Legal
Hobasa Data Processing Addendum
- Effective Date:
- November 2, 2026
- Last Updated:
- November 2, 2026
This Data Processing Addendum (“Addendum” or “DPA”) forms part of the Hobasa Terms of Use and any related documentation, as amended from time to time (“Agreement”) between you, the Customer, and Hobasa Inc. All capitalized terms not defined in this Addendum have the meanings set out in the Agreement. This DPA is effective automatically and without separate signature whenever Hobasa processes Personal Data as a Processor (or sub-Processor) on behalf of the Customer.
To the extent of any conflict: (a) this Addendum prevails over the Terms of Use with respect to data processing and privacy matters; and (b) Part B of this Addendum prevails over Part A in the event of conflict between them.
PART A: GENERAL DATA PROTECTION TERMS
DEFINITIONS
The following defined terms are used throughout this Addendum. Where a term is used in context without initial capitalization, it bears its ordinary meaning.
- 1.
“Applicable Data Protection Laws” means all privacy and data protection laws and regulations applicable to the processing of Personal Data under the Agreement, including United States Data Protection Laws as defined below, and, upon Hobasa’s commencement of operations in the relevant region, European Data Protection Laws (comprising the EU General Data Protection Regulation 2016/679 and its national implementing legislation), UK GDPR (as defined in the UK Data Protection Act 2018), the Swiss Federal Act on Data Protection, and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), together with any successor or amending legislation to any of the foregoing.
- 2.
“AUP” means Hobasa’s Acceptable Use Policy as set forth in the Terms of Use, as updated from time to time and published at https://hobasa.com/legal/acceptable-use-policy.
- 3.
“Authorized User” has the meaning given in the Terms of Use.
- 4.
“Client Data” has the meaning given in the Terms of Use.
- 5.
“Controller” means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing Personal Data. In relation to Client Data such as employee personal data, payroll data, and leave records, the Subscriber is the Controller. Where Applicable Data Protection Laws use an equivalent concept under a different name, such as “business” under the CCPA or “organization” under PIPEDA, that concept has the same meaning as Controller for the purposes of this Addendum.
- 6.
“Customer” means the Subscriber as defined in the Terms of Use. Where the context so requires, Customer includes all members of the Customer Group as defined below. In the context of this Addendum, the Customer acts as the Controller of Client Data and, where the Customer is a Processor acting on behalf of a third-party Controller (for example, a Partner processing End Client data), the Customer acts as a Processor and its instructions to Hobasa are those of the upstream third-party Controller.
- 7.
“Customer Group” means the Customer and any Affiliate of the Customer that accesses the Services under the Customer's Subscription in accordance with the Affiliate use provisions of the Terms of Use.
- 8.
“Data Subject” means an identified or identifiable natural person to whom Personal Data relates. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier, or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. Where Applicable Data Protection Laws use an equivalent concept such as “consumer” under the CCPA or “individual” under PIPEDA, that concept has the same meaning as Data Subject for the purposes of this Addendum.
- 9.
“Direct Subscriber” has the meaning given in the Terms of Use.
- 10.
“End Client” has the meaning given in the Terms of Use.
- 11.
“End User Agreement” means the Hobasa End Client User Agreement entered into between Hobasa and an End Client accessing the Services as an Authorized User under a Partner managed subscription.
- 12.
“Hobasa Group” means Hobasa Inc. and any Affiliate of Hobasa Inc. involved in the delivery of the Services or the processing of Personal Data in connection with the Services. Hobasa Group entities may act as Sub-Processors under his Addendum without requiring a separate addendum or amendment.
- 13.
“Partner” has the meaning given in the Terms of Use.
- 14.
“Personal Data” means any information relating to an identified or identifiable Data Subject that is processed by Hobasa on behalf of the Customer in the course of providing the Services. Where Applicable Data Protection Laws use an equivalent concept such as “personal information” under the CCPA or “personally identifiable information” under other US state laws, that concept has the same meaning as Personal Data for the purposes of this Addendum. Personal Data does not include data that has been irreversibly anonymized such that no individual can reasonably be identified from it.
- 15.
“Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of a Controller. Hobasa acts as Processor with respect to Client Data processed on the Customer's behalf. Where Applicable Data Protection Laws use an equivalent concept such as “service provider” under the CCPA, that concept has the same meaning as Processor for the purposes of this Addendum
- 16.
