Data processing agreement

1. Who this agreement is between

This data processing agreement (the “DPA”) is between Versity Life Co-Ltd, which runs Hivenza (“we”, the processor), and the organisation that uses Hivenza (“you”, the controller). It forms part of the terms of service and applies whenever we process personal data on your behalf.

It takes effect when an owner of your workspace accepts it in the app, or when you sign a copy with us, and lasts as long as we process personal data for you. If this DPA and the terms disagree on personal data, this DPA wins.

2. What we process, and why

We process personal data only to provide the service you use: publishing and analytics for your brands, your inbox, website chat and help centre, tickets and contacts, and the features you switch on. The details are in Annex 1.

You decide what personal data comes into the service and why. You confirm you have a lawful basis for it, that you have told the people concerned what they need to know (in particular about website chat, session replay and email campaigns), and that your instructions to us comply with the law.

3. Only on your instructions

We process personal data only on your documented instructions: this DPA, the terms, and what you set up and do in the service. We don't use it for our own purposes, never sell it, and never use it for advertising.

If the law requires us to process it otherwise, we tell you first, unless the law forbids it. If we believe an instruction breaks data protection law, we tell you and may hold it until you confirm or change it.

4. Our people

Only people who need it for their work can reach personal data, and each of them is bound to confidentiality. Access to production systems is limited to a small team, and actions in our operations console are recorded with the person and the reason.

5. Security

We keep technical and organisational measures that fit the risk, described in Annex 2 and on our security page. We may improve them over time, but never lower the overall level of protection.

6. Sub-processors

You allow us to use the sub-processors listed on our sub-processors page. Owners who have accepted this DPA see each one's name in the app. Each sub-processor is bound by written terms that protect personal data at least as well as this DPA, and we remain responsible for them.

We tell you at least 30 days before adding or replacing a sub-processor, by email to the owners who accepted this DPA. If you object for a reasonable data protection reason, we work with you to find a solution; if there is none, you can end the affected service and get back what you paid for its unused period.

7. Helping you with people's requests

The service lets you find, export, correct and delete a contact's data, and keep or delete tickets and contacts on a schedule you choose. If someone writes to us about data we process for you, we pass the request to you without answering it ourselves, and help you answer it where you can't with the service.

8. Other help

We give you the information you reasonably need for data protection impact assessments and for consulting a supervisory authority, about the processing we do for you.

9. Personal data breaches

If we become aware of a breach affecting personal data we process for you, we tell your workspace's owners without undue delay, and within 48 hours, with what we know: what happened, the data and people likely affected, the likely consequences, and what we are doing about it. We add what we learn as we learn it.

Telling you is not an admission of fault. Notifying the authorities and the people affected is your decision as the controller; we help you with it.

10. Transfers outside your country

The service runs in the European Union. Where a sub-processor outside the EU, or outside a country the EU recognises as adequate, processes personal data, the transfer is covered by the European Commission's standard contractual clauses or another safeguard the law accepts. Transfers from Cameroon follow its law on personal data protection.

11. When the service ends

You can export your tickets, contacts and activity log at any time while your workspace exists. When you delete your workspace, or within 30 days after your use of the service ends, we delete the personal data we process for you, except what the law requires us to keep (such as payment records). Copies in backups are deleted as the backups expire.

12. Showing we comply

We make available the information you reasonably need to check we meet this DPA, and answer your security questionnaires. Independent audit reports and the summary of our penetration test are shared with you once they exist.

If that information is not enough, or a supervisory authority asks for it, you may audit us, yourself or through an independent auditor bound to confidentiality, once a year, with 30 days' notice, during business hours and without disrupting the service or other customers' data. You bear its cost.

13. Liability and law

Each party's liability under this DPA is subject to the limits in the terms of service, as far as the law allows. This DPA is governed by the same law and courts as the terms. Questions: hello@hivenza.com.

Annex 1. The processing

• Subject and duration: providing the service, for as long as your workspace exists, plus the deletion period in section 11.
• Nature: storing, organising, displaying, analysing, transmitting and deleting, as the features you use require, including AI features you switch on.
• People concerned: the people who comment on or message your brands, your website visitors and chat users, your contacts and their companies, recipients of your emails, and your team members.
• Data: names, usernames, profile pictures and network ids; email addresses, phone numbers and the details you add to contacts; the content of messages, comments, tickets, emails and attachments; website visits, pages viewed and, when you switch it on, session recordings with typed fields masked; technical data such as browser, device, approximate location and IP address.
• Sensitive data: the service is not meant for special categories of data; don't ask for them. If people send them in a message, you decide how to handle them.

Annex 2. Security measures

• Encryption in transit (HTTPS) everywhere; network tokens and other secrets encrypted at rest with AES-256-GCM; passwords stored only as bcrypt hashes; files in encrypted cloud storage in the EU.
• Access control: roles and fine-grained permissions checked on every request; single sign-on and SCIM; two-step sign-in and passkeys, which owners can require; network allowlists; signed-in devices that can be signed out.
• Accountability: an activity log of important actions, exportable and streamable to the customer's security tools; our own operations actions recorded with the reason.
• Application security: rate limits on sign-in, codes and public forms; human checks; a strict content security policy; signed webhooks; automated tests for permissions and refusals.
• Operations: error monitoring without secrets; least-privilege access to production; incident response with notice to customers as in section 9; retention and deletion schedules the customer controls.

Annex 3. Sub-processors

The current list, with what each one does and where, is on our sub-processors page.