Introduction
This Data Processing Agreement ("DPA") applies where Hyonix processes personal data on behalf of a customer in the course of providing the Services. It sets out the terms required by Article 28 of the General Data Protection Regulation (GDPR), the sub-processors engaged by Hyonix, and the technical and organisational measures Hyonix applies.
This document should be read in conjunction with our:
If you have any questions about this DPA, please contact us at [email protected].
1. Scope and Application
1.1 This DPA forms part of the agreement between Krixe Pte. Ltd., trading as Hyonix ("Hyonix", "we"), and the customer ("Customer", "you") for the provision of the Services (the "Agreement").
1.2 This DPA applies only where, and to the extent that, Customer Data contains personal data processed by Hyonix on behalf of the Customer, and only to the extent that such processing is subject to Data Protection Laws.
1.3 Where this DPA conflicts with any other document forming part of the Agreement, this DPA prevails in respect of the processing of personal data. In all other respects, the order of precedence in Section 1.2 of the Terms of Service applies.
1.4 No signature is required. This DPA is accepted in the same manner as the Terms of Service, as set out in Section 1.3 of those Terms. Where the Customer requires an executed copy for its records, Hyonix may provide one on request; execution does not vary these terms.
2. Definitions
Terms defined in the Terms of Service have the same meaning in this DPA. In addition:
- Customer Data: the applications, files, data, information and other content stored, hosted, transmitted or processed within the Services under the Customer's account.
- Data Protection Laws: the data protection and privacy laws applicable to the processing of Relevant Personal Data under this DPA, including Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the Singapore Personal Data Protection Act 2012 ("PDPA"), in each case where applicable.
- End-Customer: a client of the Customer on whose behalf the Customer processes personal data, in which case the Customer acts as processor and Hyonix acts as sub-processor.
- Relevant Personal Data: personal data controlled by the Customer, or where applicable an End-Customer, and processed by Hyonix on the Customer's behalf under the Agreement.
- Security Incident: a breach of security attributable to an act or omission of Hyonix leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Relevant Personal Data.
- Standard Contractual Clauses (SCCs): the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
- Sub-processor: a third party engaged by Hyonix to process Relevant Personal Data on Hyonix's behalf.
- Supervisory Authority: an independent public authority responsible for the enforcement of Data Protection Laws.
The terms "personal data", "processing", "controller", "processor" and "data subject" have the meanings given to them in the GDPR.
3. Roles and Details of Processing
3.1 Roles
In respect of Relevant Personal Data, the Customer acts as controller, or as processor on behalf of an End-Customer, and Hyonix acts as processor or sub-processor as applicable.
3.2 Details of Processing
For the purposes of Article 28(3) GDPR:
| Item | Detail |
|---|---|
| Subject matter | The provision of the Services under the Agreement. |
| Duration | For as long as the Customer uses the Services in a manner that involves the processing of Relevant Personal Data, and thereafter only as required by applicable law. |
| Purpose | The provision, maintenance, security and support of the Services ordered by the Customer. |
| Nature of processing | Hosting, storage, transmission, and such other operations as are technically necessary to provide the Services. Hyonix does not access the contents of the Customer's virtual machines or storage volumes in the ordinary course. |
| Type of personal data | Determined solely by the Customer. The Customer decides what data it places within the Services. Hyonix neither specifies nor controls it. |
| Categories of data subjects | Determined solely by the Customer, and may include the Customer's or an End-Customer's employees, contractors, suppliers, customers, users and other individuals. |
3.3 Data Processed by Hyonix as Controller
Hyonix also processes certain personal data as controller, including account holder and contact details, billing and payment data, support correspondence, access logs, and fraud prevention signals. That processing falls outside this DPA and is described in our Privacy Policy.
3.4 Nature of the Services
The Services are provided on an unmanaged basis, as defined in the Terms of Service. The Customer alone administers the operating system, applications, access credentials, and any encryption applied within the virtual machine. The Customer acknowledges that Hyonix has no visibility into, and no obligation to inspect, the contents of Customer Data.
4. Customer Obligations
4.1 The Customer warrants that it complies, and will continue to comply, with Data Protection Laws in respect of Relevant Personal Data, including as to lawful basis, transparency, accuracy, and the rights of data subjects.
