Data Processing Agreement

1. Parties

This agreement is made under article 28 of the General Data Protection Regulation (GDPR) between:

• HS Simple SASU, SIREN 949810444, 200 rue de la Croix Nivert, 75015 Paris, France, operator of Untanggy, as processor; and
• the customer, as controller.

2. Subject matter and duration

The subject matter of the processing is the Untanggy service. The processing lasts for the term of the subscription.

3. Nature and purpose

Mapping dependencies between HubSpot workflows and assets on the customer’s instructions.

4. Categories of personal data

• Names and email addresses of the customer’s HubSpot users, as shown on workflows they created or last edited.
• Names and email addresses of the customer’s Untanggy users, and of people they invite.
• The customer’s organisation name, and the name of the connected portal, which may be a person’s name on a personal portal.
• Personal data the customer’s users may have written into the names of workflows, lists, properties, forms, emails or other assets.
• HubSpot contact ids received through the deletion webhook, which are logged and not stored.
• Billing name and email, held by Stripe.
• Technical logs (sign-in events, IP addresses in authentication logs kept by Supabase) retained for security.

5. Categories of data subjects

• The customer’s employees and contractors who use HubSpot or Untanggy, and people they invite to Untanggy.
• Any person whose name appears in the customer’s organisation name, portal name or asset names.
• Contacts, by id only.

6. Processor obligations

The processor:

• acts only on the customer’s documented instructions;
• keeps the personal data confidential;
• applies the security measures described in the annex: Security and data;
• engages sub-processors only with 30 days’ notice to the customer, who has a right to object;
• assists the customer with data subject requests and data protection impact assessments;
• notifies the customer of a personal data breach within 72 hours;
• deletes customer data within 30 days of termination;
• provides audit information on request.

7. International transfers

Personal data is transferred to the sub-processors listed on Security and data. Inngest (United States) currently receives portal configuration metadata without a data processing agreement in place; this transfer is being removed.

8. Governing law

This agreement is governed by French law.

Signed copies on request at hello@untanggy.com.

Last updated: 24 September 2026