Data processing agreement.

1. Subject matter, nature and purpose

2. Instructions

Hunch processes client data only on the documented instructions of the client, as laid down in the contract, this data processing agreement and the settings on the client page. Hunch does not use client data for its own purposes and never shows it to other clients. If Hunch considers that an instruction infringes the GDPR, Hunch informs the client immediately.

3. Confidentiality

Only persons who need the data for the service are given access to it, and they are bound by confidentiality.

4. Security

Hunch takes appropriate technical and organisational measures in accordance with Article 32 GDPR, taking into account the state of the art, the costs and the risks, including encryption, access control and keeping each client’s data separate. A description of the measures is available on request, subject to confidentiality.

5. Sub-processors

The client gives Hunch general authorisation to engage sub-processors. The categories of sub-processors are listed in section 7 of the privacy policy; the current list is available on request. Hunch imposes on them the same obligations as in this agreement and remains responsible for them towards the client. Hunch gives prior notice by email of any new or replacement sub-processor. The client may raise a reasoned objection within fourteen days; if the parties do not reach a solution, the client may terminate the contract, which is its sole remedy.

Transfers outside the European Economic Area take place only with an appropriate safeguard under Chapter V GDPR, such as an adequacy decision or the standard contractual clauses of the European Commission.

6. Assistance

Taking into account the nature of the processing, Hunch assists the client in responding to requests from data subjects, with security, with notifying breaches and with any data protection impact assessment. If Hunch receives a request directly from a data subject concerning client data, Hunch forwards it to the client.

7. Breaches

Hunch notifies any breach relating to client data without undue delay after Hunch becomes aware of it, with the information available at that time that the client needs to make its own notification, and takes reasonable measures to limit the consequences.

8. End

After the end of the contract, Hunch provides the client, if it so requests within thirty days, with an export of its client data in a commonly used format. Hunch then deletes the client data within a reasonable period, unless a legal retention obligation applies. Backups are deleted in accordance with their normal cycle.

9. Audits

Hunch makes available the information reasonably necessary to demonstrate compliance with these obligations, primarily through documentation and written answers. If that is not sufficient, Hunch cooperates with an audit by an independent auditor bound by confidentiality, no more than once a year, subject to at least thirty days’ notice, without disrupting operations and at the client’s expense.

10. Other

Liability under this data processing agreement follows Article 15 of the general terms and conditions, insofar as the GDPR permits. In the event of any conflict, this data processing agreement takes precedence over the general terms and conditions as regards the processing of client data.