4.2 The Customer is responsible for ensuring that it is entitled to disclose Relevant Personal Data to Hyonix and to instruct the processing described in this DPA.
4.3 The Customer is responsible for the security of its own environment, including operating system configuration and patching, application security, credential management, access control, encryption of Customer Data within the virtual machine, and the taking and retention of backups outside the Services in accordance with Section 5.4 of the Terms of Service.
4.4 The Customer acknowledges that, given the unmanaged nature of the Services, Hyonix cannot verify and has no obligation to verify what categories of personal data the Customer places within the Services.
5. Hyonix Obligations and Instructions
5.1 Hyonix will process Relevant Personal Data only in accordance with (i) Data Protection Laws, (ii) this DPA, (iii) the Agreement, and (iv) the Customer's documented instructions.
5.2 The Customer's instructions are constituted by this DPA and the Agreement, together with the Customer's own use and configuration of the Services. Further instructions outside this DPA may be given only where they relate to (a) a change in Data Protection Laws or guidance issued by a Supervisory Authority or the European Data Protection Board, or (b) an order of a competent court or authority. Any other instruction requires Hyonix's written agreement and may be subject to additional charges.
5.3 Hyonix will not process Relevant Personal Data for any purpose other than the provision of the Services, and will not disclose Relevant Personal Data to any third party except as permitted by this DPA or where required by applicable law or the order of a competent authority. Where and to the extent legally permitted, Hyonix will inform the Customer before making such a disclosure. Hyonix may withhold or delay such notice where prohibited by law or by the terms of the order concerned.
5.4 Hyonix is not required to verify whether the Customer's instructions comply with Data Protection Laws; that responsibility rests with the Customer. If Hyonix nonetheless forms the view that an instruction infringes Data Protection Laws, it will inform the Customer.
6. Personnel
6.1 All operations relating to Relevant Personal Data are performed by Krixe Pte. Ltd. personnel acting under Hyonix's authority.
6.2 Hyonix will ensure that personnel authorised to process Relevant Personal Data are subject to an appropriate duty of confidentiality, whether contractual or statutory, and receive appropriate guidance on the handling of personal data.
6.3 Access to systems capable of reaching Relevant Personal Data is limited to personnel who require it for the provision, maintenance or security of the Services.
7. Security
7.1 Hyonix will implement and maintain appropriate technical and organisational measures to protect Relevant Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, together with the risks to data subjects.
7.2 The measures in force are set out in Annex A to this DPA. Hyonix may update those measures from time to time provided that the overall level of protection is not materially reduced.
7.3 The measures in Annex A apply to the infrastructure operated by Hyonix. Security within the Customer's operating system, applications and account credentials remains the Customer's responsibility under clause 4.3.
8. Sub-processors
8.1 The Customer grants Hyonix a general authorisation to engage Sub-processors for the provision of the Services.
8.2 The Sub-processors currently engaged by Hyonix are listed in Annex B to this DPA. Annex B forms Annex III to the Standard Contractual Clauses where those clauses apply.
8.3 Hyonix will impose on each Sub-processor data protection obligations substantially equivalent to those set out in this DPA, and remains liable to the Customer for the performance of its Sub-processors.
8.4 Hyonix will give the Customer at least thirty (30) days' advance notice of the addition or replacement of a Sub-processor, by updating Annex B and by notice to the contact address recorded on the Customer's account. The Customer may object on reasonable data protection grounds within that period. Where an objection is made, the parties will discuss in good faith whether an alternative arrangement is available. If none is found within a reasonable period, the Customer's sole remedy is to terminate the affected Services without further liability.
8.5 Persons acting under Hyonix's authority in the course of their employment or engagement by Krixe Pte. Ltd. are not Sub-processors for the purposes of this clause.
9. International Transfers
9.1 Hyonix is established in Singapore. Relevant Personal Data is processed at the data centre location selected by the Customer, and Hyonix will not relocate Relevant Personal Data to a different country without the Customer's instruction or notice to the Customer, save where required by applicable law. Requests by the Customer to redeploy a service to a different location are subject to Section 6.6 of the Terms of Service.
