Data Processing Agreement

The Client is controller (or processor, where it acts for its own customers); Hybytes is processor, acting only on the Client's documented instructions.

• Subject matter: the Services described in the relevant SOW.
• Duration: the term of the SOW, plus any retention period under Section 8.
• Nature and purpose: access to, and where relevant migration, hosting, monitoring, or engineering of, systems containing personal data, solely to perform the Services.
• Categories of data and data subjects: vary by engagement and are described in the SOW where practical, for example the Client's employees, customers, or end users.
• Special category data: none is intended; the Client must not include it without our prior written agreement.

Hybytes accesses only what the SOW describes, only for as long as needed, and never uses Client personal data for its own purposes, including marketing or training its own models, without separate written agreement.

• Process only on the Client's documented instructions, including on international transfers, unless required otherwise by law, in which case we tell the Client first unless prohibited.
• Keep authorised personnel under confidentiality obligations.
• Implement the measures in Section 6.
• Engage sub-processors only as permitted under Section 5.
• Assist the Client with data subject requests, security, breach notification, and impact assessments.
• Notify breaches as set out in Section 7.
• Delete or return data at engagement end, per Section 8.
• Support audits as set out in Section 4.

The Client, or its mandated auditor, may audit our compliance, at most once a year except after an actual breach, on 30 days' notice, during business hours, under confidentiality, at the Client's cost unless a material breach is found. A current SOC 2, ISO 27001, or equivalent report satisfies the request where it reasonably covers the scope.

The Client authorises the sub-processors listed in our Sub-processors document. We give 30 days' notice of additions; the Client may object on reasonable data protection grounds. If unresolved after a further 30 days, the Client may terminate the affected engagement with a pro-rata refund of unused prepaid fees. We remain liable for our sub-processors, under terms no less protective than this DPA.

• Encryption in transit (TLS 1.2+) and at rest where supported.
• Least-privilege, role-based access with MFA and periodic access reviews.
• Environment and tenant separation where Hybytes manages infrastructure.
• Secure development lifecycle: code review, dependency and vulnerability scanning in CI/CD.
• System hardening, patch management, and backups with restore testing.
• Centralised logging, monitoring, and documented incident response.
• Personnel vetting, confidentiality, and security training proportionate to role.
• Sub-processor security assessment before engagement.
• Physical security inherited from AWS data centres.
• Pseudonymisation or aggregation where the engagement allows it.

A SOW may specify additional measures for a particular engagement.

We notify the Client without undue delay, and within 48 hours of becoming aware, of any breach affecting Client data, sharing further detail as it becomes available.

At engagement end, we delete or return personal data at the Client's choice, unless retention is required by law. Transfers outside the UK or EEA rely on adequacy decisions, the UK IDTA, the UK Addendum, or the EU SCCs (Module 2 or 3, as applicable), with transfer risk assessments where required. Where practical, we work within the AWS region the Client specifies.

Where a US state privacy law such as the CCPA applies, Hybytes acts as a service provider: processing personal information only for the purposes in Section 2, not selling or sharing it, and not combining it with data from other sources.

Where the Client is subject to the Australian Privacy Act 1988, Hybytes handles personal information consistently with the Australian Privacy Principles and notifies the Client of an eligible data breach without undue delay.

Liability under this DPA is subject to the limitations in Section 19 of our Terms of Business, except where data protection law does not permit such a limit.