“Security Incident” means an actual confirmed breach of Hobasa’s security measures leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by Hobasa. For the avoidance of doubt, a Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful login attempts, port scans, denial of service attacks, or similar events that do not result in access to Personal Data. Security Incidents are distinct from general platform or service disruptions not involving Personal Data.
- 17.
“Services” has the meaning given in the Terms of Use.
- 18.
“Sub-Processor” means any third party (other than an employee or contractor of Hobasa acting under Hobasa’s direct authority and instruction) engaged by Hobasa or any member of the Hobasa Group to process Personal Data in connection with the Services. Sub-Processors include cloud infrastructure providers, payment processors, email service providers, analytics tools, customer support tooling, and LLM API providers.
- 19.
“Special Category HR Data” means Personal Data processed through the HR Compliance Product that constitutes health information (including FMLA related leave and medical certification data) or disability related information (including ADA reasonable accommodation records).
- 20.
“United States Data Protection Laws” means the body of applicable US federal and state privacy legislation governing the processing of Personal Data, which currently includes the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (CCPA/CPRA); the Virginia Consumer Data Protection Act (Virginia CDPA); the Colorado Privacy Act (CPA); the Utah Consumer Privacy Act (UCPA); and the Connecticut Data Privacy Act (CTDPA). This definition will be updated as Hobasa determines that additional US state privacy laws apply to its processing activities, and Hobasa will notify the Customer of any material additions.
ROLES AND PROCESSING INSTRUCTIONS
The Customer appoints Hobasa to process Personal Data on its behalf and in accordance with the Customer’s documented instructions as set out in this Agreement. As between the parties, the Customer is the Controller and Hobasa is the Processor, except that Hobasa acts as a Controller with respect to its own account and billing data as described in the Privacy Notice. Where the Customer is itself acting as a Processor on behalf of a third-party Controller, for example, where a Partner processes an End Client's data, Hobasa acts as the Customer's sub-Processor, and the Customer warrants that its instructions to Hobasa are aligned with those of the upstream Controller.
The Customer's processing instructions are set out in the Agreement and this Addendum. Any changes to those instructions must be agreed in writing. Hobasa will promptly notify the Customer if it believes any instruction violates Applicable Data Protection Laws and may suspend processing of the relevant data pending clarification without incurring liability.
If the Customer integrates any third-party service with the Services, including Integrated Systems, any processing of Personal Data by that third-party service is governed exclusively by that third party's own terms and privacy notice. Hobasa bears no liability for the data practices of Integrated System providers.
CUSTOMER RESPONSIBILITIES
As Controller, the Customer is responsible for ensuring that all required transparency notices have been provided to Data Subjects whose Personal Data is submitted to the Services; all necessary consents, rights, and lawful bases have been obtained under Applicable Data Protection Laws before Personal Data is provided to Hobasa for processing; and, where the Customer is itself a Processor, its own instructions to Hobasa are aligned with the instructions and authorizations of the relevant upstream Controller. The Customer is independently responsible for maintaining appropriate security over its account credentials and the systems and devices it uses to access the Services, as set out in Terms of Use.
Special Category HR Data
Where the Customer’s use of the HR Compliance Product involves Special Category HR Data: (a) the Customer warrants that it has a lawful basis under applicable law to process such data and to provide it to Hobasa for processing; (b) Hobasa will process Special Category HR Data only for the purpose of generating HR Compliance Outputs or providing Services and for no other purpose; (c) Hobasa will impose equivalent restrictions on any Sub-Processor that receives Special Category HR Data; and (d) Special Category HR Data will not be used for AI model training, aggregated analytics sharing, or any purpose beyond generating the requested AI Outputs or Services.
Client Data License
The Customer grants Hobasa and the Hobasa Group a worldwide, royalty-free, perpetual (coterminous with retention), irrevocable (coterminous with retention), non-exclusive, sublicensable (solely to approved Sub-Processors) license to access, use, reproduce, store, transmit, analyze, and otherwise process Client Data for the purposes permitted under this Addendum. The license is strictly limited to the purposes of: (a) providing the Services and generating the AI Outputs the Customer has requested; (b) operating, supporting, maintaining, and securing the platform; (c) complying with Hobasa's legal obligations; and (d) generating irreversibly anonymized or aggregated statistical outputs as permitted below
AI Model Training
Hobasa will not use Client Data (including Personal Data and AI Outputs derived from Personal Data) to train, fine-tune, or improve its own or any third party's artificial intelligence or large language models without the Customer’s separate, express, written consent, obtained specifically for that purpose. Any consent given under this Section may be revoked by the Customer at any time by written notice, with effect from the date of receipt. Revocation of consent is prospective and does not require Hobasa to retrain, or purge any model previously trained on consented data. From the date Hobasa receives written notice of revocation, Hobasa shall not use the revoked data for any further training activity.
