This Data Processing Addendum ("DPA") forms part of the Terms of Service for HiTRAi (os.hit.land) and related services ("Terms"). It is made between HiT Land LTD, a company registered in England and Wales under company number 14117142, with its registered office at 2 Frederick Street, Kings Cross, London WC1X 0ND, United Kingdom ("HiT Land", "we", "us", or "our"), acting as processor, and the customer that has accepted the Terms ("Customer", "you"), acting as controller.
This DPA applies where we process personal data on the Customer's behalf through the Service. It is written to meet Article 28 of the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR). If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
1. Definitions
1.1. Applicable Data Protection Law: the UK GDPR, the Data Protection Act 2018, and the EU GDPR where it applies to the processing.
1.2. Customer Data: the data described in section 8.1 of the Terms, to the extent it contains personal data.
1.3. Controller, processor, data subject, personal data, personal data breach and processing have the meanings given in Applicable Data Protection Law.
1.4. Sub-processor: a third party that we engage to process Customer Data.
1.5. Transfer Clauses: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses (SCCs), as applicable to a transfer.
1.6. Security Measures: the measures listed in Annex 2.
2. Scope and Roles
2.1. Subject matter: we process Customer Data only to provide the Service to the Customer under the Terms. Annex 1 describes the processing.
2.2. Roles: the Customer is the controller of Customer Data and we are its processor. If the Customer processes personal data on behalf of its own clients, the Customer confirms that its instructions have been authorised by those clients, and we act as the Customer's sub-processor.
2.3. Our own data: where we act as controller of account, billing, support and technical data about the Customer and its users, our Privacy Policy applies, not this DPA.
2.4. Duration: this DPA applies for as long as we process Customer Data.
3. Customer Instructions
3.1. We process Customer Data only on documented instructions from the Customer. The Terms, this DPA, and the settings and actions that the Customer and its users make in the Service are such instructions.
3.2. If we believe an instruction infringes Applicable Data Protection Law, we will tell the Customer without undue delay. We may then pause the affected processing until the Customer confirms or changes the instruction.
3.3. If the law requires us to process Customer Data other than on the Customer's instructions, we will inform the Customer before processing, unless the law forbids it.
4. Confidentiality of Personnel
4.1. We ensure that everyone who processes Customer Data is bound by a written duty of confidentiality, whether by contract or by statute.
4.2. We give access to Customer Data only to personnel who need it to provide the Service or to support the Customer, and only to the extent they need it.
5. Security
5.1. We implement the Security Measures in Annex 2. They are appropriate to the risk of the processing, as required by Article 32 UK GDPR and EU GDPR.
5.2. We may update the Security Measures from time to time. An update will not reduce the overall level of protection of Customer Data.
6. Sub-processors
6.1. Authorised Sub-processors: the Customer gives us general written authorisation to use the following Sub-processors:
- Hetzner Online (hosting, Germany): core cloud hosting, application servers and primary databases;
- Cloudflare (network, security and content delivery);
- Stripe (payments, fraud prevention and recurring billing);
- Google (Gemini AI models), OpenAI, Anthropic and OpenRouter (AI models): message text, context and prompts for drafts, summaries and chat intelligence;
- ElevenLabs (voice): speech-to-text, text-to-speech, voice cloning and dubbing, when the Customer uses these features;
- Meta Platforms (WhatsApp and Instagram), when the Customer connects these channels;
- Composio (connected business apps), when the Customer connects these apps;
- Apify (reading public social profile data), when the Customer uses features that need it;
- our email delivery provider (service emails).
6.2. Changes: we will give the Customer at least 30 days' notice before we add or replace a Sub-processor. We will give notice by email to the account owner or through the Service dashboard.
6.3. Right to object: the Customer may object to an added or replacement Sub-processor on reasonable data protection grounds within those 30 days. We will discuss the objection in good faith. If we cannot accommodate it, the Customer may cancel the affected subscription under section 4.1 of the Terms. Refunds are governed only by our Refund Policy.
6.4. Flow-down: we engage each Sub-processor under a written contract that imposes data protection obligations no less protective than this DPA. We remain responsible to the Customer for the Sub-processor's performance of those obligations, subject to section 12.
7. International Transfers
7.1. We host Customer Data in Germany, within the European Union.
7.2. Where a Sub-processor processes Customer Data outside the United Kingdom or the European Economic Area (EEA), we ensure that a transfer mechanism required by Applicable Data Protection Law is in place before the transfer. This is the IDTA or the UK Addendum for transfers from the United Kingdom, and the EU SCCs for transfers from the EEA, in each case with the applicable module.
