This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between you (the "Customer", acting as Data Controller / Data Fiduciary) and Hayanlabs (acting as Data Processor / Data Fiduciary's agent, where applicable). It applies to the limited extent that Hayanlabs processes Personal Data on behalf of the Customer in connection with StackPilot App.
Scope
StackPilot App is a desktop application installed on the Customer's own computer. The Customer's deployment data, server credentials, command history, and infrastructure data are not transmitted to Hayanlabs. As a result, the volume of Personal Data Hayanlabs processes on behalf of the Customer is intentionally minimal and limited to:
- Licence-validation data (IP address, device identifier of the Customer's seat users) used solely to enforce seat / device limits;
- Account contact data (Customer's billing email, account holder name) used to administer the contract;
- Support communications voluntarily provided by Customer's seat users.
For the avoidance of doubt: Hayanlabs is an independent Data Controller for billing data, marketing-site analytics, and similar processing carried out for its own purposes; the GDPR Art. 28 / DPDPA Section 8 obligations below apply only where Hayanlabs is acting as Processor / agent for the Customer.
Subject Matter, Duration, Nature & Purpose
- Subject matter: the provision of StackPilot App under the Terms and EULA.
- Duration: for the term of the Customer's licence plus the retention periods set out in our Privacy Policy.
- Nature & purpose: licence enforcement, billing, and customer support.
- Categories of data subjects: the Customer's employees, contractors, or other users assigned to a seat.
- Categories of personal data: name, work email, IP address, device identifier.
Processor Obligations
Where Hayanlabs acts as Processor, Hayanlabs will:
- Process Personal Data only on documented instructions from the Customer, including those set out in the Terms and EULA;
- Ensure that personnel authorised to process Personal Data are bound by confidentiality;
- Implement appropriate technical and organisational measures, including those described in our Security page;
- Assist the Customer, taking into account the nature of processing, to respond to data-subject requests (access, rectification, erasure, portability, restriction, objection);
- Notify the Customer without undue delay (and in any event within 72 hours of becoming aware) of a Personal Data breach;
- At the Customer's choice, delete or return all Personal Data after the end of the provision of services, except where retention is required by law;
- Make available to the Customer information necessary to demonstrate compliance with these obligations.
Sub-processors
The Customer authorises Hayanlabs to engage the Sub-processors listed on our Sub-processors page. Hayanlabs will: (a) impose data-protection obligations on each Sub-processor that are substantially equivalent to those in this DPA; (b) remain liable for the acts and omissions of its Sub-processors; (c) give the Customer at least 30 days' notice of any new Sub-processor by updating the Sub-processors page (subscribe via privacy@stackpilotapp.com). The Customer may object on reasonable data-protection grounds; if the Customer and Hayanlabs cannot agree on a resolution, the Customer may terminate the affected services without penalty.
International Transfers
Where Personal Data is transferred from the EU/EEA, UK, Switzerland, or other restricted jurisdictions to Hayanlabs in India or to a Sub-processor outside that jurisdiction, the parties rely on the European Commission's Standard Contractual Clauses (Module 2 - Controller to Processor) and the UK International Data Transfer Addendum, which are incorporated by reference into this DPA. A signed copy of the relevant SCCs is available on request from privacy@stackpilotapp.com.
For transfers governed by India's DPDPA, transfers are made in compliance with applicable government notifications.
Audits
On reasonable prior written request and no more than once per year (except following a Personal Data breach), Hayanlabs will respond to a reasonable, non-burdensome questionnaire from the Customer to demonstrate compliance with this DPA. On-site audits are by mutual agreement and at the Customer's cost.
Liability
The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms.
Order of Precedence
In case of conflict between this DPA and the Terms, this DPA prevails on data-protection matters within its scope; the Terms prevail otherwise.
Execution
This DPA takes effect automatically when the Customer accepts the Terms. A countersigned PDF version, customised for enterprise procurement, is available on request from privacy@stackpilotapp.com.