Notwithstanding the aforementioned, Hobasa may use irreversibly anonymized data, , aggregated usage metrics, and platform wide performance signals to improve the Services, develop new features, and generate platform analytics.
Excluded Data
The Services are not designed, contracted, or priced to receive the categories of data defined as “Excluded Data” in the AUP. The Customer must not provide Excluded Data to Hobasa for processing. In the event the Customer provides Excluded Data, Hobasa may delete it without liability and suspend the affected Integrated System connection. The Customer shall indemnify Hobasa for any claim, loss, liability, penalty, or cost arising from the Customer’s submission of Excluded Data.
TECHNICAL AND ORGANISATIONAL MEASURES
Hobasa will maintain, for the duration of the Agreement, technical and organizational measures appropriate to the risk of processing, designed to protect Personal Data against Security Incidents. These measures are detailed in Annex A to this Addendum. Hobasa may update its security measures from time to time as technology evolves and threats develop, provided that any amendment shall not materially diminish the overall level of protection provided. Hobasa maintains its information security program in alignment with the SOC 2 Type II standards.
DATA SUBJECT RIGHTS ASSISTANCE
Where Hobasa receives any request, complaint, or enquiry from a Data Subject in connection with Personal Data processed on a customer’s behalf, Hobasa will promptly forward the matter to the relevant Customer within 5 (five) business days of receipt. Hobasa will provide such reasonable technical assistance as is available through its systems to support the Customer in responding to the Data Subject’s request within the applicable statutory timeframe. Hobasa will not respond directly to Data Subject requests without the Customer’s prior written authorization, except where Hobasa is required to do so by applicable law.
For employee HR data, where an employee of a Subscriber makes a rights request to Hobasa in connection with HR Compliance Product processing, Hobasa will notify the Subscriber within 5 (five) business days. Hobasa will not respond directly to employee rights requests concerning HR data without the Subscriber’s authorization, as the Subscriber is the Controller of that data.
RETENTION, DELETION, EXPORT
Deletion
Upon termination of the Agreement for any reason, or upon receipt of the Customer’s written deletion request, Hobasa will delete or irreversibly anonymize all Personal Data within 30 (thirty) calendar days of the termination date or deletion request, unless a longer retention period is required by Applicable Data Protection Laws or applicable statutory record keeping obligations. Backup copies containing Personal Data will be overwritten within Hobasa’s standard backup rotation cycle. Financial and other records subject to mandatory statutory retention will be maintained in isolated, access-controlled storage and deleted at the expiry of the applicable retention period. Upon request, Hobasa will provide the Customer with written confirmation that deletion has been completed.
For Partner-managed subscriptions, the deletion clock for an End Client’s Integrated System data runs from the expiration of the applicable End Client subscription. For Direct Subscribers, the deletion clock runs from termination of the Direct Subscriber’s subscription. For any prepaid End Client subscription continuing beyond termination of the Partner Agreement, Hobasa shall retain the applicable End Client data and continue providing the Services through the end of the prepaid subscription term.
Export
AI Outputs generated during the term of the Agreement may be exported by the Customer (or in the case of a Partner managed subscription, by the Partner or End Client) as raw documents upon written request submitted to support@hobasa.com and partnersupport@hobasa.com respectively, within 30 (thirty) days following the expiration or termination of the applicable End Client subscription.
Extended Retention
Where the Customer (or in the case of a Partner managed subscription, the Partner or End Client) wishes to retain access to AI Outputs on the Hobasa platform beyond the 30 (thirty) day window, a written Extended Retention Request must be submitted before the export window closes. The request must specify the Customer’s or End Client’s identity, the data to be retained, and the requested retention period. Hobasa may, at its discretion, confirm whether extended retention can be accommodated and provide a storage fee quote based on the volume of data to be retained, the requested retention period, and its then-current storage fee schedule. Extended retention is not guaranteed and is subject to Hobasa’s operational capacity. AI Outputs retained under an Extended Retention arrangement remain subject to Hobasa's Privacy Notice and this DPA and will be permanently deleted at the end of the agreed retention period or upon non-payment of the applicable storage fee, whichever occurs first.
