information

Hanse will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, including summaries of relevant security policies and any third-party audit reports or certifications it holds.

If that information is not enough to show compliance, or a supervisory authority requires it, the Customer may carry out an audit, at its own cost, no more than once every 12 months. The Customer must give at least 30 days' written notice, agree the scope and timing with Hanse in advance, use an auditor bound by confidentiality who is not a Hanse competitor, and avoid disrupting Hanse's business. Audits of Hanse's sub-processors are satisfied by the reports and certifications those sub-processors make available.

Deletion and return

The Customer can export Customer Data during the term and for 30 days after the Terms end. After that period, Hanse will delete all personal data in Customer Data, including copies, within a further 30 days, unless the law requires Hanse to keep it. Request logs are deleted on their regular [30]-day cycle. Data in backups is deleted as backups expire and is kept protected and out of active use until then.

On request, Hanse will confirm deletion in writing.

Liability, term and governing law

Each party's liability under this DPA is subject to the limitations of liability in the Terms, except where Data Protection Law or the SCCs do not allow those limits.

This DPA applies for as long as Hanse processes personal data in Customer Data, and ends automatically once deletion under section 8 is complete.

Except as set out for the SCCs in section 5, this DPA is governed by the same law and courts as the Terms.

Details of processing

Technical and organisational measures

• Encryption: data encrypted in transit with TLS 1.2 or higher, and at rest where stored, including backups.
• Access control: staff access to production systems on a least-privilege basis with multi-factor authentication; access reviewed regularly and removed on role change or departure.
• Customer access: role-based access in the Service (admin, member, read-only); API keys scoped to the organisation and revocable at any time.
• Tenant isolation: Customer Data logically separated between customers; dedicated deployments run on capacity reserved for the Customer.
• Data residency: processing in the EEA by default; the processing region of every request is logged, and any request processed outside the EEA is flagged.
• Logging and monitoring: security-relevant events logged and monitored, with alerting on suspicious activity.
• Vulnerability management: dependencies and infrastructure patched promptly; regular security testing of the Service.
• Data minimisation: no use of Customer Data for model training; request logs kept for a limited period only.
• Incident response: documented process to detect, contain, investigate and notify personal data breaches.
• Resilience: backups and recovery procedures for systems that store data.
• Personnel: staff bound by confidentiality and trained on security and data protection.
• Sub-processor management: security and privacy due diligence before engagement, and written data protection terms with each sub-processor.

Sub-processors

Hanse keeps an up-to-date list of the sub-processors it uses to process Customer Data, including their purpose and processing location. To request the full list, contact privacy@gethanse.eu. Changes are notified as set out in section 4.