This Data Processing Agreement ("DPA") forms part of the agreement between FAVZ Group ("AIZA", "Processor") and the customer ("Controller") and applies where AIZA processes personal data on behalf of the Controller in the course of providing the Service.
This DPA is entered into under Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national implementations thereof.
"Controller" means the AIZA customer who determines the purposes and means of processing personal data.
"Processor" means AIZA, who processes personal data on behalf of the Controller.
"Personal Data" has the meaning given in the GDPR.
"Processing" has the meaning given in the GDPR.
"Sub-processor" means any third party engaged by AIZA to process personal data on behalf of the Controller.
"Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
"Service" means the AIZA-Hextyx AI security assessment platform as described in the Terms of Service.
AIZA processes personal data only as Processor, acting on documented instructions from the Controller.
The subject matter and nature of processing is the provision of AI security assessment services, which may involve processing personal data as follows:
Categories of data subjects: The Controller's employees, contractors, and authorized users who access the AIZA platform.
Categories of personal data: - Account data: name, email address, organisation, role - Usage data: scan configurations, scan logs, API access logs, report downloads - Technical data: IP addresses, session tokens, timestamps - Incidental data: any personal data that may appear in responses from the Controller's target AI system during scanning (see Section 2.3)
Purpose of processing: Providing the AIZA security assessment service, including account management, scan execution, report generation, billing, and support.
Duration: For the duration of the Controller's subscription plus the retention periods specified in AIZA's Privacy Policy.
AIZA sends structured probe requests to the Controller's target AI systems. The Controller is responsible for ensuring that their target AI systems do not return regulated personal data in response to these probes. AIZA processes probe responses only to extract security findings and does not store full response bodies. The Controller acknowledges that any personal data appearing in target system responses is incidental and that AIZA acts as Processor in respect of such data for the sole purpose of generating security findings.
AIZA shall:
3.1 Process only on instructions: Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by applicable law. In such a case, AIZA shall inform the Controller of that legal requirement before processing, unless prohibited by law.
3.2 Confidentiality: Ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.3 Security: Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate: - Encryption of personal data in transit and at rest - Ongoing confidentiality, integrity, availability, and resilience of processing systems - Ability to restore availability and access following a physical or technical incident - Regular testing and evaluation of security measures
3.4 Sub-processors: Not engage another processor without prior specific or general written authorisation of the Controller. Current sub-processors are listed in Schedule A.
3.5 Assist with rights requests: Taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests from data subjects exercising their rights.
3.6 Assist with compliance: Assist the Controller in ensuring compliance with obligations pursuant to Articles 32 to 36 GDPR (security, breach notification, DPIA, prior consultation), taking into account the nature of processing and information available to AIZA.
3.7 Deletion or return: At the choice of the Controller, delete or return all personal data after the end of provision of services, and delete existing copies unless required by law to retain them.
3.8 Audit: Make available to the Controller all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. AIZA may require reasonable advance notice (30 days) and that audits are conducted during business hours with minimum disruption.
The Controller shall:
4.1 Ensure that there is a lawful basis for processing personal data under the GDPR before instructing AIZA to process it.
4.2 Provide any necessary notices to and obtain any necessary consents from data subjects in connection with the processing described in this DPA.
4.3 Ensure that personal data provided to AIZA or that may be returned by target AI systems during scanning is accurate and handled in accordance with applicable data protection law.
4.4 Not instruct AIZA to process personal data in a manner that would violate applicable data protection law.
The Controller provides general authorisation for AIZA to engage sub-processors. AIZA will inform the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object.
Schedule A — Current Sub-processors:
| Sub-processor | Location | Purpose | Data Shared |
|---|---|---|---|
| Supabase, Inc. | USA (with EU data residency options) | Database, authentication infrastructure | Account data, scan metadata |
| Railway Corp. | USA | Cloud hosting and compute | Encrypted application data |
| Stripe, Inc. (if applicable) | USA | Payment processing | Billing data |
AIZA will maintain an up-to-date list of sub-processors at legal/sub-processors (or upon request to dpo@hextyx.com). AIZA imposes data protection obligations on sub-processors equivalent to those in this DPA.
If the Controller has legitimate grounds to object to a new sub-processor, the Controller must notify AIZA within thirty (30) days of being informed. If the parties cannot resolve the objection, either party may terminate the affected services with reasonable notice.
Where AIZA transfers personal data to a third country outside the European Economic Area or United Kingdom, AIZA shall ensure the transfer is subject to appropriate safeguards, including:
A copy of applicable SCCs is available upon request at dpo@hextyx.com.
AIZA shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting personal data processed under this DPA.
Notifications shall include, to the extent available: - Nature of the Security Incident - Categories and approximate number of data subjects concerned - Categories and approximate number of personal data records concerned - Likely consequences of the Security Incident - Measures taken or proposed to address the incident
AIZA shall cooperate with the Controller and take reasonable steps to assist in investigating, mitigating, and remediating the Security Incident.
AIZA shall provide reasonable assistance to the Controller in connection with any data protection impact assessment required under Article 35 GDPR, to the extent that such assessment relates to AIZA's processing activities.
Upon termination of the Service, AIZA shall, at the Controller's election:
(a) Return: Provide the Controller with an export of their personal data in a machine-readable format within thirty (30) days of the termination date.
(b) Delete: Securely delete all personal data within ninety (90) days of the termination date, and provide written confirmation of deletion upon request.
Unless the Controller makes an election within thirty (30) days of termination, AIZA will delete the data in accordance with its standard retention policy.
AIZA may retain personal data where required by applicable law, for the period required by that law.
Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA limits liability for matters that cannot be limited by law under applicable data protection legislation.
This DPA is governed by the law of Wyoming, USA. For EU data subjects, this DPA is interpreted in accordance with applicable EU data protection law.
This DPA is incorporated into and forms part of the Terms of Service agreed between AIZA and the Controller. No separate signature is required — acceptance of the Terms of Service constitutes acceptance of this DPA.
Enterprise customers may request a separately executed version by contacting legal@hextyx.com.