Hobasa bears no liability to the Customer, any End Client, or any third party for the deletion of Integrated System data or AI Outputs performed in accordance with the timelines and requirements of this Section.
SECURITY INCIDENT
In the event of a Security Incident, upon Hobasa becoming aware of the incident, Hobasa will notify the affected Customer without undue delay and no later than 72 (seventy-two) hours after becoming aware of the Security Incident,, and in any event within the timeframe required under applicable law. The initial notification will describe, to the extent then known: the nature of the Security Incident; the categories and approximate number of Data Subjects and records of Personal Data affected, including whether HR data or Special Category HR Data is involved; the likely consequences of the incident; and the measures taken or proposed by Hobasa to address the incident and mitigate its effects.
Where full information is not available, Hobasa will provide what is known at that time and supplement the notification as further information becomes available. Hobasa will cooperate with the Customer’s investigation and with any notifications the Customer is required to make to regulatory authorities or affected Data Subjects. Partners who become aware of a Security Incident affecting Hobasa connected systems or Client Data within the Partner's possession or control must notify Hobasa within 72 (seventy-two) hours per Hobasa’s Partner Code of Conduct.
Where an End Client has direct knowledge of a Security Incident affecting its Client Data, the End Client may notify Hobasa directly at support@hobasa.com. Hobasa will acknowledge receipt within 24 (twenty-four) hours and will treat the notification as an incident report for purposes of this Section, without waiting for the End Client to escalate the matter through the Partner first. Nothing in this Section limits the Partner’s own Security Incident reporting obligations under the Partner Code of Conduct, which continue to apply in parallel.
SUB-PROCESSING
LLM API Sub-Processors
Hobasa uses third-party large language model (LLM) API providers to generate AI Outputs. These providers are engaged as Sub-Processors under this Addendum. Hobasa will only engage LLM API providers that: operate under a zero data retention configuration for Hobasa’s API calls, meaning that query data is not persistently stored beyond the duration of the individual API call; are contractually prohibited from training, fine tuning, or otherwise improving their own models using Hobasa Customer Personal Data; and are listed on the Sub-Processor list. Client Data is transmitted to LLM API providers for the sole purpose of generating the requested AI Output and is not retained, sold, or otherwise used by those providers.
CONFIDENTIALITY
Hobasa will ensure that all personnel and contractors authorized by Hobasa to process Personal Data are subject to enforceable obligations of confidentiality that are no less protective than Hobasa’s confidentiality obligations under this Addendum and the Agreement. Hobasa will ensure that access to Personal Data is limited to those personnel who require it for the purpose of delivering the Services.
LIABILITY
Each party's liability under this Addendum is subject to the limitation of liability provisions in: (i) Terms of Use (for Direct Subscribers); (ii) the Partner Agreement (for Partners); or (iii) the End User Agreement (for End Clients accessing the Services as Authorized Users under a Partner-managed subscription), as applicable, except that the liability cap will not apply to: (a) any fines, penalties, or enforcement actions imposed by a data protection authority to the extent arising from that party’s breach of this Addendum; or (b) any loss or damage arising from that party’s gross negligence or willful misconduct in connection with Personal Data. Nothing in this Addendum limits either party’s liability for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation.
ANNEX A: TECHNICAL AND ORGANISATIONAL MEASURES
The following technical and organizational measures are maintained by Hobasa as at the effective date of this Addendum. Hobasa may update these measures from time to time.
Encryption: all Personal Data stored on Hobasa’s systems is encrypted at rest using AES-256. All Personal Data transmitted between Hobasa systems and users, Partners, or sub-processors is encrypted in transit using TLS 1.2 or higher.
Access controls: Hobasa employs role-based access controls (RBAC) across all internal systems, ensuring that access to Personal Data is limited to personnel who require it for their specific role. The principle of least privilege is enforced. Multi factor authentication (MFA) is mandatory for all Partner accounts.
Client data isolation: each End Client's data environment is logically segregated from all other End Client environments. Session level isolation controls are applied in the Partner Dashboard to prevent cross-client data access when switching between client environments.
API and key security: API keys are stored in hashed form. Rate limiting is applied to all API endpoints. OAuth 2.0 tokens are managed with automatic rotation. API key compromises reported by Partners result in immediate revocation.