9.2 Where and to the extent that the processing of Relevant Personal Data under this DPA constitutes a restricted transfer under Chapter V of the GDPR, the Standard Contractual Clauses are incorporated into this DPA by reference and apply between the Customer as data exporter and Krixe Pte. Ltd. as data importer, on the following basis:
- Module Two (controller to processor) applies where the Customer acts as controller. Module Three (processor to processor) applies where the Customer acts as processor on behalf of an End-Customer.
- The optional docking clause in Clause 7 applies.
- In Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in clause 8.4 of this DPA.
- The optional wording in Clause 11(a) concerning independent dispute resolution does not apply.
- In Clause 17, the governing law is the law of Ireland.
- In Clause 18(b), the forum is the courts of Ireland.
- Annex I is populated by clause 3.2 of this DPA, with the Customer as exporter and Krixe Pte. Ltd. as importer, and the contact details of each party as recorded in the Customer's account and in the Hyonix Privacy Policy respectively.
- Annex II is populated by Annex A to this DPA.
- Annex III is populated by Annex B to this DPA.
9.3 Where the transfer is subject to the UK GDPR, the International Data Transfer Addendum issued by the Information Commissioner applies to the Standard Contractual Clauses. Where the transfer is subject to Swiss law, the Standard Contractual Clauses apply with the amendments required by the Federal Data Protection and Information Commissioner.
9.4 Where an alternative transfer mechanism recognised under Data Protection Laws becomes available and is adopted by Hyonix, that mechanism applies in place of the Standard Contractual Clauses to the extent it covers the transfer.
10. Assistance
10.1 Data subject requests. The Customer is responsible for responding to requests from data subjects in respect of Relevant Personal Data, and has continuous administrative access to its own environment for that purpose. Where Hyonix receives a request relating to Relevant Personal Data, it will not respond to it directly and will forward it to the Customer without undue delay, unless legally required to respond.
10.2 Other assistance. Taking into account the nature of the processing and the information available to it, Hyonix will provide the Customer with reasonable assistance in relation to data protection impact assessments, prior consultations with a Supervisory Authority, and the preparation of breach notifications.
10.3 Assistance beyond the provision of information already available to Hyonix, or beyond that which is required by Data Protection Laws, may be subject to a reasonable charge notified to the Customer in advance.
11. Security Incidents
11.1 Hyonix will notify the Customer without undue delay after becoming aware of a Security Incident affecting Relevant Personal Data.
11.2 The notification will, to the extent the information is available, describe the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed in response, and a contact point for further information. Where information is not available at the time of notification, it will be provided in stages as it becomes available.
11.3 Notification will be sent to the contact address recorded on the Customer's account. The Customer is responsible for keeping that address current.
11.4 Hyonix will take reasonable steps to assist the Customer in investigating and mitigating a Security Incident. Notification is not an admission of fault or liability by Hyonix.
11.5 This clause does not apply to incidents arising from the Customer's own operating system, applications, configuration or credentials, which fall within the Customer's responsibility under clause 4.3.
12. Information and Audits
12.1 On written request submitted through the Control Panel, and no more than once in any twelve (12) month period, Hyonix will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. Hyonix may satisfy this obligation by providing a completed security questionnaire, a summary of the measures in Annex A, or a third-party certification or audit report where one is held.
12.2 Where the information provided under clause 12.1 is demonstrably insufficient to establish compliance, and the Customer is required by a Supervisory Authority to conduct a further audit, Hyonix will allow an audit subject to all of the following:
- at least thirty (30) days' written notice;
- no more than one audit in any twelve (12) month period;
- conduct during Hyonix's normal business hours (UTC+8) and in a manner that does not disrupt its operations;
- scope limited to systems, records and processes relating to the Relevant Personal Data of the requesting Customer;
- no access to the data, systems or premises of any other customer, and no access to information that would compromise the security of other customers;
- where the audit may expose confidential or proprietary information, conduct by an independent third-party auditor approved by Hyonix, such approval not to be unreasonably withheld, and bound by confidentiality obligations acceptable to Hyonix;
- all costs borne by the Customer, including reasonable compensation for Hyonix's time and resources.
12.3 Where the Standard Contractual Clauses apply, this clause 12 constitutes the parties' agreement on the audit and information rights under Clause 8.9 of those clauses.
