数据处理协议

Last updated: October 15, 2026

This Data Processing Agreement ("DPA") is between HubNX, Inc. ("Hub Nexus", the Provider) and the Customer under the Hub Nexus Workspace Terms (the Agreement), as the Agreement defines it. It applies whenever Hub Nexus processes personal data for the Customer through a Hub Nexus workspace. The Customer accepts it, with the Agreement, when a workspace is created for it, when it starts or changes a workspace plan, or when it signs an Order Form that refers to it — no separate signature is needed. A Customer that wants a countersigned copy can ask at legal@hubnx.com.

The DPA has two parts: (1) this Cover Page, and (2) the Common Paper Data Processing Agreement Standard Terms, Version 1.1, which are incorporated by reference. If they disagree, the order is the one the Standard Terms set: the EEA SCCs or UK Addendum, then this DPA (this Cover Page over the Standard Terms), then the Agreement.

Cover Page

Changes to the Standard Terms

1. Audits and security reports. Hub Nexus has not been audited by an independent third party and has no Report to give. Until it has one: (a) Section 5.2 (Security Reports) of the Standard Terms is replaced with this: on the Customer's written request, Hub Nexus will give the Customer, in confidence, its security readiness pack (policies, control map and latest evidence report), its record of the processing it carries out for the Customer, and a completed security questionnaire, and will tell the Customer when a Report becomes available. Section 5.3 (Security Due Diligence) applies unchanged. (b) Despite the sentence of Section 5.1 that limits how the Customer exercises its audit rights: if what Hub Nexus gives under Sections 5.2 and 5.3 does not reasonably show that it complies with this DPA, after a Security Incident, or when a supervisory authority asks, the Customer may audit Hub Nexus's compliance with this DPA itself or through an independent auditor who is bound to confidentiality and does not compete with Hub Nexus. The Customer gives at least 30 days' written notice (less after a Security Incident or at a supervisory authority's request), audits no more than once in any 12 months otherwise, and pays its own costs. The audit reviews documents, records and evidence from Hub Nexus's systems, with interviews, normally remotely; it does not extend to the facilities of Hub Nexus's Subprocessors, whose own audit reports Hub Nexus will help the Customer obtain.
2. No AI on Customer Personal Data. Hub Nexus will not use Customer Personal Data to develop, train or improve any artificial intelligence or machine learning model, and will not give it to any generative AI or large language model service — including for support or debugging, and including the AI tools its personnel use to build and run the Service, which are not used on Customer Personal Data, and which the Service's own database client refuses a workspace's pages and settings in production. This item does not cover the spam, fraud and security screening that Approved Subprocessors apply, under their own terms, to email and payments.
3. Return and deletion. Section 7 of the Standard Terms applies with these changes, and the words "impracticable or" in Section 7.2(a) do not apply. (a) Return. Hub Nexus returns Customer Personal Data with the Workspace Content, as item 4 of the Agreement's Changes to the Standard Terms provides; that is the return Section 7.2(a) of the Standard Terms and Clause 8.5 of the EEA SCCs refer to. (b) During the Agreement. Deleting a page, change, comment or file removes at once the records that name it; the stored text or file itself is erased with the workspace. (c) Deleting a workspace — by its owner, or by Hub Nexus on request or after the Agreement ends, as item 5 of the Agreement's Changes to the Standard Terms says — erases every page in every state with all its versions, changes, comments, votes and signatures; its stored texts and files; its members, groups, invitations, read links and page grants; its single sign-on and SCIM set-up and verified domains; notifications and reports about its pages; and its name. (d) What remains for a limited time. Database backups for up to 35 days and earlier versions of stored files for up to 30 days, kept encrypted and used only to recover the Service after a failure — anything a recovery brings back that had been deleted is deleted again; application logs that name people, for up to 30 days; and messages people sent Hub Nexus about the workspace (support, reports, feedback): the copies in the Service for up to 90 days, the emails in Hub Nexus's mailboxes until the Customer asks for them to be deleted. Copies cached at content-delivery edge locations are invalidated when the workspace is deleted. (e) What Hub Nexus keeps. The workspace's audit log, for 12 months after deletion, to answer the Customer's questions about the workspace — including who deleted it — and then erased; earlier, on the Customer's written request once it has its copy. It holds ids, actions and times, never page text or email addresses. Records of payments into and out of a recognition budget, as Hub Nexus's own financial records, for as long as tax and accounting law requires. A version published to the public site, which is public content (Agreement, Changes to the Standard Terms, item 3). People's own accounts, as item 4 says. (f) On request, Hub Nexus confirms in writing what it deleted and what it kept under (d) and (e).
