Data Processing Agreement of CUZY Hosting

Data Processing Agreement, version 1.2, effective 28 October 2026. Part of the contract between CUZY, 80 St. Columbanus Road, Dundrum, Dublin 14, D14 WP98, Ireland ("CUZY", the processor) and the customer who subscribes to CUZY Hosting (the "Customer", the controller), under Article 28 of the GDPR. The terms of service and the privacy policy apply; where they differ from this agreement on the processing of personal data, this agreement prevails. Terms such as "personal data", "processing", "data subject", "sub-processor" and "personal data breach" have the meaning the GDPR gives them. For a Customer subject to the Swiss Federal Act on Data Protection (FADP), this agreement also serves as the contract its Article 9 requires, and every reference to the GDPR includes the FADP where it applies; section 14 covers the United Kingdom, Canada and the United States.

1. What is processed

• Subject and purpose: hosting, backing up, updating, monitoring and supporting the HumHub community the Customer administers, so that the Customer's members can use it.
• Nature: storage, backup, transmission, display, restore and deletion of the community's data, continuously for as long as the community exists; CUZY reads it only in the cases of section 4.
• Data: whatever the Customer and the members put in the community: profile data (name, email address, picture, profile fields), posts, comments, messages, files, calendar entries, log entries of the community (logins, actions), and any special categories the Customer chooses to collect; CUZY does not decide what they are.
• People concerned: the members of the community and the people they write about.
• Duration: the life of the subscription, plus the retention of section 10.

2. Instructions

CUZY processes the data only on the Customer's documented instructions. The instructions are: this agreement, the terms, the settings the Customer makes in the community and in the customer account, and the support requests the Customer sends. CUZY informs the Customer immediately when, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection law, and may wait for its confirmation before following it. CUZY may process the data to comply with a legal obligation of EU or Irish law; it then tells the Customer first unless that law forbids it on important grounds of public interest.

3. The Customer's responsibilities

The Customer decides what the community is for and who joins it. It has a lawful basis for what it and its members put in the community, informs its members (the community's own legal pages, written from CUZY's templates, are the usual place), answers their requests with the help of section 9, and gives only lawful instructions. When the community holds special categories of data, the Customer chooses the region, the plan and the settings that suit them.

4. Confidentiality and access

The people CUZY authorises to access the data are bound to confidentiality, a duty that lasts beyond the end of their work for CUZY and of this agreement. CUZY accesses a community only for support at the Customer's request, to investigate an incident, or when required by law. Every staff login to the community is recorded in the community's audit log, visible to its administrators; every other staff action on it (a restore, an upgrade, a command, a reading of its logs) is recorded in CUZY's own event log, which the Customer obtains on request. CUZY uses the data for no purpose of its own and never sells or shares it.

5. Security

CUZY applies the measures published on cuzy.app/security, which the Customer has read and accepts as appropriate under Article 32: one isolated environment per community, encryption in transit and of every backup, least-privilege access with two-factor authentication for staff, monitoring, tested restores, a documented incident process. CUZY may change a measure when the new one gives at least the same protection. The page, as it stands on the day the Customer accepts this agreement, is the Customer's annex of technical and organisational measures; CUZY keeps every earlier version of the page and sends it on request.

6. Sub-processors

The Customer authorises the sub-processors below. Before CUZY adds or replaces one it notifies every Customer by email and on the privacy policy page at least 30 days ahead; a Customer who objects within those 30 days may terminate the hosting subscription without penalty, with the unused period refunded.

Each sub-processor is bound by a written contract that gives the data at least the protection of this agreement, and CUZY remains fully liable to the Customer for its sub-processors' work. On request, CUZY shows the data protection terms of a sub-processor, commercial details removed. The external uptime monitor (StatusCake Ltd, United Kingdom) sees hostnames only and processes no personal data. No AI service processes the Customer's data: the support assistant is switched off (9 October 2026).

7. International transfers

Data stays in the region the Customer chose. For a region outside the EU, and for the backups of Singapore communities, the transfer rests on Chapter V of the GDPR: an adequacy decision or the European Commission's Standard Contractual Clauses (processor to sub-processor) between CUZY or its sub-processor and the recipient, as listed above, or the safeguards of the sub-processor's own data processing agreement, with the encryption of section 5 as a supplementary measure. For a Customer established outside the EU and the EEA, the Standard Contractual Clauses, module four (processor to controller), apply between CUZY and the Customer to the extent the GDPR applies to CUZY's processing. CUZY makes its assessment of a transfer available on request. CUZY does not transfer data elsewhere without the Customer's instruction. For a Customer under the FADP, a transfer outside Switzerland and the EU rests on the same clauses, which the Swiss Federal Data Protection and Information Commissioner recognises with the adaptations it requires.

8. Requests from public authorities

CUZY discloses data to a public authority only when a binding legal order requires it. It then tells the Customer first unless the law forbids it, checks the order's legality and contests it when there are reasonable grounds, and discloses the minimum the order requires. CUZY tells the Customer of any inquiry, inspection or audit by an authority about the processing, where the law allows. CUZY has built no means for anyone to reach the data outside these procedures.