13. Retrieval, Deletion and Return
13.1 Customer access. Throughout the term of the Agreement the Customer has continuous administrative access to its own virtual machines and storage, and may retrieve, copy or export Relevant Personal Data at any time using its own tools and methods. That access constitutes the means by which Relevant Personal Data is made available to the Customer, and discharges any obligation on Hyonix to return Relevant Personal Data.
13.2 No obligation to produce copies. Hyonix is not obliged to produce, extract, transmit or otherwise deliver disk images, storage volumes, snapshots, or copies of Customer Data to the Customer or to any third party. Where Hyonix agrees to assist with data export, it does so at its discretion and subject to the fees described in Section 11.4 of the Terms of Service.
13.3 Deletion during the term. The Customer may delete Relevant Personal Data at any time within its own environment. Requests relating to a specific service must be submitted through the Control Panel at https://my.hyonix.com. Requests made through other channels, including chat platforms, will not be actioned.
13.4 Deletion on cancellation or termination. On cancellation or termination of a service, all related data and backups are destroyed and associated IP addresses released, in accordance with Sections 6.3.3 and 6.5.1 of the Terms of Service. This process cannot be reversed. The Customer is responsible for retrieving any data it requires before submitting a cancellation request.
13.5 Retention. Retention of personal data held by Hyonix as controller following account closure is governed by Section 9.3 of the Privacy Policy. Hyonix may retain Relevant Personal Data where required by applicable law or the order of a competent authority.
13.6 Service transfers. Where the Customer requests the transfer of a service to another customer under Section 6.2 of the Terms of Service, data on that service is retained as it is and becomes accessible to the receiving customer. Such a request constitutes the Customer's documented instruction to Hyonix for that purpose. The Customer is responsible for removing any Relevant Personal Data from the service before the transfer is completed, and for establishing any legal basis required for the transfer. Hyonix does not inspect the contents of a transferred service.
14. Liability
14.1 Each party's liability to data subjects and in respect of administrative fines is determined in accordance with Articles 82 and 83 GDPR, or the corresponding provisions of applicable Data Protection Laws.
14.2 As between the parties, liability for breach of this DPA is subject to the limitations and exclusions of liability set out in Section 5 of the Terms of Service.
15. Term
This DPA takes effect on acceptance of the Agreement and continues until Hyonix ceases to process Relevant Personal Data, at which point it expires automatically. Clauses that by their nature should survive, including clauses 13 and 14, survive expiry.
16. Changes to this DPA
16.1 We reserve the right to update this DPA, including Annex A and Annex B, at any time. Except as set out in clauses 16.2 and 16.3, changes will be effective immediately upon posting to our website. It is your responsibility to review this DPA periodically for updates. The "Last Updated" date at the top of this page indicates the latest revision.
16.2 The addition or replacement of a Sub-processor in Annex B is subject to the advance notice and objection process in clause 8.4.
16.3 Where an amendment materially and adversely affects the Customer, Hyonix will give at least thirty (30) days' notice before it takes effect, and the Customer may terminate the affected Services within that period without further liability. Amendments required by a change in law may take effect without advance notice.
16.4 No amendment will reduce the level of protection afforded to Relevant Personal Data below that required by Data Protection Laws. Where the Standard Contractual Clauses apply, the Clauses themselves are not varied by any amendment to this DPA.
17. Application of the Singapore Personal Data Protection Act
17.1 Krixe Pte. Ltd. is an organisation established in Singapore and is subject to the Personal Data Protection Act 2012 ("PDPA"), in addition to any other Data Protection Laws that apply to a given processing activity.
17.2 Where the PDPA applies to the processing of Relevant Personal Data, the following terms correspond:
| Term used in this DPA | Equivalent under the PDPA |
|---|---|
| Controller | Organisation |
| Processor | Data intermediary |
| Data subject | Individual |
| Personal data | Personal data |
| Supervisory Authority | Personal Data Protection Commission (PDPC) |
| Security Incident | Data breach |
17.3 Where Hyonix acts as a data intermediary under the PDPA, its obligations in that capacity are the Protection Obligation and the Retention Limitation Obligation, together with the obligation to notify the Customer without undue delay upon becoming aware of a data breach affecting personal data processed on the Customer's behalf. Clause 11 of this DPA gives effect to that notification obligation.
