Data Processing Agreement

1. Subject, duration and nature

Hubzone processes personal data to provide the service described in the Terms: storing, organising, displaying, sending (e-mail, forms), searching, reporting and deleting the data. The processing lasts as long as the workspace exists, and ends as set out in section 9.

2. Data and people

• People: the Customer's contacts, prospects, customers, website and form visitors, meeting participants, and the Customer's own users.
• Data: names, contact details, company details, notes, messages and e-mail, files, call and meeting recordings and transcripts, form answers, consent records, activity and tracking data, and anything else the Customer chooses to enter.
• Special categories of data (for example health or biometric data) are not required to use the service. If the Customer enters them it does so on its own responsibility and must have a legal basis.

3. The Customer's instructions

Hubzone processes the data only on the Customer's documented instructions: the Terms, this agreement, the settings of the workspace and the use of the product and its API. If Hubzone believes an instruction breaks the law it tells the Customer. The Customer decides the legal basis, the notices to its contacts and how long the data is kept.

4. Confidentiality

Everyone at Hubzone who may reach the data is bound by confidentiality, and access is limited to what the work needs.

5. Security

Hubzone applies appropriate technical and organisational measures. Today they include: encrypted connections (TLS) with strict browser protections; passwords stored only as one-way hashes; mandatory two-step sign-in; isolation of each workspace in the database (row level security, tested); message text encrypted in the database; files in a private store with every read checked by the application; encrypted daily backups kept apart from the server; monitoring and alerts; limits against automated attacks; and regular security reviews. The measures are described in more detail on request and may be improved over time but not weakened.

6. Sub-processors

The Customer gives general permission to use the sub-processors below. Hubzone has a contract with each of them that gives equivalent protection. Hubzone announces a new sub-processor or a change at least 30 days before it starts, by e-mail to the workspace owners and on this page. The Customer may object on reasonable data protection grounds within that time; if the matter cannot be solved, the Customer may close the workspace and take its data (section 9).

• Hostinger International Limited: server hosting (data centre in Germany).
• Cloudflare, Inc.: network protection, DNS, human verification, and the private file and backup store (Cloudflare R2).
• Google LLC: e-mail delivery through Google Workspace, and sign-in with Google when the user chooses it.
• Providers the Customer itself connects (for example its own mail server, Google or Microsoft calendar): they are the Customer's own processors, not Hubzone's.
• No artificial intelligence provider is used today. Before one is used it will be added here with 30 days' notice.

7. Helping the Customer

Hubzone helps the Customer, with the tools in the product and by reasonable support, to answer requests from people about their data (access, copy, correction, deletion, objection, restriction, portability), to keep the data secure, to report breaches, and to carry out impact assessments and consult an authority when needed. If a person writes to Hubzone about the Customer's data, Hubzone passes it on to the Customer.

8. Personal data breaches

Hubzone tells the Customer without undue delay after it becomes aware of a breach that affects the Customer's data, and aims to do so within 24 hours of confirming it, with what is known: what happened, which data and workspaces, what Hubzone has done and what it advises the Customer to do. Hubzone keeps the Customer informed as more becomes known. The Customer decides whether and how to notify the authority and the people.

9. Return and deletion

The Customer can export its data at any time with the export tools. When the workspace is deleted (by an owner, in Settings > Data privacy > Delete workspace) all its data and files are deleted at once. Copies in backups are removed by themselves within 30 days. Hubzone keeps data only where the law requires it, and only for as long as it requires.

10. Information and audits

Hubzone gives the Customer the information needed to show that it follows this agreement. Once a year, or after a breach, the Customer may ask for an audit by itself or an independent auditor under confidentiality, with 30 days' notice, during business hours, without harming other customers' data or the service; each side bears its own costs.

11. Transfers abroad

The data is hosted in Germany and some sub-processors work worldwide. Hubzone makes sure every transfer has a lawful ground: where Turkish law (KVKK article 9) or the GDPR require it, through the safeguards those laws allow (for example standard contract clauses, which are notified to the Authority when the law requires it). Hubzone gives the Customer the help it needs for this.

12. Liability, law and changes

Liability is governed by the Terms. Turkish law applies, and the Istanbul courts and enforcement offices are competent, unless a mandatory law says otherwise. Hubzone may update this agreement for legal or technical reasons and announces important changes at least 30 days ahead by e-mail; the Customer may close the workspace before they apply.

13. Contact

Stokzone Teknoloji Limited Şirketi

Esentepe Mah. Büyükdere Cad. Levent 199 No: 199 İç Kapı No: 6, Şişli / İstanbul

Tax office / No: Zincirlikuyu / 7811172592 · MERSIS: 0781117259200001

E-mail: [email protected]