Data Processing Addendum

Roles and scope

The customer is the controller and HEOSSI is the processor for customer data submitted to the hosted workspace. The customer decides the purposes, files, organizations, retention settings and who receives access. HEOSSI processes customer data only to provide the services, secure them and comply with law.

Processing details

• Subject matter: hosted lossless compression, restore, verification, storage, downloads, usage and account administration.
• Duration: the subscription term and the deletion period described in the agreement.
• Data subjects: customer personnel and other individuals whose data the customer submits.
• Data types: account, organization, file, usage, billing and audit data described in the Privacy Policy.
• Special categories: the customer must not submit special-category data unless a separate written agreement covers it.

Security measures

• Role-based organization access and per-member policy limits.
• Hashed passwords, WebAuthn passkeys, session version revocation and hashed API tokens.
• Encrypted SSO client secrets and verified-domain checks for OIDC.
• Private blob storage with authorized downloads and signed access.
• SHA-256 integrity checks on outputs before delivery.
• Rate limits, submission guards, audit events and administrative review.
• Provider-level encryption in transit and at rest where offered by the hosting, database and payment providers.

Sub-processors

The current sub-processor categories and providers are listed in the Sub-processors policy. HEOSSI will give notice of a new sub-processor that processes customer personal data and a reasonable opportunity to object. If an objection cannot be resolved, the customer may terminate the affected service.

Breach notification and assistance

HEOSSI will notify the customer without undue delay after confirming a personal data breach affecting customer data and will provide information reasonably needed for the customer's own notification obligations. Notification is not an admission of fault.

HEOSSI will reasonably assist with data subject requests, security questionnaires, impact assessments and consultations, taking into account the nature of the processing and the information available.

Return, deletion and audit

On termination, customer data is deleted under the retention schedule, except records that must be kept for legal, tax or security purposes. Customers can export account data and delete stored files or the account during the term.

HEOSSI will make available information reasonably needed to demonstrate compliance and will allow audits at a agreed time and scope, subject to confidentiality and security controls. On-site audits require a separate written agreement.

International transfers and liability

Where customer data is transferred internationally, the parties will rely on appropriate safeguards, including contractual clauses where required. Each party's liability is subject to the limitations in the agreement, except where law prohibits limitation.

DPA contact: saar-legal@heossi.com. Company: HEOSSI (PTE.) LTD., Singapore, UEN 202532790K.