9. Assistance to the Customer

CUZY helps the Customer answer members' requests (access, rectification, erasure, portability, restriction, objection) with the tools of the community and, where those do not suffice, by support within ten business days. A request a member sends to CUZY directly is passed to the Customer without undue delay and is not answered by CUZY unless the Customer asks it to. CUZY helps with the security obligations, data protection impact assessments and prior consultations with the information it holds, and cooperates with the supervisory authorities. Assistance beyond what the tools and the plan's support include is charged at the published hourly rate, agreed in writing first.

10. Return and deletion

• During the subscription the Customer downloads a complete export of the community (database and files) from the customer account at any time, once per 24 hours.
• When the subscription ends, the community is archived about 30 days after the end date (unreachable, data kept, export still available on request) and deleted with its backups at the latest 6 months after that date. The Customer may ask for earlier deletion at any time: CUZY deletes the live data and the backups within 30 days of the request, and the backup provider's recovery copies expire 30 days later. The Customer may ask for an export before it. This retention exists so that a Customer can return after a lapse; it is the only purpose.
• Trial communities are deleted 28 days after the trial ends and are never backed up.
• Deletion covers the live data and every backup; prior file versions kept by the backup provider for recovery expire 30 days later. After that nothing remains, except what CUZY must keep by law (invoices, six years). On request CUZY confirms the deletion in writing.

11. Personal data breach

CUZY notifies the Customer without undue delay, and at the latest within 72 hours after becoming aware of a personal data breach affecting the Customer's data, by email to the account address, with what is known: nature, data and people concerned, likely consequences, measures taken, a contact. The information may come in phases. CUZY takes the measures to contain the breach and limit its effects, and helps the Customer inform the members when the Customer decides to. The Customer remains responsible for the notifications to the supervisory authority and to the members.

12. Audit

On request, at most once a year unless a breach or an authority requires it, CUZY provides the information needed to show compliance with this agreement: the published security page, the list of sub-processors, the results of the last restore test, the certifications of the sub-processors, answers to a written questionnaire. An on-site audit by the Customer or an auditor bound to confidentiality is possible with 30 days' notice, during business hours, at the Customer's cost, without access to other customers' data. CUZY also submits to the inspections of a competent supervisory authority.

13. When CUZY cannot comply

CUZY tells the Customer promptly if it can no longer meet an obligation of this agreement, or if a change in the law is likely to prevent it. The Customer may then suspend the processing concerned and, if compliance is not restored within a month, terminate the hosting subscription without penalty, with the unused period refunded.

14. Other privacy laws

When another privacy law governs the Customer's data, CUZY meets its processor obligations under the same terms:

• United Kingdom (UK GDPR and Data Protection Act 2018): every reference to the GDPR includes the UK GDPR and to the supervisory authority the Information Commissioner. A transfer from the United Kingdom outside the UK and the EU rests on the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner, on the UK Extension to the EU-US Data Privacy Framework, or on a UK adequacy regulation.
• Canada (PIPEDA and the provincial laws, Quebec's Law 25 included): this agreement is the written contract that gives the data a comparable level of protection. CUZY uses the data only for the service, protects it as section 5 says, tells the Customer without delay of any violation or attempted violation of the confidentiality of the data and of any breach as section 11 says, lets the Customer verify compliance as section 12 says, and deletes the data as section 10 says. Before data leaves Quebec, the Customer carries out the assessment Quebec law requires; CUZY gives it the information it needs.
• United States (the California Consumer Privacy Act and the comparable state laws): CUZY acts as the Customer's service provider or processor. The Customer discloses the data to CUZY only for the limited and specified business purpose of section 1 (hosting, backing up, updating, monitoring and supporting the Customer's community), and CUZY processes it only for that purpose. CUZY does not sell or share it, nor retain, use or disclose it for any other purpose or outside its direct business relationship with the Customer; does not combine it with personal information from other sources, except as those laws allow a service provider to; complies with all applicable sections of those laws and their regulations and gives the data the same level of privacy protection they require of the Customer; helps the Customer answer consumer requests as section 9 says; and tells the Customer if it can no longer meet these obligations. The Customer may take reasonable and appropriate steps to ensure that CUZY uses the data consistently with the Customer's obligations, including the audit of section 12, and, upon notice, reasonable and appropriate steps to stop and remediate any unauthorized use, including those of section 13. CUZY certifies that it understands and will comply with these restrictions.

15. Term, liability, law, signed copy

This agreement lasts as long as CUZY processes the data for the Customer; sections 4, 8, 10 and 11 apply until the last copy of the data is deleted. Liability follows the terms of service; nothing in this agreement limits what the GDPR makes the parties liable for. Irish law applies; the courts of Dublin have jurisdiction, without prejudice to the GDPR's rules on the competent supervisory authority. Accepting these terms at checkout concludes this agreement; a Customer who needs a signed copy for its records asks at contact@cuzy.app and receives this text with its name and both signatures, unchanged. Notices about this agreement go to that address, and to the Customer's account address; a personal data breach is reported to CUZY at security@cuzy.app.