4. Roles, and what is Customer Personal Data. Customer Personal Data includes the personal data in Workspace Content; what the Service holds about people because of the Customer's workspaces — membership, roles, groups, invitations, page grants and read links, votes, signatures, notifications about workspace pages, and what the Customer's identity provider sends by single sign-on or SCIM; the workspaces' audit logs; and Usage Data that identifies a person, which Hub Nexus uses only to provide, secure and support the Service. Hub Nexus is a separate controller, under its Privacy Policy and not under this DPA, for each person's own Hub Nexus account once they have signed in — their sign-in address, name, picture and profile, and what they do on the public site — for its billing and payment records, and for any version a member publishes to the public site, from the moment it is published. An account Hub Nexus creates only because the Customer invited, shared a page with or provisioned an address is Customer Personal Data until that person signs in, and Hub Nexus deletes it if what created it — the invitation, the grant or the provisioning — ends before they do. Deleting a workspace does not delete the accounts of people who have signed in; each can delete their own at any time. Each account has a public profile page showing its name, picture and anything its owner adds to the profile.
5. Hub Nexus's personnel and their access. Hub Nexus gives access to Customer Personal Data only to personnel who need it to run, secure and support the Service and who have committed in writing to keep it confidential. Its site administrators can open any workspace page, hide a page and remove a comment. They do so only to give support the Customer asked for, to act on a report of abuse or of a security problem, or where Applicable Laws require it, and the workspace's audit log records each administrator's first opening of the workspace each day and every comment removed, and every page hidden. Hub Nexus's operator administers the infrastructure through an AWS role; that access can reach all stored data and is recorded only in AWS's 90-day history of management actions.
6. Security Incidents. Section 4 of the Standard Terms applies to every Security Incident as the Agreement defines it (Workspace Terms, Changes to the Standard Terms, item 6), with these additions. Hub Nexus sends its notice by email to the Customer's Notice Address, the workspace's owner and administrators, and any security contact the Customer names in writing — sooner than 72 hours where a law that applies to Hub Nexus requires it. The notice gives, as far as known at the time: what happened and when; the workspaces, kinds of data and approximate numbers of people and records affected; the likely consequences; what Hub Nexus has done and will do; what the Customer should do; and whom to contact. Hub Nexus will help the Customer notify supervisory authorities and the people affected.
7. Helping with people's requests. Under Section 6.1 of the Standard Terms, Hub Nexus helps the Customer answer people who exercise their data protection rights. The workspace's administrators can themselves find, change and remove its pages, comments and members, and download its audit log. Within 30 days of the Customer's written request, Hub Nexus exports a person's content and activity in a workspace, and corrects or erases, as the Customer instructs and as far as item 3 allows, personal data the Service gives the Customer no way to change itself — in an earlier version of a page, for example — and confirms it in writing.
8. Instructions. Where the GDPR or the UK GDPR applies, "Applicable Laws" in Sections 2.2 and 7 of the Standard Terms means the law of the European Union, an EEA member state or the United Kingdom; a demand made under any other law is handled under Section 6.1 of the Standard Terms and Clauses 14 and 15 of the EEA SCCs. Hub Nexus will tell the Customer at once if, in its opinion, an instruction breaks the GDPR or another data protection law.
9. Objecting to a new Subprocessor. If the Customer objects to a new Subprocessor on reasonable data protection grounds within 30 days of the notice, and the parties cannot resolve the objection within 30 days after it, the Customer may end the Agreement by notice and receive a prorated refund of prepaid Fees.
10. Swiss transfers. Where the Swiss Federal Act on Data Protection (FADP) governs a transfer, Section 3.4 of the Standard Terms applies with these additions: references to the GDPR anywhere in the EEA SCCs are to the FADP, to the extent the FADP governs the transfer; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for it; and "Member State" in Clause 18(c) of the EEA SCCs does not prevent data subjects in Switzerland from suing for their rights in Switzerland, where they habitually reside.
11. Versions of this DPA. This DPA carries a version date. A new version applies to the Customer only as item 8 of the Agreement's Changes to the Standard Terms allows; it never changes the EEA SCCs or the UK Addendum and never lowers the protection of Customer Personal Data already received. Earlier versions stay available at hubnx.com/about/dpa.

Annex I(A) — List of Parties

Annex I(B) — Description of Transfer and Processing

Annex I(C) — Competent Supervisory Authority

The supervisory authority of the data exporter, as determined by Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II — Technical and Organizational Measures

The measures Hub Nexus maintains at least, for all Customer Personal Data (the Agreement's Security Policy):

Annex III — Subprocessors

The Approved Subprocessors listed on the Cover Page.

Common Paper Data Processing Agreement (Version 1.1) free to use under CC BY 4.0. The Standard Terms are © Common Paper, Inc. This Cover Page was written by HubNX, Inc. from the Common Paper Data Processing Agreement Cover Page and changes the Standard Terms as stated above; Common Paper does not endorse it.