This Data Processing Agreement ("DPA") forms part of the services agreement between Hyperion Finance, Inc. ("Hyperion", "Processor") and the business customer using the Services ("Customer", "Controller"), and applies when Hyperion processes Personal Data on behalf of the Customer.
In case of conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection.
With respect to the Personal Data processed by Hyperion under the services agreement, the Customer acts as Controller (or joint controller, as applicable), and Hyperion acts as Processor. Each party will comply with its respective obligations under the Data Protection Laws.
The subject matter of the processing is the provision of the Services described in the Terms of Service, including entity formation, automation of IVU and municipal filings, integrations with third-party systems, and related communications. The duration of the processing coincides with the term of the services agreement, plus any additional period required by law for record retention.
Hyperion will process Personal Data solely for the purpose of providing the Services to the Customer and complying with the Customer's documented instructions, unless required otherwise by law.
Hyperion: (a) will process Personal Data only under the Customer's documented instructions (the Terms of Service and this DPA constitute such documented instructions); (b) will ensure that personnel authorized to process Personal Data are subject to confidentiality obligations; (c) will implement appropriate technical and organizational measures to protect Personal Data (see Annex A); (d) will assist the Customer in fulfilling Data Subjects' requests to the extent reasonably possible; (e) will assist the Customer in conducting impact assessments, incident notifications, and consultations with data-protection authorities, to the extent reasonably possible; and (f) at the end of the agreement, will delete or return the Personal Data in accordance with Section 11.
The Customer grants Hyperion general authorization to engage sub-processors for the provision of the Services. An updated list is published at /en/legal/sub-processors. Hyperion will notify of significant changes to the list with at least fifteen (15) days' advance notice; during that period, the Customer may reasonably object, in which case the parties will negotiate in good faith an alternative solution, or, if not possible, may terminate the affected portion of the Service.
Hyperion will enter into an agreement with each sub-processor containing data-protection obligations substantially equivalent to those set forth herein, and will be responsible for the sub-processor's compliance.
Hyperion will implement reasonable and appropriate technical and organizational measures to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. Measures include, without limitation: encryption in transit (TLS) and at rest where technically feasible, role-based access controls, multi-factor authentication for administrative access, environment segregation, activity monitoring, vulnerability management, and personnel training.
Hyperion will notify the Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware of a Security Incident affecting the Customer's Personal Data. The notification will include, to the extent available, the nature of the incident, the categories and approximate volume of affected data, the measures taken or proposed, and a contact point.
Some Personal Data may be processed outside of Puerto Rico, including in the continental United States, the European Union, or other jurisdictions where sub-processors operate. For such transfers, Hyperion will implement appropriate legal mechanisms (for example, standard contractual clauses) where required by applicable law.
At the end of the services agreement, Hyperion, at the Customer's option, will return or delete the Personal Data in its possession, except where retention is required by applicable law (for example, tax record-retention requirements). Hyperion will confirm in writing compliance with this obligation.
Once per year, or with greater frequency if required by a regulatory authority, the Customer may request reasonable information demonstrating Hyperion's compliance with this DPA. Hyperion will provide, as applicable, compliance certifications, third-party audit reports (for example, SOC 2), or completed questionnaires. On-site audits may be performed, subject to reasonable notice, during business hours, without disrupting Hyperion's operations, and under confidentiality agreements.
The limitations of liability set forth in the Terms of Service will apply to claims arising under this DPA, to the extent permitted by applicable law.
This DPA is governed by the laws of the Commonwealth of Puerto Rico, without prejudice to any data-protection mechanism required by foreign laws applicable to international transfers.
The updated list of sub-processors is maintained at /en/legal/sub-processors.
