Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Hexaa, Inc. ("Processor") and the customer ("Controller") for processing personal data in connection with Hexaa services.

1. Definitions

Personal Data, Processing, Controller, Processor, Sub-processor, Personal Data Breach, and Applicable Data Protection Law have the meanings given in GDPR, UK GDPR, and applicable privacy law.

2. Subject matter and duration

Hexaa processes Personal Data to provide the Service. Processing continues for the term of the principal agreement and any deletion-or-return period.

3. Nature and purpose of processing

Processing includes collection, storage, retrieval, analysis, transmission, deletion, and return for readiness assessment, booking, reporting, support, security, and procurement workflows.

4. Types of Personal Data

Personal Data may include name, work email, company, role, message, booking details, readiness-assessment answers, IP address, user agent, consent state, analytics identifiers, and redacted AI trace metadata.

5. Security measures

Hexaa applies access controls, encryption in transit, least-privilege service credentials, logging, PII redaction, rate limiting, and vendor review. Annex A may be expanded in an order form.

6. Sub-processors

Hexaa may use the following sub-processors and remains responsible for their acts and omissions.