Data Processing Addendum

1. Scope and how this DPA applies

1.1 Applicable law. This DPA is written for the EU GDPR and the UK GDPR, and for US state privacy laws (including the CCPA as amended by the CPRA), under which Helios acts as a service provider or processor. In this DPA, "Data Protection Law" means those laws, as they apply to the processing.

1.2 Taking effect. This DPA applies automatically to every Customer as part of the Terms of Service; no separate signature is needed.

1.3 Order of precedence. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA controls. If it conflicts with the Business Associate Agreement on PHI, the Business Associate Agreement controls.

2. Definitions

Capitalised terms not defined here have the meanings given in the Terms of Service. "Controller," "processor," "personal data," "data subject" and "processing" have the meanings given in Data Protection Law (where a law uses other words for the same roles, such as "business" and "service provider," those words apply).

• "Customer Personal Data" means personal data in Customer Data that Helios processes for the Customer.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Subprocessor" means a third party Helios engages that processes Customer Data. Every Subprocessor is listed in the Subprocessors List.

3. Roles

3.1 Customer Personal Data. The Customer is the controller (or, where it processes the data for its own clients, a processor) of Customer Personal Data. Helios is the Customer's processor (or subprocessor).

3.2 Helios's own data. Helios is a controller of the personal data it needs to run the Customer's account and the business relationship. This includes the account owner's and billing contact's names and email addresses, the company name, the plan and Seat count, invoices and payment records, and messages sent to Helios through its website. The Privacy Policy covers that data, not this DPA.

4. Processing only on the Customer's instructions

Helios will process Customer Personal Data only on the Customer's documented instructions. Those instructions are the Agreement, the Customer's and its Authorized Users' use and configuration of the Service, and any other written instructions the Customer gives that are consistent with the Agreement. The only exception is where Data Protection Law or other law requires Helios to process the data. In that case Helios will tell the Customer before processing, unless that law forbids it.

Helios will tell the Customer if, in its opinion, an instruction breaks Data Protection Law.

5. Confidentiality of personnel

Helios will ensure that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality. Every employee and contractor with access to Customer Data is bound by a confidentiality clause in their employment or contractor agreement. Access to Customer Data is role-based and approved by a named owner, is reviewed quarterly, and is removed the same day an employee or contractor leaves.

6. Security

Helios will implement the technical and organisational measures described in Annex 2. Annex 2 describes the Service as it runs today, including the known gaps.

7. Subprocessors

7.1 Authorisation. The Customer authorises Helios to use the Subprocessors in the Subprocessors List. That list is the only place the Subprocessors are named (see Annex 3).

7.2 Terms with Subprocessors. Helios will put a written contract in place with each Subprocessor that imposes data-protection obligations no less protective than this DPA. Helios remains responsible to the Customer for each Subprocessor's performance. Helios has a data processing agreement in place with each current Subprocessor except Bluehost, with which no data processing agreement is in place today, as shown in the "DPA in place" column of the Subprocessors List.

7.3 Notice of new Subprocessors. Helios will give the Customer notice at least 14 days before a new or replacement Subprocessor starts processing Customer Data. Helios will give this notice by email to the account owner or, once available, in the admin portal, and by updating the Subprocessors List. See how Customers are told about changes.

7.4 Objections. If the Customer objects to a new Subprocessor on reasonable grounds, the parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected Service by written notice and receive a pro-rata refund of prepaid fees for the remainder of the Subscription Term.

8. International transfers

Where personal data is transferred out of the European Economic Area or the United Kingdom to a recipient certified under the EU-US Data Privacy Framework (and its UK Extension), Helios will rely on that certification for the transfer; otherwise Helios will rely on the EU Standard Contractual Clauses (and the UK Addendum to them).

The country or region where each Subprocessor processes Customer Data is shown in the "Data location" column of the Subprocessors List, as each Subprocessor states it.

9. Data-subject requests and other assistance

9.1 Requests. Taking into account the nature of the processing, Helios will help the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights under Data Protection Law. If Helios receives a request directly from a data subject about Customer Personal Data, Helios will pass it to the Customer and will not answer it itself, unless the Customer authorises it or the law requires it.

9.2 Other assistance. Taking into account the nature of the processing and the information available to it, Helios will help the Customer meet its obligations on security, Personal Data Breach notification, data protection impact assessments and prior consultation with supervisory authorities.

