Your HumHub community holds your members' personal data. Here is who is responsible for it, which privacy laws apply, where it is stored, who can read it and how you take it back, in plain words for data-protection officers and decision makers.
New to HumHub? What it is, who it is for and what you can do with it.
Accepted with every subscription, versioned, signed copy on request.
The same agreement covers the UK, Switzerland, Canada and Quebec, California and the other US states.
Germany (EU), the USA or Singapore (APAC): your community and its backups stay there.
Every line of code your community runs can be read and downloaded through read-only SFTP.
No selling, no advertising, no AI, no staff access without your permission.
Export everything at any time; stop early and the remaining days are refunded pro rata.
CUZY's side of the hosting is built for the GDPR, and the Data Processing Agreement applies the same commitments wherever an equivalent law governs your data. Your own obligations under these laws are yours to check, ideally with a lawyer.
| Where, and which law | What the agreement provides |
|---|---|
| European Union and EEA: GDPR | The processor contract of Article 28; transfers under Chapter V |
| United Kingdom: UK GDPR and Data Protection Act 2018 | The same terms, the Information Commissioner as authority, the UK transfer addendum |
| Switzerland: Federal Act on Data Protection (FADP) | The contract its Article 9 requires; transfers under the clauses the Swiss Commissioner recognizes |
| Canada: PIPEDA and provincial laws, Quebec's Law 25 included | A written contract giving comparable protection, notice of any breach, the information Quebec's transfer assessment needs |
| California and other US states: CCPA and comparable state laws | CUZY as your service provider: one business purpose, no selling or sharing, no combining with other data |
Under every one of them CUZY follows your instructions, applies the published security measures, binds its sub-processors by written contracts, notifies you of a breach within 72 hours at the latest, helps you answer your members' requests, opens its practices to audit and deletes the data at the end. Another law applies to you? Ask us.
Hetzner (servers, in your region), Backblaze (encrypted backups, in your region), Cloudflare (DNS), SMTP2GO (community emails), Infomaniak (our support mailboxes, Switzerland), and on Business HumHub GmbH with Google Firebase (push notifications), Google (address geocoding for the map modules) and WhatsApp (the support channel). Each is bound by a written contract with at least the protection of our agreement, and CUZY stays liable for them. You are told at least 30 days before one is added or replaced, and you may then leave with the unused period refunded. The binding list with locations and transfer safeguards is in the Data Processing Agreement and the privacy policy.
A personal data breach affecting your community is notified to you without undue delay and within 72 hours at the latest, with what is known and what was done, so you can inform your authority and your members. For the data CUZY controls, CUZY notifies the Irish Data Protection Commission when required.
CUZY gives you what the GDPR asks of a host: a Data Processing Agreement (Article 28) accepted with every subscription, the data kept in the region you choose, the published security measures, HumHub's own privacy tools (export, erasure, consent) and templates for your legal pages. That does not make your community compliant on its own: you are the controller. Have a lawyer review and adapt the legal pages before you publish them, check whether your country requires you to register with or notify its data protection authority, and name a contact person for privacy (a data protection officer, or a representative in the EU when you are outside it) where the law requires one. The administrator handbook lists the rest of your part.
Yes. The Data Processing Agreement covers the UK GDPR, the Swiss Federal Act on Data Protection, Canada's PIPEDA with Quebec's Law 25, and the California Consumer Privacy Act with the comparable US state laws, under which CUZY is your service provider.
Yes. HumHub, its modules and the CUZY agent are open source. On Team and Business, a read-only SFTP access lets you browse and download the whole installation: 100% of the code your community runs, and its files.
No. CUZY never sells or shares your data, uses it for no purpose of its own, and no AI service processes it.