7.3. If the Transfer Clauses conflict with this DPA, the Transfer Clauses prevail for the transfer they govern. We will provide copies of the Transfer Clauses in place on request.
8. Data Subject Requests and Assistance
8.1. If we receive a request from a data subject about Customer Data, we will tell the Customer without undue delay and will not respond to the data subject on the substance, unless the Customer instructs us to do so.
8.2. Taking into account the nature of the processing, we will help the Customer to respond to requests to exercise data subject rights. The Customer can use the tools in the Service or write to [email protected].
8.3. We will help the Customer to meet its obligations under Articles 32 to 36 UK GDPR and EU GDPR, including data protection impact assessments and prior consultation with a supervisory authority. Our help is limited to information that is reasonably available to us.
9. Personal Data Breach
9.1. We will notify the Customer of a personal data breach affecting Customer Data without undue delay and within 72 hours of becoming aware of it.
9.2. The notice will describe, as far as we know at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We may give the information in stages as it becomes available.
9.3. We will take reasonable steps to contain the breach and to reduce its effects, and we will cooperate with the Customer's investigation.
10. Deletion or Return at the End of Processing
10.1. When the Agreement ends, or earlier on the Customer's written request, the Customer may ask us to return Customer Data in a commonly used, machine-readable format before deletion.
10.2. We will delete Customer Data from our active systems within 30 days after the Agreement ends or after the request, unless the law requires us to keep it.
10.3. Customer Data in backups is deleted as those backups rotate out, and in any case within 90 days.
10.4. Account and billing records, which are our own controller data, are kept as set out in section 6.1 of the Privacy Policy.
11. Information and Audits
11.1. We will make available to the Customer the information reasonably necessary to show that we meet our obligations under this DPA. We provide it on request.
11.2. If that information is not enough, the Customer may audit our processing of Customer Data. An audit may be carried out:
- on at least 30 days' written notice;
- during normal business hours, without disrupting our operations;
- no more than once in any 12-month period, unless a supervisory authority requires it or after a personal data breach affecting Customer Data;
- by the Customer or an independent auditor bound by confidentiality, at the Customer's cost.
11.3. Where a Sub-processor's contract allows, we will pass on the Customer's audit rights to that Sub-processor, or give the Customer the results of its audit.
12. Liability
12.1. Each party's liability under this DPA is subject to the exclusions and limits in section 10 of the Terms.
13. Governing Law and Jurisdiction
13.1. This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it, as set out in section 11 of the Terms.
13.2. Where a Transfer Clause requires its own governing law for a transfer, that law applies to that transfer only.
14. Contact
- Company: HiT Land LTD (Company No. 14117142)
- Registered Address: 2 Frederick Street, Kings Cross, London WC1X 0ND, United Kingdom
- Email: [email protected]
Annex 1: Description of Processing
| Item | Description |
|---|---|
| Subject matter | Providing HiTRAi to the Customer: unified inboxes for WhatsApp and Instagram, CRM, AI-assisted drafts, voice features and integrations |
| Categories of data subjects | The Customer's contacts (for example customers, prospects and suppliers) and the Customer's team members who use the Service |
| Categories of personal data | Names; phone numbers; Instagram handles; messages; voice notes and other audio; media files; CRM notes, status tags and related metadata; message timestamps |
| Special category data | Not intended. The Customer must not submit special category data unless it has a lawful basis for doing so and has told us in advance |
| Nature of processing | Storing, organising, transmitting, transcribing, translating and generating drafts from Customer Data, as instructed by the Customer |
| Purpose | Providing the Service to the Customer |
| Duration | The term of the Agreement, followed by the deletion periods in section 10 |
Annex 2: Technical and Organisational Security Measures
- Encryption in transit: data sent between users and the Service uses Transport Layer Security (TLS, HTTPS).
- Stored credentials and tokens: stored credentials and integration tokens, such as connected-account access tokens, are encrypted in our database.
- Access control: access to Customer Data is role-based and follows the principle of least privilege. Staff access is limited to what each person needs for their role.
- Confidentiality: everyone who processes Customer Data is bound by a written duty of confidentiality (section 4).
- Hosting location: primary servers and databases are hosted in Germany by Hetzner Online.
- Backups: backups are kept no longer than 90 days, and then overwritten as they rotate.
- Sub-processor selection: Sub-processors are engaged under written contracts with data protection terms (section 6).
- Deletion: Customer Data is deleted from active systems and backups within the periods in section 10.