Huntbase's standard Data Processing Addendum (DPA) for customers.
Version 2026-10-10 · Last updated
The Sub-processors we engage under Section 4 are listed on our Sub-processors page.
This Data Processing Addendum ("DPA") is subject to and forms part of the Huntbase Terms of Service (the "Agreement"). Unless otherwise defined in this DPA or in the Agreement, all capitalised terms used in this DPA will have the meanings given to them in Section 8 of this DPA.
1.1 Roles of the Parties. You are a Controller of Customer Personal Data. We are a Processor of Customer Personal Data. Processing details are stated in Schedule 1 (Description of Processing).
1.2 Order of Precedence. If there is any conflict or inconsistency among the following documents, the order of precedence from highest to lowest will be: (1) the Agreement; (2) Schedule 1 (Description of Processing); and (3) the main body of this DPA.
2.1 This DPA, the Agreement, and your use of Huntbase (including relevant configurations and settings) comprise your documented instructions regarding our Processing of Customer Personal Data ("Documented Instructions"). We will process Customer Personal Data only on your Documented Instructions, including with regard to transfers of Customer Personal Data to a third country or an international organisation, unless we are required to do so by law. In such a case, we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. You are responsible for ensuring Documented Instructions comply with Applicable Data Protection Laws.
2.2 We will treat Customer Personal Data as your Confidential Information under the Agreement and ensure that our personnel authorised to Process Personal Data are bound by appropriate obligations of confidentiality.
3.1 Security Measures. We have implemented and will maintain appropriate technical and organisational measures designed to protect the security, confidentiality, integrity and availability of Customer Personal Data and protect against Security Incidents.
3.2 Security Incidents. We will notify you without undue delay after becoming aware of a Security Incident. We will make reasonable efforts to identify the cause, mitigate the effects, and remediate the cause to the extent within our reasonable control. Upon your request and taking into account the nature of the Processing and the information available to us, we will assist you by providing information reasonably necessary for you to meet your Security Incident notification obligations under Applicable Data Protection Law.
4.1 General Authorisation. You authorise us to engage Sub-processors to Process Customer Personal Data, including those outside the UK and European Economic Area, provided we: (i) enter into a written agreement with each Sub-processor imposing data protection terms that require the Sub-processor to protect Customer Personal Data to the standard required by Applicable Data Protection Law and to the same standard provided by this DPA; and (ii) remain liable to you if such Sub-processor fails to fulfil its data protection obligations with regard to the relevant Processing activities under the Agreement.
4.2 Transfers of Data. Where we transfer data to a third party outside the UK and European Economic Area, we will only do so where we have a lawful basis, including recipients in countries subject to an adequacy decision, or under an agreement which includes the UK or EU Model Contract Clauses, as applicable.
5.1 Data Subject Rights. Taking into account the nature of the Processing, we will provide reasonable and timely assistance to you to enable you to respond to requests for exercising a data subject's rights (including rights of access, rectification, erasure, restriction, objection, and data portability) in respect of Customer Personal Data.
5.2 Third Party Requests. Unless prohibited by law, we will promptly notify you of any valid, enforceable legal process or governmental request compelling us to disclose Customer Personal Data. If we receive an inquiry or request for information from any other third party (such as a regulator or data subject) concerning the Processing of Customer Personal Data, we will redirect such inquiries to you and will not provide any information unless required to do so under law.
6.1 Following expiration or termination of the Agreement, we will delete all Customer Personal Data held by us. Notwithstanding the foregoing, we may retain Customer Personal Data (i) as required by Applicable Data Protection Law or (ii) in accordance with our standard backup or record retention policies, provided that in either case we will maintain the confidentiality of, and otherwise comply with the applicable provisions of this DPA with respect to, retained Customer Personal Data and not further Process it except as required by Applicable Data Protection Law.
7.1 On your written request, we will provide you with reasonable information necessary to demonstrate our compliance with this DPA, which may include a summary copy of relevant third-party security audit reports.
7.2 Our liability arising out of or related to this DPA is subject to the Limitation of Liability section of the Agreement.
| Term | Meaning |
|---|---|
| Applicable Data Protection Law | All laws applicable to the Processing of Personal Data under the Agreement. |
| Controller | The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. |
| Customer Personal Data | Personal Data contained in Customer Data that we Process under the Agreement solely on your behalf in our capacity as Processor. |
| Personal Data | Information about an identified or identifiable natural person, or which otherwise constitutes "personal data", "personal information", "personally identifiable information" or similar terms as defined in Applicable Data Protection Law. |
| Processing | Any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction. |
| Processor | The entity which Processes Personal Data on behalf of the Controller. |
| Security Incident | Any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data Processed by us. |
| Sub-processor | Any third party engaged by us to Process Customer Personal Data. |
Purpose of processing: To provide Huntbase and related support for you and your Users, to enable the use of various features and functionalities in Huntbase, including investigating Security Incidents, resolving issues, bugs and errors, enforcing the Acceptable Use Policy, and complying with our legal obligations.
Categories of data subjects whose Personal Data is Processed: Users, your personnel, your clients, or your clients' personnel.
Categories of Personal Data Processed: Customer Personal Data, the content of which is determined and controlled by you and your Users; device and log data, including system log data and telemetry data.
Duration of Processing: We will Process Customer Personal Data for the term of the Agreement as outlined in Section 6 (Deletion and Return of Customer Personal Data).
Transfers to Sub-processors: We will transfer Customer Personal Data to Sub-processors as permitted in Section 4 (Sub-processing).
Controller Activities: We act as a Controller of Personal Data as specified in our Privacy Policy. This DPA does not apply to our Processing of Personal Data in our capacity as a Controller.