Data processing addendum

This addendum forms part of the terms of service and governs personal data we process on your behalf. Where it conflicts with the terms, this document wins on data protection.

You are the controller. HSH Design is the processor. You decide what goes into the platform and why; we carry out your instructions and do nothing else with it.

We will sign this. Ask at hello@hshdesign.com and you will get a countersigned copy, with the standard contractual clauses attached if you need them.

Types of personal data processed on your behalf:

• Identity and contact details for your staff logins — name, email address, role and access scope.
• Authentication data — bcrypt password hashes, hashed two-factor codes, trusted-device tokens.
• Your customer records, as you enter them: name, company, contact details and whatever notes you add.
• Job and proof content — artwork files, specifications, versions, comments and approval history including approver name and timestamp.
• Commercial records — quotes, invoices and job history.
• Technical data incidental to running the service: IP address, timestamps and activity-log entries.

Categories of data subject: your staff, your customers and the individuals your customers nominate to approve proofs.

We do not require, and the platform is not designed for, special-category data as the GDPR defines it. If your artwork carries such data — health, biometrics, political or religious content in a design — tell us, because it changes what protections are appropriate.

Access is limited to people who need it to run or support the service, each under a duty of confidentiality that continues after they stop working with us.

Every access runs through a named login and lands in the activity log. There is no shared support account and no view that lists every tenant’s content at once — separation is enforced in the database query, scoped to the company asking, rather than by hiding rows in the page.

These are the same commitments as Your data, written here so they bind rather than merely reassure:

• We will not use your data, or anything derived from it, to train or fine-tune machine-learning models, and we will not transmit it to a third-party model provider.
• We will not sell, rent or share it for any third party’s marketing.
• We will not use it for our own commercial analysis, market research or product development beyond operating the service for you.
• We will not use it to contact your customers on our own behalf.
• We will not retain it after clause 12 requires deletion.

Aggregate operational statistics that identify no person and no customer — a count of proofs processed in a month — may be used and published. Nothing that could identify you or your customers falls into that category.

You give general authorisation for the sub-processors below. We remain responsible for what they do with your data, and each is bound by terms no weaker than these.

That is the entire list. There is no analytics provider, advertising network, CRM, data-enrichment service, session recorder or AI vendor, because we use none.

We will give you at least 30 days’ notice before adding or replacing a sub-processor with access to customer content. If you object on reasonable data-protection grounds we will discuss it, and if it cannot be resolved you may end the agreement with no penalty and take your export with you.

The servers are in the United States. The studio operating and supporting the platform is in Pakistan. For a customer in the UK or the EEA this is a restricted transfer on both legs, and we would rather set it out here than let you discover it during a review.

Where a transfer mechanism is required we will enter into:

• The UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, for UK controllers.
• The European Commission’s standard contractual clauses (module two, controller to processor), for EEA controllers.

We will complete the annexes with the details on this page and sign. We rely on no adequacy decision, because none applies, and we will not pretend otherwise.

If your rules require data residency in a specific country, say so at the start. Today the honest answer is that we cannot offer it, and you should know that before a procurement process runs for three weeks.

The measures in place, each of which exists in the software today rather than on a roadmap:

What we do not claim: no external audit, no certification, no penetration-test report. If you need those, ask now and we will answer plainly.

If personal data we process for you is breached, we will notify you without undue delay and in any case within 72 hours of becoming aware — regardless of whether your jurisdiction requires it.

The notice will describe what happened, the categories and approximate number of records involved, the likely consequences, what we have done and what we recommend you do. We will help you meet your own notification duties, and we will not wait for a complete picture before telling you something is wrong.

If one of your customers or staff exercises a data-protection right against you, we will help you answer within a timescale that lets you meet your deadline, and at no charge for a reasonable volume of requests.

A request that reaches us directly for data you control is passed to you rather than answered by us — the decision is yours.

We will provide the information you reasonably need for a data protection impact assessment or a prior consultation with a regulator.

You may satisfy yourself that we are doing what this document says. In practice that means: written answers to a security questionnaire, and a call with the person who wrote the code rather than an account manager reading a script.

For a customer with a regulatory need for more, we will agree a proportionate on-site or remote audit with reasonable notice, no more than once a year unless a breach or a regulator makes it necessary, and subject to confidentiality. We are a small studio and we will say so if a request is disproportionate — but we will not refuse one you genuinely need.

At the end of the agreement, or whenever you ask:

• We export your data in a loadable format — jobs, proofs, customer records, approval history.
• You have at least 30 days from the end date to request that export.
• We delete it from live systems within 30 days of your request or the end of that window.
• Copies inside rolling backups expire within 90 days and are not restored or searched for any purpose other than recovering from a failure.
• We keep only what the law requires us to keep — invoices and accounting records — and nothing else.

We will confirm deletion in writing if you ask.

Liability under this addendum is governed by the terms of service, except that the cap there does not apply to a breach of the data protection obligations in this document, which is one of the carve-outs in clause 9 of those terms.

This addendum is governed by the laws of the Islamic Republic of Pakistan. Where standard contractual clauses are in place, their own governing-law and forum provisions take precedence over this clause for the matters they cover — which is the point of signing them.