9.3 Timing and cost. Helios will forward a data-subject request it receives to the Customer within 5 business days. Reasonable help under this section is free of charge; extensive help is charged at cost.

10. Personal Data Breach

Helios will notify the Customer of a Personal Data Breach without undue delay and in any case within 48 hours after becoming aware of it. The notice will describe, as far as Helios then knows: the nature of the breach, including the categories and approximate number of data subjects and records concerned; a contact point for more information; the likely consequences; and the measures taken or proposed to address the breach and reduce its effects. Where Helios cannot give all of this at once, it will give it in stages as it learns more.

Notices go to the account owner's email address on file.

Helios will maintain a written incident response plan. Helios will notify Customers of service incidents on its status page, and will notify affected Customers of a Security Incident directly by email.

11. Information and audits

Helios will make available to the Customer the information necessary to show compliance with this DPA, and will allow for and contribute to audits, including inspections, by the Customer or an auditor the Customer appoints.

The Customer may audit Helios's compliance with this DPA once a year, on 30 days' written notice. Helios will first try to satisfy the audit with written answers and available reports; an on-site or further audit takes place only if those are not sufficient.

Helios holds no third-party security certification or independent audit report today.

12. Deletion or return at the end of processing

12.1 The obligation. When the Service ends, Helios will, at the Customer's choice, delete or return all Customer Personal Data and delete existing copies, unless the law requires Helios to keep it.

12.2 Export. Until the purge, the Customer's administrator will be able to export Customer Data through self-service: files from the workspace, and mail over IMAP.

12.3 How deletion works today. Cancelling a Subscription suspends the Customer's workspace and keeps its data until Helios staff purge it. Under the Data Retention & Deletion Policy, Helios will keep Customer Data for 30 days after the Subscription ends, and then purge it. The Data Retention & Deletion Policy sets out what the purge deletes and what it does not delete today.

12.4 Copies stored with Backblaze. Workspace files are stored with Backblaze as the Service's primary file storage. When the purge deletes the Customer's Authorized Users, the workspace software deletes their files. Helios will enable object versioning or lifecycle rules on that storage, so that earlier and deleted versions of files, including files in group folders, are kept for up to 30 days and then removed automatically. Nightly backups of the workspace and intranet databases are also stored with Backblaze. Those backup copies, which contain Customer Personal Data such as user accounts, shares, calendars and contacts, remain until backup retention deletes them, and no backup retention period is configured today. Helios will configure backup retention so that backup copies are kept for 30 days and then deleted.

12.5 Timing. Helios will complete a deletion request within 30 days. Once backup retention is configured as described in section 12.4, backup copies will be overwritten within 30 days; until then, backup copies of the databases remain in Backblaze storage, as section 12.4 explains.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where Data Protection Law does not allow it.

14. Governing law

This DPA is governed by the law, and disputes are resolved in the forum, stated in the Terms of Service, unless the transfer mechanism in section 8 requires otherwise.

Annex 1: Details of the processing

Subject matter. Hosting and operating the Service (mail, files, chat and meetings, calendars and contacts, documents and the intranet) and providing support.

Duration. The Subscription Term, plus the period after it ends until Customer Personal Data is deleted under section 12 and the Data Retention & Deletion Policy.

Nature of the processing. Storing, hosting, transmitting, backing up, displaying, indexing and deleting data; delivering and receiving email; creating and managing user accounts; and, when the AI support assistant is turned on for the Customer, sending support ticket text to an AI provider to draft replies.

Purpose. To provide the Service and support to the Customer under the Agreement.

Categories of personal data. Whatever the Customer and its Authorized Users put into the Service, including:

• Workspace files: files and folders, their earlier versions, deleted files in the trash bin, previews and file metadata.
• Mail: email messages and attachments, mailbox settings, forwarding addresses and mail-copy addresses.
• Calendars and contacts: events, invitations, attendees and address books.
• Chat and meetings: chat messages, shared items and meeting details.
• Documents: documents, spreadsheets and presentations created or edited in the Service.
• Account identity data: names, user IDs, email addresses, mailbox addresses, group memberships, sign-in records, and two-factor sign-in settings.
• Mobile app data: for Authorized Users of the Helios mobile app, a device push token.
• Support ticket text: the subject, category and messages of support tickets, and the identity of the person who opened them.
• Technical data: IP addresses, device and browser information, and log entries created when Authorized Users use the Service.
• Billing contact: the billing contact's email address and the company name (Helios processes these mainly as a controller, see section 3.2).

