Holnix Data Processing Agreement

Version 1.0 · Effective date: October 29, 2026 · Last updated: October 29, 2026

1. Scope and relationship to the Agreement

1.1 This Data Processing Agreement (“DPA”) forms part of the Holnix Terms of Service or, where applicable, the Master Services Agreement (in either case, the “Agreement”) between Holnix, Inc. (“Holnix”) and the Subscriber identified in the Agreement (“Customer”). Capitalized terms not defined in this DPA have the meaning given in the Agreement.

1.2 This DPA applies where Holnix processes Customer Personal Data on behalf of Customer in the course of providing the Service and Applicable Data Protection Law applies to that processing. It does not apply to personal data for which Holnix acts as a controller, such as account and contact data of Customer’s Authorized Users, which is governed by the Holnix Privacy Policy.

1.3 By accepting the Agreement, Customer accepts this DPA. For MSA Subscribers, this DPA is incorporated as an annex to the Master Services Agreement. In the event of a conflict on data protection matters, this DPA prevails over the rest of the Agreement, and the SCCs, where they apply, prevail over this DPA.

2. Definitions

“Applicable Data Protection Law” means the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”) and any other data protection or privacy law, including U.S. state privacy laws, that applies to Customer Personal Data.

“Customer Personal Data” means personal data contained in the User Content that Holnix processes on behalf of Customer.

“GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as it forms part of the law of the United Kingdom.

The terms “controller”, “processor”, “processing”, “data subject”, “personal data”, “Personal Data Breach” and “supervisory authority” have the meanings given in the GDPR.

“SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914. “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner’s Office (version B1.0). “Sub-processor” means a third party engaged by Holnix to process Customer Personal Data.

3. Roles and details of the processing

3.1 Customer is the controller of Customer Personal Data (or, where Customer processes it on behalf of another controller, a processor), and Holnix is Customer’s processor (or sub-processor).

3.2 The subject matter, duration, nature and purpose of the processing, and the categories of personal data and data subjects, are set out in Annex I.

3.3 The Service is not designed to process special categories of personal data. To the extent the User Content incidentally includes such data (for example, in publicly available author biographies), Customer is responsible for having a lawful basis for that processing and for not uploading special-category data that is not necessary for its catalogs.

4. Customer’s instructions

4.1 Holnix will process Customer Personal Data only on Customer’s documented instructions. Customer’s instructions are: the Agreement, including this DPA; Customer’s use and configuration of the Service; and any further written instructions that are consistent with the Agreement.

4.2 Holnix will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

4.3 Customer is responsible for the lawfulness of its processing of Customer Personal Data, including having a legal basis, giving the notices that data subjects are entitled to, and the accuracy of the data it uploads.

4.4 Holnix may process Customer Personal Data where required to do so by law to which it is subject, in which case it will inform Customer before the processing unless the law prohibits it.

5. Confidentiality and personnel

Holnix will ensure that the persons it authorizes to process Customer Personal Data, including employees and contractors who provide development and technical support for the Service, are bound by confidentiality obligations, and will limit access to those who need it to provide, secure and support the Service.

6. Security

Holnix will implement technical and organizational measures appropriate to the risk, as described in Annex II. Holnix may update those measures from time to time, provided that the overall level of protection is not materially reduced.

7. Sub-processors

7.1 General authorization. Customer authorizes Holnix to engage Sub-processors to process Customer Personal Data, including those listed in Annex III.

7.2 Obligations. Holnix will bind each Sub-processor to data protection obligations no less protective than those in this DPA, and remains responsible to Customer for the performance of its Sub-processors.

7.3 Changes. Holnix will give Customer at least thirty (30) days’ notice before a new or replacement Sub-processor starts processing Customer Personal Data, by updating Annex III and notifying Customer by email or within the Service.

7.4 Objection. Customer may object to a new Sub-processor on reasonable data protection grounds within fifteen (15) days after notice. The parties will discuss the objection in good faith. If it cannot be resolved, Customer may terminate the part of the Service that depends on the Sub-processor by written notice.

8. Data subject rights

Taking into account the nature of the processing, Holnix will assist Customer by appropriate technical and organizational measures in responding to requests from data subjects to exercise their rights. If Holnix receives such a request directly and it relates to Customer Personal Data, Holnix will redirect the data subject to Customer where it can identify Customer, and will not otherwise respond to the request unless instructed by Customer or required by law.

9. Assistance to Customer

Taking into account the nature of the processing and the information available to Holnix, Holnix will provide reasonable assistance to Customer in meeting its obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments and prior consultation).

10. Personal Data Breach

Holnix will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Holnix will provide the information reasonably available to it to help Customer meet its notification obligations, and will take reasonable steps to contain and remediate the breach. Holnix’s notification is not an acknowledgment of fault or liability.

11. International transfers

11.1 Holnix is established in the United States. Customer Personal Data may be processed in the United States and in other countries where Holnix or its Sub-processors operate.

11.2 EU Standard Contractual Clauses. To the extent Customer is established in the European Economic Area, or its processing is subject to the GDPR, and transfers Customer Personal Data to Holnix in a country that has not been recognized as providing adequate protection, the parties agree to the SCCs, which are incorporated into this DPA by reference and completed as follows:

(a) Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor;

(b) Clause 7 (docking clause) applies;

(c) in Clause 9(a), Option 2 (general written authorization) applies, with the notice period set out in Section 7.3;

(d) in Clause 11(a), the optional language does not apply;

(e) in Clause 13 and Annex I.C, the competent supervisory authority is that of the Member State in which Customer is established or, if Customer is not established in the European Economic Area, of the Member State in which its representative is established;

(f) in Clause 17, Option 1 applies and the governing law is the law of Ireland;

(g) in Clause 18(b), the courts of Ireland have jurisdiction; and

(h) Annexes I to III of the SCCs are completed by Annexes I to III of this DPA.

