Data Processing Addendum

We process personal data on your behalf so that you can sell, teach and stay in touch with your people through HeyHoney. This addendum runs for as long as the main contract.

Data subjects: your buyers, members, webinar participants, leads, the recipients of your emails, the people who book your appointments, and your team.

Data: names, email addresses, billing details, purchases and access rights, learning progress, posts and comments in communities, webinar registrations and chat messages, video and audio when someone turns on their camera or microphone in a webinar, form responses, appointments, and the delivery, opens and clicks of your emails.

We only process the data on your instructions. Your instructions are the settings and actions in your account; you can give us further instructions by email. If we believe an instruction violates data protection law, we tell you. We only process data without an instruction if a law requires us to; in that case, we inform you beforehand where we are allowed to.

Everyone at HeyHoney with access to your data is bound to confidentiality. Only people who need access for their job have it.

We protect the data in line with Art. 32 GDPR, including in these ways:

• Data is only transmitted encrypted (HTTPS with HSTS).
• Passwords are only stored as a hash that cannot be reversed (Argon2id).
• Two-factor sign-in for accounts, mandatory for HeyHoney staff.
• Customers are separated at the database level: every row belongs to one account, and the database itself does not allow access to other accounts.
• Access tokens for connected platforms are stored encrypted.
• Roles with graded permissions, both in your own team and at HeyHoney.
• HeyHoney staff can only view a customer account read-only. Our support team can only make changes with the customer’s express permission and for at most eight hours; deleting data and changing sign-in details stay blocked even then. Every access is logged.
• A log of security-relevant events, such as logins and changes to permissions.
• Limits on sign-in attempts and protection against requests from other sites.
• Paid videos and files are only available through time-limited links.

We keep developing these measures. We may change them as long as the level of protection does not go down.

You allow us to use subprocessors in these areas:

• Hosting and file storage
• Video network
• Live video for webinars
• Email delivery
• Payment processing (only as far as buyer data is needed for it)
• Speech and AI services (only if you use Honey or the writing assistant)

We send you the current list with names and locations on request. We bind every subprocessor to the same obligations that apply to us. We announce a new subprocessor to you by email in advance. You can object for an important data protection reason and, if we cannot find a solution, cancel the contract.

Some subprocessors are based outside the European Union, for example in the United States. For transfers of data from the EU, we rely on an adequacy decision of the European Commission or on its Standard Contractual Clauses.

If someone asks for access, correction or deletion, you can usually handle it yourself: in your account, you can view contacts, export their data and delete them. Where that is not enough, we help you. If a data subject contacts us directly, we forward the request to you.

If we become aware of a breach affecting your data, we inform you without undue delay, so that you can meet your reporting obligations, and we help you investigate.

After the contract ends, you can take your data with you for a reasonable period. After that, we delete it, unless a law requires us to keep it.

We give you the information you need to show that this addendum is being followed. On-site audits are possible by arrangement and with reasonable notice. You bear their cost, unless they were needed because of a breach on our part.

Liability is governed by Art. 82 GDPR; beyond that, our Terms of Service apply. If our Terms of Service conflict with this addendum on a data protection matter, this addendum prevails.