When providing our services, Divhunt may process personal data on behalf of its users/customers. To outline the specifics of how we will perform this processing and what our obligations are, as well as the obligations of our users/customers, we have developed a Data Processing Addendum (DPA). This DPA is automatically incorporated into Divhunt’s Terms of Service and forms part of your agreement with us when you sign up to use our Services.

This Data Processing Addendum (“DPA”) is incorporated into, and is subject to the terms and conditions of, the Agreement between Divhunt GmbH, a legal entity with its registered office at Chamerstrasse 172, CH-6300 Zug, Switzerland (“Divhunt”), and the entity or person placing an order for or accessing the Services (“Customer”).

Definitions

• “Agreement” means Divhunt’s Terms of Service, or other written or electronic agreements, which govern the provision of the Services to the Customer, as such terms or agreements may be updated from time to time.
• “CCPA” means the California Consumer Privacy Act, its associated regulations, and their successors.
• “Controller,” “Data Subject,” “Process,” and “Processor” (whether or not capitalized) have the meanings provided in the GDPR and include analogous provisions under Data Protection Laws in other jurisdictions.
• “Data Protection Law(s)” means all laws and regulations applicable to Divhunt’s processing of Personal Data under the Agreement, including CCPA and GDPR.
• “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• “Personal Data” means any information relating to an identified or identifiable natural person that is processed by Divhunt on Customer’s behalf pursuant to the Agreement.
• “Security Incident” means the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Content, User Personal Data, or other Customer Confidential Information processed by Divhunt on Customer’s behalf pursuant to the Agreement.

Processing of Personal Data

1. Roles of the Parties: Customer may be the controller of Personal Data or a processor. Divhunt will act as a processor or sub-processor, as appropriate. Divhunt will comply with obligations under Data Protection Laws that govern Divhunt’s activities when processing Personal Data. The customer shall be solely responsible for compliance with Data Protection Laws regarding the collection of and transfer to Divhunt of Personal Data and for advising Divhunt of any obligations imposed on Divhunt as a sub-processor or service provider to Customer.
2. Details of the Processing: The subject matter of processing of Personal Data by Divhunt is the performance of the Divhunt Services pursuant to the Agreement. The duration of the processing, the nature and purpose of the processing, the types of Personal Data, and categories of Data Subjects processed under this DPA are further specified in Annex A.
3. Processing in Accordance with Data Protection Law: Divhunt shall only process Personal Data on behalf of and in accordance with Customer’s documented instructions for the following purposes: (a) processing in accordance with the Agreement and applicable Order Form(s); (b) processing initiated by Users in their use of Divhunt Services; and (c) processing to comply with other documented instructions provided by the Customer. Divhunt will promptly inform the Customer if it becomes aware that processing requested by the Customer infringes Data Protection Law.
4. Processing in Accordance with California Law: In accordance with the CCPA, and with respect to Personal Data to which CCPA applies: (a) Divhunt will not “sell” (as defined in the CCPA) any Personal Data; and (b) Divhunt will not collect, share or use any Personal Data except as necessary to perform services for the Customer.
5. Confidentiality of Processing: Divhunt will treat Personal Data as Customer’s Confidential Information and protect it in accordance with the confidentiality obligations in the Agreement. Divhunt shall ensure that its personnel engaged in the processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities, and have executed written confidentiality agreements no less protective of Customer’s rights in such data as this DPA.
6. Data Subject Requests; Data Impact Assessments: Divhunt shall, taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer’s obligation to respond to: (a) any request from a data subject to exercise any of its rights under Data Protection Laws; (b) any other correspondence, inquiry, or complaint received from a data subject, regulator, or other third party in connection with the processing of Personal Data; and (c) any data protection impact assessment that the Customer may be required to perform under Data Protection Law. If any such request, correspondence, inquiry, or complaint is made directly to Divhunt, Divhunt will promptly inform the Customer, providing full details of the same. Divhunt shall not respond to a data subject request without Customer’s prior written consent except to confirm that such request relates to the Customer.

Sub-processors

Authorized Sub-processors: Customer consents to Divhunt engaging the following third-party Sub-processors to process Personal Data for the purposes described in the Agreement and this DPA:

Hetzner

• Nature of Processing: Server hosting
• Territories: Germany

Google, Inc.

• Nature of Processing: Cloud Service Provider
• Territories: United States

Bunny CDN

• Nature of Processing: Content Delivery Network for assets
• Territories: United States

Cloudflare

• Nature of Processing: Web performance and security
• Territories: United States

Stripe

• Nature of Processing: Payment processing
• Territories: United States

Divhunt or its Affiliates will enter into a written agreement with each Sub-processor imposing data protection terms on the Sub-processor substantially equivalent to, and no less protective of, data subjects’ rights in Personal Data than, this DPA. Divhunt shall notify the Customer if it adds or removes Sub-processors within ten (10) business days of such changes.

Liability for Sub-processors: Where a Sub-processor fails to fulfill its data protection obligations, Divhunt shall remain fully liable to the Customer for the performance of that Sub-processor's obligations.