11.3 United Kingdom. To the extent the UK GDPR applies, the UK Addendum applies and is completed as follows: Tables 1 to 3 are completed with the information in this DPA (parties, the SCCs as selected in Section 11.2 and Annexes I to III), and in Table 4 neither party may end the UK Addendum when it changes.

11.4 Switzerland. To the extent the FADP applies, the SCCs apply with the following adaptations: references to the GDPR are references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; references to a Member State include Switzerland, so that data subjects in Switzerland may bring claims in the courts of Switzerland under Clause 18(c).

11.5 Other mechanisms. If a different lawful transfer mechanism becomes available to the parties, Holnix may rely on it instead of the SCCs on notice to Customer.

12. Return and deletion

When Customer’s Account is terminated, Holnix will make Customer Personal Data available for export for thirty (30) days, as set out in Section 7.8 of the Terms of Service. After that period Holnix will delete Customer Personal Data, unless law requires it to be retained, and will delete it from backups in accordance with its backup retention cycle. At Customer’s written request, Holnix will confirm the deletion in writing.

13. Information and audits

13.1 On request, Holnix will make available to Customer the information necessary to demonstrate compliance with Article 28 of the GDPR, which may include relevant reports or certifications of its Sub-processors.

13.2 If that information is not sufficient, Customer or an independent auditor bound by confidentiality may audit Holnix’s compliance with this DPA, no more than once in any twelve (12) month period unless a Personal Data Breach has occurred or a supervisory authority requires it, on at least thirty (30) days’ written notice, during business hours and without unreasonably disrupting Holnix’s operations. Customer bears the cost of the audit.

14. U.S. state privacy laws

To the extent U.S. state privacy laws apply to Customer Personal Data, Holnix acts as Customer’s service provider or processor. Holnix will not sell or share Customer Personal Data, and will not retain, use or disclose it outside the direct business relationship between Holnix and Customer or for any purpose other than the business purposes specified in the Agreement, except as those laws permit. Holnix will notify Customer if it determines that it can no longer meet its obligations under those laws.

15. General

15.1 Liability. Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, to the extent permitted by law and without prejudice to the rights of data subjects under the SCCs.

15.2 Changes. Holnix may update this DPA to reflect changes in law or in the Service. If a change is material, Holnix will give at least thirty (30) days’ notice.

15.3 Governing law. This DPA is governed by the law that governs the Agreement, except where the SCCs or the UK Addendum require otherwise.

15.4 Contact. Questions about this DPA may be sent to legal@holnix.com.

Annex I — Details of the processing

A. Parties. Data exporter: Customer, as identified in the Agreement, acting as controller or processor. Data importer: Holnix, Inc., 150 SE 2nd Ave, Ste 300, Miami, FL 33131, United States; contact: legal@holnix.com; acting as processor. Each party’s acceptance of the Agreement constitutes its signature of this DPA and of the SCCs.

B. Description of the processing.

  • Categories of data subjects: authors, contributors, illustrators, translators and editors whose details appear in Customer’s catalog data; staff and business contacts of Customer, its customers and its partners; and other individuals whose personal data Customer includes in its User Content.
  • Categories of personal data: names and pen names; biographical information; photographs and images; professional contact details; links and social-media handles; and any other personal data included by Customer in its catalog data, ONIX records, metadata, cover images and marketing assets.
  • Sensitive data: none intended. See Section 3.3.
  • Frequency of the transfer: continuous, for as long as Customer uses the Service.
  • Nature of the processing: hosting, storage, transmission, display, formatting, synchronization and distribution of catalog data and related digital assets; generation of exports and online catalogs; and, where Customer uses AI-assisted features, processing by AI providers to generate content.
  • Purpose: to provide the Service to Customer as described in the Agreement.
  • Duration: the term of the Agreement and the export period described in Section 12.
  • Sub-processors: see Annex III. The subject matter, nature and duration of their processing are the same as above.

C. Competent supervisory authority. As set out in Section 11.2(e).

Annex II — Technical and organizational measures

  • The Service is hosted on Microsoft Azure, whose infrastructure is subject to the provider’s physical and environmental security controls.
  • Data is encrypted in transit using TLS.
  • Access to the Service requires authentication, and each Subscriber’s Account is logically separated from other Subscribers’ Accounts.
  • Access to Customer Personal Data by Holnix personnel and contractors, including development and technical support personnel, is limited to those who need it to operate, secure or support the Service, and they are bound by written confidentiality obligations.
  • Holnix has written agreements with its Sub-processors that impose data protection obligations.
  • Holnix maintains procedures to detect, assess and respond to security incidents and Personal Data Breaches.
  • Holnix applies the retention and deletion practices described in Section 12.
  • Holnix reviews these measures periodically.

Annex III — Sub-processors

The following Sub-processors may process Customer Personal Data. Holnix may update this list in accordance with Section 7.3.

  • Microsoft (Azure): cloud infrastructure and hosting of the Service.
  • OpenAI, Anthropic, Google and Microsoft: AI model processing, only when Customer uses AI-assisted features, through their enterprise and API channels.
  • Sentry (Functional Software, Inc.): application error monitoring, which may incidentally capture personal data present in error reports.