Data Processing Agreement

"Controller" means the Customer who determines the purposes and means of processing Personal Data via the Digitalix Hub platform. "Processor" means Digitalix Hub (operated by the entity specified at digitalixhub.com/terms), which processes Personal Data on behalf of the Controller. "Personal Data", "Processing", "Data Subject", and "Supervisory Authority" have the meanings given in the GDPR (Regulation (EU) 2016/679).

"Sub-processor" means any third party engaged by Digitalix Hub to process Personal Data on behalf of the Controller. The current list is maintained at digitalixhub.com/subprocessors.

Digitalix Hub processes Personal Data solely to provide the Services described in the Terms of Service — specifically: account management, company backbone generation, agent task execution, integration synchronisation, billing, and support. Processing categories include: account identifiers (name, email), onboarding Q&A responses, company memory documents, agent task inputs and outputs, integration OAuth tokens (encrypted at rest), and billing records.

The duration of processing corresponds to the term of the Customer's subscription. Upon termination, data is retained per the offboarding schedule (30-day soft delete, 90-day permanent delete, 180-day backup purge) unless applicable law requires longer retention.

Digitalix Hub implements appropriate technical and organisational measures including: encryption at rest (AES-256) and in transit (TLS 1.2+); row-level security enforced at the ORM layer ensuring strict tenant isolation; Argon2id password hashing; HTTP-only secure session cookies; rate limiting and CSRF protection; regular automated backups with tested restore procedures.

Access to production systems is restricted to authorised personnel only. No customer data is transmitted to third-party logging, observability, or analytics services — all telemetry is self-hosted. API keys provided by customers are encrypted at rest using AES-256-GCM.

Customer Personal Data is stored and processed within the European Union. Where sub-processors outside the EU are used (see subprocessor list), transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, or by an adequacy decision under Article 45 GDPR.

Digitalix Hub does not transfer Personal Data to any country or entity without appropriate safeguards. When customers connect BYO API keys to non-EU LLM providers, the customer acts as Controller for that data transfer and is responsible for ensuring appropriate safeguards.

Digitalix Hub engages sub-processors listed at digitalixhub.com/subprocessors. The Controller is notified of any changes to sub-processors at least 14 days before the new sub-processor begins processing. If the Controller objects, they may terminate the affected Services within 30 days.

Each sub-processor is bound by data protection obligations no less protective than those in this DPA. Digitalix Hub remains fully liable for the acts and omissions of its sub-processors.

Digitalix Hub assists the Controller in responding to Data Subject requests (access, rectification, erasure, portability, restriction, objection) through built-in self-service tools: Settings for data export, account deletion, and data portability. Where requests require manual processing, Digitalix Hub responds within 72 hours.

In the event of a Personal Data breach, Digitalix Hub notifies the Controller without undue delay and in any case within 48 hours of becoming aware of the breach, providing: the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.