Vulnerability management: Hobasa conducts annual third-party penetration testing of its production environment. Continuous automated vulnerability scanning is applied to all production systems. Critical and high severity vulnerabilities are remediated within documented remediation timeframes appropriate to their severity, which shall be made available to the Customer upon request, if provided for in a negotiated agreement between Hobasa and such Customer.
Backup and recovery: daily automated backups of all Customer Personal Data are performed. Hobasa shall maintain a recovery point objective (RPO) of 8 (eight) hours and a recovery time objective (RTO) of 6 (six) hours for critical systems. Backup copies are encrypted and stored in isolated environments.
Personnel security: all Hobasa personnel with access to Personal Data receive annual data protection training. Personnel in roles with significant access to Personal Data are subject to background screening. Access rights are revoked promptly upon role change or departure.
Incident response: Hobasa maintains a documented incident response plan (IRP) with defined escalation paths. All Security Incidents are subject to post-incident review. Lessons learned are incorporated into the information security program.
Sub-Processor management: all Sub-Processors are engaged under written data processing agreements that impose security and confidentiality obligations equivalent to those in this Addendum. Sub-Processor security practices are reviewed at least annually.
LLM API providers: each LLM API provider engaged by Hobasa is contractually restricted from retaining query data beyond the duration of the API call and from training its models on Customer Personal Data.
ANNEX B: DATA PROCESSING SCHEDULE
This schedule describes the processing of Personal Data carried out by Hobasa under this Addendum.
Data Subjects
The Personal Data processed relates to the following categories of Data Subjects: Hobasa Subscribers (Direct and Partner-managed); Authorized Users; Partner Personnel; End Client personnel; and employees and workers of End Clients whose HR and payroll data is processed through the HR Compliance Product.
Categories of Personal Data
Hobasa processes the following categories of Personal Data on behalf of the Customer: identity and contact data (names, email addresses, telephone numbers, job titles, business names and addresses); account and subscription data (login credentials, subscription plan details, MFA configuration, billing contact information); financial and accounting records (transaction data, account balances, invoices, payroll data, and other information pulled from Integrated Systems via API); AI interaction data (queries submitted to LLM pipelines and the AI Outputs generated in response); payment data (truncated card details, ACH routing and account information, billing history); device and usage data (IP addresses, browser type, session tokens, platform usage logs); and such other personal data as the Customer chooses to submit to the Services.
Special Categories of Personal Data
Hobasa may process health related and disability related Special Category HR Data through the HR Compliance Product where such data is present in HRMS Integrated Systems. Processing is solely on the Customer’s instruction for the purpose of generating HR Compliance Outputs.
Purposes and Operations of Processing
Hobasa processes Personal Data for the following purposes: delivering access to the Hobasa platform and its features; operating the End Client and Partner dashboards; processing data received from Integrated Systems via API in order to generate AI Outputs and financial intelligence reports; processing subscription payments and issuing invoices; maintaining account security and preventing fraud and unauthorized access; providing customer support; and complying with applicable legal and regulatory obligations. The operations involved include collection via web interface and API; storage on cloud infrastructure in the United States; transmission to authorized Partners and Sub-Processors; processing by LLM API providers for AI Output generation; and deletion upon termination as described in this DPA.
Retention
Personal Data is retained in accordance with the periods set out in the Terms of Use and this DPA, as described in full in Hobasa’s Privacy Notice.
PART B: ADDITIONAL REGION-SPECIFIC TERMS
Part B of this DPA applies in addition to Part A where region specific data protection laws apply to the processing of Personal Data under the Agreement. In the event of any conflict between the provisions of Part A and Part B, Part B prevails to the extent of the conflict.
UNITED STATES
Where United States Data Protection Laws apply to the processing of Personal Data under this Addendum, Hobasa acts as a 'service provider' within the meaning of the CCPA, or as a 'processor' within the meaning of the Virginia CDPA, Colorado CPA, Utah UCPA, and Connecticut CTDPA, as applicable. Hobasa will not sell Personal Data, share Personal Data for cross context behavioral advertising, retain, use, or disclose Personal Data outside the scope of the business relationship, or combine Personal Data received from the Customer with personal data received from other sources, except as permitted by Applicable Data Protection Laws. Hobasa will cooperate with the Customer in responding to verifiable consumer requests within the timeframes required by applicable law. Hobasa will notify the Customer promptly if it determines that it can no longer meet its obligations under United States Data Protection Laws.