Data Processing Addendum

1. Scope and roles

This addendum forms part of the Huck Terms of Service where BWD processes personal data on a customer’s behalf and applicable data-protection law requires processor or service-provider terms. Customer is the controller, or a processor authorized by its controller; BWD is its processor or subprocessor. Account, security, billing and business-contact data processed for BWD’s own lawful purposes is addressed separately in the Privacy Notice. This addendum controls a conflict concerning customer-directed personal-data processing.

Customer determines the lawful purposes, data and people involved, and must provide required notices and obtain necessary authority. Do not submit data requiring a business associate agreement, special certification, dedicated residency or another unagreed arrangement. Contact us before a deployment that requires additional terms.

2. Documented instructions and limits

The agreement, supported workspace settings, API requests and verified written directions constitute customer’s instructions. BWD will process customer personal data only to provide the contracted service on those instructions, unless law requires otherwise. Where permitted, BWD will notify customer of a legal requirement before processing beyond the instructions. BWD will inform customer if it believes an instruction violates applicable data-protection law and may pause the affected operation pending clarification.

Where applicable service-provider law requires it, BWD will not sell or share customer personal data, retain or use it outside the specified business purposes or direct business relationship, or combine it with other customers’ or independently collected personal data except as law permits. BWD will notify customer if it can no longer meet these obligations and cooperate with reasonable steps to stop and remediate unauthorized processing.

3. People, security and incidents

BWD limits access to authorized personnel and providers who need it and are bound by confidentiality obligations. Measures include encrypted transport, protected production storage, authentication and role restrictions, tenant-bound access checks, scoped credentials, logging and controlled deployment practices. Safeguards must be appropriate to the processing risk; no clause promises perfect security or a certification not separately established.

After becoming aware of a personal-data breach affecting customer personal data, BWD will notify the customer without undue delay and provide available information about its nature, likely consequences, affected data and mitigation. Information may be supplied in stages as the investigation develops. BWD will cooperate reasonably with containment and the customer’s obligations. Notice is not an admission of fault. Customer remains responsible for notices it is legally required to give to people or authorities, unless law requires BWD to notify directly.

4. Subprocessors

Customer gives general authorization for the subprocessors listed on the Subprocessors page for the stated functions. BWD will impose data-protection obligations appropriate to their processing and remains responsible for performance of its subprocessor obligations to the extent required by law.

BWD will notify the workspace owner at least 30 days before adding or materially replacing a subprocessor for customer personal data, where practicable. An urgent security or legal change may occur sooner with prompt notice. Customer may raise a reasonable data-protection objection during that period. The parties will work on an appropriate alternative; if none is reasonably available, customer may stop the affected processing and terminate the affected service with a refund of prepaid unused fees. Customer must keep its notice contact current.

5. Rights, assessment and audit assistance

Taking account of the processing and information available, BWD will provide reasonable assistance with data-subject requests, security obligations, breach notifications, impact assessments and regulator consultations. BWD will notify customer of a request concerning its controlled records and will not independently disclose those records except on authorized instructions or where legally required.

BWD will make information reasonably needed to demonstrate compliance available and allow legally required audits by customer or an independent auditor subject to appropriate confidentiality, scope and security arrangements. Existing evidence and remote review should be used where sufficient. These arrangements must not prevent a regulator’s lawful access or an audit required after a material incident. Customer bears reasonable costs of extraordinary assistance unless law or BWD’s breach requires otherwise; ordinary supported privacy tools are not made conditional on paying an audit fee.

6. Return, deletion and international transfers

At the end of processing, BWD will, at customer’s choice, return available customer personal data through supported export or reasonable assistance, and delete the remaining active copies, unless law requires retention. Customer should request return before closing access. BWD will confirm the scope of deletion on request. Restricted backup copies are isolated from ordinary use until deletion or expiry and applicable deletion instructions will be reapplied if restored. Records legally retained must be limited to the required purpose.

Primary processing is in the United States. This addendum alone does not establish every international-transfer mechanism. Where a transfer requires EU Standard Contractual Clauses, a UK Addendum or another safeguard, the parties must complete the applicable instrument, annexes and assessment before that transfer. Do not send affected data while that requirement remains unmet. No Data Privacy Framework participation, regional residency or blanket GDPR compliance certification is represented.

7. Processing description

Subject and purpose: hosting a customer workspace; synchronizing and indexing its records; authorizing retrieval; generating and evaluating responses; executing configured delivery/callback workflows; and providing operational support. Duration: the customer relationship and the limited return, deletion or legally required retention period that follows.

Nature of operations: collection, storage, organization, transformation into searchable text and embeddings, authorized retrieval, transmission to model and integration providers, generation, evaluation, access restriction, export and deletion. Data subjects: customer staff, account users, website visitors and people referenced in customer-supplied records. Data categories: business/contact identifiers, source content, gate/membership attributes, messages, prompts, evaluation context and action data selected by customer. Sensitive or child data is not approved by default.

Frequency: ongoing or intermittent as the customer uses the service. Customer’s contact is its workspace owner or designated privacy contact. BWD’s contact and mailing address appear below. The Subprocessors page describes current provider functions. The Terms’ lawful liability limits apply between the parties without limiting data subjects’ nonwaivable statutory rights.