Haku is a processor for Controller Personal Data you supply, and an independent controller for data it sources itself. The split is set out in clause 3, and Annex I section 6 records the controller-side processing for transparency.

Eight named vendors receive Controller Personal Data, with location, purpose, data categories, retention and transfer mechanism listed for each. Ocean.io and FullEnrich are disclosed separately as controller-side vendors that receive no Controller Personal Data.

Thirty days, with a thirty-day objection window on reasonable grounds. If the objection cannot be resolved you may terminate the affected part of the Services with a pro-rata refund.

UK and EEA destinations need none. US sub-processors are covered by the Approved EU SCCs as amended by the ICO's International Data Transfer Addendum, version B1.0, with completed tables and the optional clause selections set out in full.

Twenty-four hours from confirmation of a Personal Data Breach affecting Controller Personal Data, with the categories, scale, likely consequences and remediation included as known.

A published schedule per data type: term plus 90 days for account and sequence data, 24 months for research evidence and engagement events, 6 months for call recordings, 35 days rolling for backups. Deletion is automated.

Two times the fees paid in the twelve months before the first event giving rise to the liability, on top of the Service Agreement limits. Death, personal injury and fraud are never excluded.

No. Client Data is not used to train AI models or develop products without your written consent, and any data used for platform improvement is anonymised and aggregated first. Inference runs on Haku's own EEA infrastructure.