Data processing

Data Processing Addendum

Effective date: June 1, 2026

This Data Processing Addendum supplements the agreement between HermesWorkspace and the organization that administers a workspace. It applies when HermesWorkspace processes personal data on behalf of that organization.

The organization remains responsible for its legal obligations, user notices, and the lawful basis for processing personal data under applicable privacy law.

1. Processing instructions

HermesWorkspace processes personal data only as instructed by the organization and to provide, secure, support, maintain, and improve the Service.

2. Sub-processors

HermesWorkspace may engage service providers for storage, messaging, analytics, notifications, security, and support. Sub-processors are bound by obligations to protect personal data.

3. Security measures

HermesWorkspace maintains technical and organizational measures designed to protect personal data, including authentication, transport security, monitoring, and backup controls.

4. Data subject requests

HermesWorkspace assists the organization in responding to verified privacy requests, including access, correction, export, and deletion requests.

5. Security incidents

HermesWorkspace will notify the organization if a security incident involving personal data is confirmed and notification is required by law or agreement.