This Data Processing Addendum (DPA) forms part of the agreement between Hexel Studio and the customer and governs the processing of personal data.
This document is a working draft and will be reviewed by counsel before Hexel Studio launches. It is not legal advice.
Legal documents
1.Roles of the parties
For personal data processed via the Services, the customer is the data controller and Hexel Studio is the data processor. Hexel Studio processes data only on documented instructions from the customer.
2.Scope of processing
Hexel Studio processes personal data to provide the Services, including control, governance, tool execution, data services, and observability of AI agents, for the duration of the agreement.
3.Confidentiality
Personnel authorized to process personal data are bound by appropriate confidentiality obligations.
4.Security measures
Hexel Studio maintains technical and organizational measures including encryption, access controls, isolation, and continuous monitoring, as described in our Security overview.
5.Sub-processors
The customer authorizes Hexel Studio to engage sub-processors listed on our sub-processors page. Hexel Studio imposes data-protection obligations on each sub-processor.
6.Data subject requests
Hexel Studio assists the customer, where reasonably possible, in responding to requests from data subjects to exercise their rights.
7.International transfers
Where personal data is transferred internationally, the parties rely on appropriate safeguards such as standard contractual clauses.
8.Deletion and return
Upon termination, Hexel Studio deletes or returns personal data in accordance with the agreement, subject to legal retention requirements.