Special categories of data. The Customer may upload special categories of personal data (for example health data) under this DPA; the Customer is responsible for having a lawful basis, and any condition required for special-category data, for that processing. US PHI may be stored only under a signed Business Associate Agreement (see the Terms of Service).

Categories of data subjects.

• The Customer's Authorized Users, including its administrators.
• People who exchange email, chat messages, meeting invitations or shared files with Authorized Users.
• People whose details appear in the Customer's contacts, calendars, files and documents, such as the Customer's own clients, patients, employees and suppliers.
• People who open a public share link an Authorized User sends them.

Frequency. Continuous, for the duration above.

Annex 2: Security measures

This annex lists only measures verified in the Service as it runs today. It also states the known gaps and, in sentences beginning “Helios will”, the measures Helios has committed to put in place. It is not a promise that any measure not listed is in place.

A. Encryption in transit. Connections to the Helios web app, sign-in and admin portal use HTTPS (TLS); TLS certificates are issued automatically by a public certificate authority and renewed by cert-manager, and TLS 1.3 is negotiated. The mail protocols (IMAP, SMTP submission and server-to-server SMTP) offer TLS. Uploads to Backblaze storage use TLS. Known gaps: some Helios web addresses also answer over plain HTTP without redirecting to HTTPS, and several do not send an HSTS header. Connections between services inside the Helios server are not all encrypted.

• Helios will serve every Service hostname over HTTPS only (plain HTTP is redirected to HTTPS), will send an HSTS header on every hostname and will mark session cookies Secure, so that connections to the Service are encrypted in transit with TLS.

B. Sign-in and access control. Authorized Users sign in at the workspace; the admin portal and the intranet send Authorized Users to the workspace to sign in. Two-factor sign-in (authenticator app and backup codes) is available but not enforced. Protection against repeated failed sign-in attempts and a password policy are switched on. Admin portal sessions last up to 24 hours.

C. Staff access. Helios staff sign in to the internal operations console through a separate sign-in system that requires an authenticator code every time. Consequential staff actions require a fresh sign-in within the previous five minutes. Staff sessions last up to 8 hours.

D. Separation between Customers. Customers share one Helios-operated workspace server. Each Customer's Authorized Users are kept in their own group with a storage quota. By default, Authorized Users can only find and share with people in their own organisation inside the Service. Public share links and sharing with other servers are allowed by default. The intranet is one shared site that Customers can read but not change. Each Authorized User's mailbox is tagged with the Customer it belongs to.

E. Audit logging. Staff actions are recorded in an append-only audit log: the application cannot change or delete entries, it connects with a database role limited to reading and adding entries, and secrets are removed from entries before they are stored. The workspace software's own administrator audit log is switched off.

F. Backups. The workspace and intranet databases are backed up nightly to Backblaze, in a separate storage bucket, using a key that cannot delete buckets and is separate from the production storage key. Backups are compressed. Mail, the sign-in system's database and the support and audit database are not backed up off the server. No backup retention period is configured.

• Helios will configure backup retention so that backup copies are kept for 30 days and then deleted.

G. Incident response and vulnerability reports. Helios publishes a security.txt file. Security reports go to support@helioscloudsuite.com with “Security” in the subject line, as set out in the Vulnerability Disclosure Policy. No written incident response plan is in place today.

• Helios will maintain a written incident response plan. Helios will notify Customers of service incidents on its status page, and will notify affected Customers of a Security Incident directly by email.

H. Certifications. Helios holds no third-party security certification or independent audit report. The Security Overview describes the Service's security in plain language.

Annex 3: Authorised Subprocessors

The authorised Subprocessors are those listed in the Subprocessors List, which states each one's purpose, the data it processes, its data location, and whether a BAA and a DPA are in place. This DPA does not repeat that list. Other third-party services that receive limited data from the Service are listed, for transparency, in section 2 of the Subprocessors List.

• Notice of changes: at least 14 days before a new or replacement Subprocessor starts processing Customer Data, by email to the account owner or, once available, a notice in the admin portal, and an update to the Subprocessors List (see how changes are announced).
• Objections: good-faith discussion, then a right to terminate the affected Service with a pro-rata refund of prepaid fees, as set out in section 7.4 (see how to object).