Data processing agreement and sub-processors

Who is responsible for what

You decide what data goes into Hubbery and why. We process it only to deliver the service and according to your instructions. If one of your customers asks for access or deletion, that is your request to handle; we help with the tools in the dashboard.

What we process

The content of conversations across every channel, your customers’ contact details, the knowledge you put in, and the details of your own colleagues who use the dashboard. Special categories of personal data do not belong there; if they do appear in a message, they are treated like the rest of that message.

Sub-processors

We engage third parties for hosting, language models and telephony. With each of them we have a processing agreement with at least the same obligations. New sub-processors are announced at least thirty days in advance; you may object.

• Hosting, database and backups: [supplier], EU
• Language model for answers: [supplier] — no training on your data
• Speech and telephony: [supplier], only if you use the phone channel
• SMS and WhatsApp: [supplier], only if you use those channels
• Payments: [supplier] — processes no conversations, only billing data

Transfers outside the EU

The starting point is processing inside the EU. Where a supplier nevertheless processes outside the EU, that happens under the European Commission’s standard contractual clauses and it is stated in the list above. If you want EU-only processing, say so: then we switch off the channels for which that does not hold today.

Security

The measures are on the security page and form part of the agreement: separation per organisation in the database, encryption of secrets and traffic, roles and a full audit trail.

Data breaches

If we discover a breach affecting your data, we report it within 24 hours of our discovery, with what we know at that moment: what happened, which data it concerns and what we are doing about it. Reporting to the supervisory authority is yours; we supply what you need for it.

Return and deletion

At the end of the agreement you receive your data in a usable format. After that we delete everything within thirty days, including backups within their retention window, unless the law obliges us to keep something longer.

Audit

You may check once a year whether we keep to this, with reasonable notice. In practice that starts with questions and documents; only if that is not enough, with an on-site audit.

How to get it

Email support@hubbery.nl with your organisation’s name and address; you receive it digitally for signature. If you have your own template, send it along — we will look at it rather than refuse it.