Security

1. Security Measures: Divhunt will use procedural, technical, and administrative safeguards designed to ensure the confidentiality, security, integrity, availability, and privacy of Content, Personal Data, and other Customer Confidential Information stored within Divhunt. Divhunt may update or modify such measures from time to time provided that such updates and modifications do not result in a material decrease in the overall security of the services during Customer’s subscription term.
2. Audit Rights: Divhunt will make available to the Customer such information as the Customer may reasonably request to demonstrate Divhunt’s compliance with obligations under Data Protection Laws. Divhunt will further allow for and contribute to audits conducted by the Customer or an auditor mandated by the Customer, provided it is not a competitor of Divhunt.
3. Breach Notice: Divhunt will inform the Customer via email without undue delay upon discovering a Security Incident. Divhunt will take all actions reasonably necessary to remedy or mitigate the effects of the Security Incident and keep the Customer informed of all material developments regarding the incident.

Data Collection and Use

Types of Data Collected

• Account Data: Divhunt collects and stores personal data required to create and manage user accounts, such as name, email address, and encrypted password. This data is used solely for account management, authentication, and providing a seamless user experience.
• Website Data: As users build websites on the Divhunt platform, all related content, including databases (collections), website content, and configurations, is stored securely. This data is necessary to provide the core functionality of the Divhunt platform and to ensure that users can build, manage, and maintain their websites effectively.

Access to Data

• Restricted Access: Access to user data, including website content and databases, is strictly controlled and limited to authorized Divhunt personnel. Only high-level personnel who require access for support purposes are permitted to view or manage this data.
• Support Use Only: Divhunt personnel may access user website data only when necessary to provide technical support or resolve specific user issues. This access is used solely to assist users and ensure the proper functioning of their websites on the platform.

Data Security

• Encryption and Protection: Divhunt uses industry-standard encryption and security measures to protect all personal data, including user account information and website content. Passwords are stored in an encrypted format to ensure user privacy and security.
• Data Retention: Divhunt retains personal data and website data only for as long as necessary to provide the services or as required by law. Upon termination of a user’s account, data will be deleted or anonymized according to our data retention policy, unless further retention is required by applicable law.

User Responsibilities

• Data Management: Users are responsible for managing the data they upload to the Divhunt platform. Users must ensure that any personal data they handle complies with applicable data protection laws and that they have obtained all necessary consents for processing.

Lawful Use of Services

• Compliance with Laws: Customers must use the Divhunt platform in compliance with all applicable laws and regulations. Customers are prohibited from creating, uploading, or hosting any unlawful content, including but not limited to pornographic material, hate speech, or any content that violates the rights of others.

• Prohibited Content: Customers are strictly forbidden from creating websites that contain or promote illegal activities, including but not limited to pornographic websites or content that is harmful, abusive, or otherwise offensive.

Copyright and Intellectual Property

• Customer Responsibility for Content: Customers are solely responsible for ensuring that the content they create, upload, or host on the Divhunt platform does not infringe on the copyrights, trademarks, or other intellectual property rights of third parties. Divhunt will not be liable for any copyright infringement claims or disputes arising from customer content.
• Response to Copyright Claims: In the event that Divhunt receives a valid copyright infringement notice or other legal request concerning content hosted on a customer’s website, Divhunt reserves the right to remove or disable access to the alleged infringing content without prior notice to the customer.

Indemnification

• Customer Liability: Customers agree to indemnify, defend, and hold harmless Divhunt, its affiliates, and its personnel from any claims, damages, losses, or expenses arising from or related to their use of the Divhunt platform, including any content they create or host that violates this agreement or applicable laws.

Data Storage Locations

Divhunt offers customers the option to choose where their data is stored, providing flexibility to meet data residency requirements:

1. Choice of Data Storage Location: Customers may choose to have their data stored in either:
   1. Germany
   2. United States
2. Data Replication: Customers can also opt for data replication, where their data is stored in both locations to enhance availability and resilience.
3. Data Residency: Divhunt will process and store data in the location(s) selected by the customer at the time of project creation. Customers are responsible for choosing the appropriate data storage location based on their regulatory requirements.

Return and Deletion of Personal Data

Upon termination or expiration of the Agreement, Divhunt shall, at Customer’s election, delete or return to the Customer all Personal Data (including copies) in its possession or control, except to the extent Divhunt is required by applicable law to retain some or all of the Personal Data, or to Personal Data it has archived on backup systems.

Europe-specific provisions

1. Cross-Border Data Transfer Mechanisms: To the extent Divhunt processes Personal Data originating from member states of the European Union, the European Economic Area, or the United Kingdom in a country that has not been designated by the European Commission as providing an adequate level of protection for Personal Data, such Personal Data shall be deemed to have adequate protection by virtue of the Standard Contractual Clauses for the Transfer of Personal Data to Processors established in third countries under GDPR.

Miscellaneous

1. Limits of Liability: Each party’s liability to the other under this DPA is subject to the limitations of liability in the Agreement.
2. Severability: If any provision of this DPA is adjudicated invalid or unenforceable, this DPA will be amended to the minimum extent necessary to achieve the same legal and commercial effect originally intended by the parties.
3. Governing Law: This DPA will be governed by and construed in accordance with the laws of the jurisdiction governing the Agreement unless otherwise required by the GDPR.

Contact Information

If you have any questions or concerns about this Data Processing Addendum or any related data protection matters, please contact us at business@divhunt.com

Updates

Divhunt reserves the right to modify, update, or change this DPA from time to time in the normal course of business. If we make any material changes to this DPA, we will provide reasonable notice to you, such as by email or a notification on our platform. Your continued use of the platform after the effective date of the updated DPA constitutes your acceptance of the updated terms. We encourage you to review this DPA periodically to stay informed about how we are protecting your data.