17.4 The remaining obligations under the PDPA in respect of Relevant Personal Data, including those relating to consent, notification, purpose limitation, accuracy, access and correction, and the assessment and reporting of notifiable data breaches to the PDPC and to affected individuals, rest with the Customer as the organisation. Where the Customer is not itself subject to the PDPA, the Customer remains responsible for the equivalent obligations under the Data Protection Laws applicable to it.
17.5 Where Hyonix transfers personal data out of Singapore in the course of providing the Services, it will do so in a manner consistent with the Transfer Limitation Obligation under the PDPA. The arrangements described in clause 9 support that requirement.
17.6 Hyonix has designated a Data Protection Officer in accordance with the PDPA, contactable at [email protected].
17.7 Nothing in this DPA requires Hyonix to act inconsistently with the PDPA or with any other law applicable to it in Singapore. Where a conflict arises between this DPA and a mandatory requirement of Singapore law, Hyonix will inform the Customer in accordance with clause 5.3 to the extent legally permitted.
Annex A — Technical and Organisational Measures
The following measures are implemented by Hyonix in respect of the infrastructure it operates. They correspond to Annex II of the Standard Contractual Clauses where those clauses apply. Security within the Customer's operating system, applications and credentials remains the Customer's responsibility under clause 4.3.
| Measure | Description |
|---|---|
| Access control | Access to infrastructure and management systems is limited to authorised Hyonix personnel on a need-to-know basis. Administrative access requires individual authentication and multi-factor authentication. |
| Encryption in transit | Connections to the Hyonix website, Control Panel and management interfaces are protected using TLS. |
| Encryption at rest | Encryption is applied to sensitive data held in Hyonix systems where appropriate. Encryption of data within the Customer's virtual machine is configured and controlled by the Customer. |
| Network security | Firewalling, network segmentation and filtering are applied at the infrastructure layer. Management networks are separated from customer-facing networks. |
| Tenant separation | Each service is provisioned as a dedicated virtual machine with its own virtual storage volume and virtual network interface. Virtual machines are logically isolated from one another at the hypervisor layer. Underlying physical network capacity and connectivity are shared between virtual machines on the same host and network segment. |
| Physical security | Infrastructure is housed in data centre facilities with controlled physical access, monitoring, and environmental protection appropriate to their function. |
| Monitoring and logging | Administrative access and infrastructure events are logged. Operational logs are retained in accordance with Section 9.1 of the Privacy Policy. |
| Vulnerability and patch management | Hyonix-operated systems and hypervisor infrastructure are maintained and patched on an ongoing basis. Patching within the Customer's virtual machine is the Customer's responsibility. |
| Availability and resilience | Infrastructure is operated with redundancy appropriate to the Services. Customers are responsible for maintaining independent backups in accordance with Section 5.4 of the Terms of Service. |
| Incident response | Documented procedures are in place for the identification, escalation and handling of security incidents, including notification under clause 11. |
| Personnel | Personnel with access to systems capable of reaching Customer Data are subject to confidentiality obligations and receive guidance on data protection. |
| Secure disposal | On cancellation or termination, service data and associated backups are destroyed in accordance with Sections 6.3.3 and 6.5.1 of the Terms of Service. Storage media are securely wiped or destroyed before reuse or disposal. |
| Governance | Security policies are reviewed periodically. Data protection enquiries are handled by the contacts listed in Section 1 of the Privacy Policy. |
Annex B — Sub-processors
This Annex corresponds to Annex III of the Standard Contractual Clauses where those clauses apply.
Hyonix currently engages no Sub-processors in respect of Customer Data. All operations relating to Customer Data, including provisioning, maintenance, migration and security response, are performed by Krixe Pte. Ltd. personnel acting under Hyonix's authority. Such personnel are not Sub-processors, as set out in clause 8.5.
| Entity | Country | Role | Access to Customer Data |
|---|---|---|---|
| None | — | — | — |
Hyonix contracts with data centre facility providers for space, power, connectivity and physical hosting. Those providers have physical access to hardware but no logical access to Customer systems or Customer Data, and are not engaged to process Relevant Personal Data on Hyonix's behalf.
The parties Hyonix engages in respect of personal data it processes as controller, including payment processors and fraud prevention services, are listed in Section 6.2 of the Privacy Policy. Those parties are not Sub-processors under this DPA.
Where a Sub-processor is engaged in future, this Annex will be updated and notice given in accordance with clause 8.4.