Data Processing Addendum

For the personal data you put into Designhive - the content of your site and documents, your data tables, your customers’ enquiries and anything else you choose to store - you are the controller and we are the processor. We process that data only to provide the service and only on your documented instructions, which include your use of the product’s features.

For data about your own account and billing we are the controller, and our Privacy Policy applies.

• Subject matter: providing the Designhive platform - hosting, editing, publishing, AI generation, documents, galleries and integrations.
• Duration: for as long as your account is open, and for the short period afterwards during which backups expire.
• Categories of data subject: your staff and members, your customers and website visitors, and anybody named in content you upload.
• Categories of personal data: contact details, account identifiers, content you supply, enquiry and form submissions, and technical data such as IP addresses.
• Special category data: not requested by the service. Do not upload it unless you have a lawful basis, and tell us first if you intend to.

• We process personal data only on your instructions, unless the law requires otherwise - in which case we will tell you, unless the law forbids it.
• People who handle personal data for us are bound by confidentiality.
• We keep appropriate technical and organisational measures, described below.
• We do not use your content to train AI models, and we do not sell it.
• We help you respond to data subject requests and, taking account of what we know, with your impact assessments and consultations.
• We tell you without undue delay if we become aware of a personal data breach affecting your data, with the detail you need to meet your own obligations.

• Encryption in transit, and encryption at rest by our hosting providers.
• Each project's data separated inside the database, with access through the application rather than directly.
• Access to production limited to staff who need it, with individual accounts.
• Logging of requests, and monitoring for abuse and unusual usage.
• Backups, and a documented route to restore them.
• Review of these measures as the service changes.

You give general authorisation for us to engage sub-processors to provide the service. Each is bound by terms no less protective than these, and we remain responsible for their performance. Today they are, by category:

• Hosting, database and file storage.
• AI model providers, for generating pages, documents, pictures and video.
• Payment processing.
• Transactional email delivery.
• Error reporting and infrastructure monitoring.

A current list naming each sub-processor is available from privacy@designhive.app. We will give you notice before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may stop using the affected feature or end the agreement.

Personal data may be processed outside your country, including in the European Economic Area and the United States. Where it is, we rely on an appropriate safeguard - an adequacy decision, or standard contractual clauses incorporated by reference into this addendum - and apply additional measures where they are needed.

The product gives you the means to access, correct, export and delete the personal data you hold in it. If a request reaches us directly we will not respond to it on your behalf, except to tell the person to contact you, and we will pass it on without undue delay.

On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will make available the information needed to show compliance with this addendum and allow an audit conducted by you or an auditor you appoint, at your cost, subject to confidentiality and without disrupting the service.

You may export your content at any time while your account is open. When the agreement ends we delete your personal data within a reasonable period, except where the law requires us to keep it; backups expire on their own schedule.

Liability under this addendum is subject to the limits in our Terms of Service. If this addendum conflicts with those terms on the processing of personal data, this addendum prevails.

To sign this addendum as a counter-signed document, or to ask anything about it, write to legal@designhive.app.