Skip to content

Data processing agreement (Art. 28 GDPR)

The legal source of this agreement is the Spanish text: Contrato de encargo del tratamiento (version dpa-direct-v2026-10-30). This page is a summary, not a translation.

  • Parties. The customer is the controller; the processor is HODEITEK SL, CIF B56478027, Markole, 20550 Aretxabaleta (Gipuzkoa), Spain.
  • Scope. Paying direct customers. Beta participants are covered by the beta agreement; the MSSP chain is not covered.
  • Personal data breaches. Hodeitek notifies the customer within 48 hours of becoming aware of a breach affecting its data, and documents every breach under a written one-page procedure.
  • Sub-processors. General authorisation with 15 days' notice and a right to object. The list on the Subprocessors page is the single authoritative list. Sentry is not a sub-processor of the customer: it is Hodeitek's provider for the error reports Hodeitek processes as controller. Stripe and Holded process Hodeitek's own billing data as controller.
  • End of contract. The customer has 30 days to ask for return or deletion; Hodeitek deletes within 30 days of the request. Backups expire at most 2 days (managed database) and at most 17 days (n8n) after deletion. During the beta the console does not delete a tenant by itself: Hodeitek deletes it by hand, within those periods, following its internal tenant offboarding procedure. All customer and service data is deleted, with no exception by type of data, except what Union or Member State law requires to be kept, which Hodeitek keeps blocked and only for that purpose (clause 11.6); of it, only the backups remain until they expire. The subscription billing records (only if the subscription is taken out from the console) are neither customer data nor service data: Hodeitek processes them as controller under a legal obligation (Art. 6(1)(c) GDPR), namely to keep accounting documentation for six years (Art. 30 of the Spanish Commercial Code). When the contract ends, Hodeitek detaches them from the tenant and keeps them for 6 years from the end of the financial year of their last document, then deletes them automatically; they carry no service data (vendors, incidents, questionnaires, evidence or the account's users) and are used only to meet that obligation.
  • Return format (clause 11.3). JSON or CSV. The console's tenant data export is one JSON file with every table that belongs to the tenant: vendors and their contacts, questionnaires and answers, evidence and documents (their records, not the files), incidents with their history, deadlines, generated reports and recorded submissions, risks, policies, endpoint agent observations, the tenant's audit log and HodeiAI conversations. It leaves out columns that can hold credentials, uploaded files, the account's users, the text of HodeiAI messages and the endpoint agent's device identities and inventory, and holds at most 10,000 rows per table and 100,000 in total (the file says when it was cut). What the export does not cover, Hodeitek hands over by hand, in JSON or CSV, following its internal offboarding procedure, on request and in any case within the clause 11.2 periods. The export also carries the tenant's billing subscriptions; after termination those records are not deleted with the tenant but detached and kept as described above.
  • Incidents. For the duration of the engagement, an incident of the incident register is kept 5 years after it is closed, then deleted automatically with its history, deadlines, reports and recorded submissions; each deletion leaves an audit-log entry. While the engagement lasts, an incident that is not closed is never deleted, whatever its age, and the console offers no manual deletion of incidents. The 5 years do not survive termination: when the engagement ends, incidents are deleted like the rest of the customer's data, within the clause 11.2 periods, even if 5 years have not passed or they are not closed. Before termination the customer's administrators can export them with the console's tenant data export (JSON) and download each incident's authority reports (clause 11.7).
  • Customer's own register. The register of the customer's data-subject requests kept in the GDPR module is the customer's data and is kept at least 5 years. The customer instructs this retention; at the end of the contract it is handed over and deleted unless the customer says otherwise, within the clause 11.2 periods.
  • Rights requests. Requests forwarded to the customer within 5 working days; Hodeitek's record of them is kept 3 years.
  • Liability, law. Spanish law; courts of Donostia-San Sebastian.

To request the signed agreement, write to privacy@hodeitek.com.