Data Processing Terms

Version 2026.1 · Effective date: 19-Oct-2026 · Hexos Incorporated, d/b/a Hexos IP

These Data Processing Terms (the "DPA") form part of the agreement between Hexos Incorporated, d/b/a Hexos IP, a North Carolina corporation ("Hexos", "we", "us"), and each client that uses our services (the "Client", "you"). They apply automatically: no signature is needed. If you would like a countersigned copy, email operations@hexosip.com.

1. Introduction

1.1 What this DPA covers. This DPA sets out how Hexos processes personal data on the Client's behalf when providing patent and trademark renewal (annuity), recordal and related services, the my Hexos IP client portal (the "Portal") and the Hexos API (together, the "Services").

1.2 Laws it addresses. It is written to meet the processor-contract requirements of the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended ("CCPA"), and other US state privacy laws, to the extent each applies to the Client's personal data.

1.3 How it fits with our other terms. The Hexos Terms and Conditions at hexosip.com/terms (the "T&C"), the my Hexos IP Terms of Use and our Privacy Policy at hexosip.com/privacy also apply. On the processing of Client Personal Data, the documents apply in this order:

any Standard Contractual Clauses signed under section 6.3;
a data processing agreement signed by both Hexos and the Client;
this DPA;
the my Hexos IP Terms of Use;
the T&C;
the Privacy Policy.

Words defined in the T&C (such as Case, Case Data, Instruction, Agent and Authority) have the same meaning here.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable individual.
"Client Personal Data" means Personal Data that Hexos processes on the Client's behalf in providing the Services, as described in Annex 1.
"Processing" means any operation performed on Personal Data, such as collecting, storing, using, disclosing or deleting it.
"Controller" means the person who decides why and how Personal Data is processed. "Processor" means a person who processes Personal Data on a Controller's behalf. Under the CCPA, these roles are called "business" and "service provider".
"Data Subject" means the individual a piece of Personal Data is about, such as an inventor, an owner, or a member of the Client's staff.
"Sub-processor" means a service provider Hexos engages to process Client Personal Data for us.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Personal Data.
"Data Protection Laws" means the laws listed in section 1.2 and any other privacy law that applies to the processing.

3. Roles and scope

3.1 The Client is the Controller; Hexos is its Processor. For Client Personal Data, the Client is the Controller (or, where the Client acts for its own clients, a Processor, in which case Hexos is its Sub-processor and the Client confirms that its own client has authorized our appointment). Hexos is the Client's Processor and, under the CCPA, its service provider.

3.2 Where Hexos is the Controller. Hexos is a separate Controller, and this DPA does not apply, for: the account, billing and payment details of the Client and its staff; our records of Portal and API sign-ins and security; marketing to business contacts; our records of the Instructions we receive and what we did, kept to show how a right was maintained and to establish or defend legal claims; and information we must keep by law. Our Privacy Policy covers that processing.

3.3 Authorities and Agents. Paying a renewal or recording a right means giving Case Data to Authorities and, in many countries, to Agents. Authorities receive it under their own laws and often publish it. Agents act under their own legal and professional duties of confidentiality and decide for themselves how to carry out the filing. They are not our Sub-processors. We choose Agents with care, give them only the Case Data needed for the task, and require them to keep it confidential. We will tell the Client on request which Agent we use for a country.

3.4 The Client's responsibilities. The Client is responsible for the lawfulness of the Client Personal Data it gives us, and for giving any notices and obtaining any consents needed for us to process it under this DPA, as section 5.2 of the T&C states.

4. Obligations of Hexos

4.1 Documented instructions. We process Client Personal Data only on the Client's documented instructions. The Client's instructions are: the T&C, the Terms of Use and this DPA; the Client's Instructions about Cases, given as section 6 of the T&C describes; and the Client's use of the Portal and the API. We may also process it where the law requires, and if so we will tell the Client first unless the law forbids it. We will tell the Client if we believe an instruction breaks Data Protection Laws.

4.2 Purpose and minimization. We process Client Personal Data only to provide, secure and support the Services, and to improve them using aggregated, de-identified information as section 14 of the T&C allows. We do not use it to build profiles of individuals, for anyone else's services, or for advertising. We collect and keep only what the Services need.

4.3 Confidentiality of our staff. Only Hexos staff and contractors who need Client Personal Data for their work can access it, and each is bound by a duty of confidentiality.

4.4 Security. We maintain the technical and organizational measures in Annex 2, and may improve them, but will not materially reduce the protection they give.

4.5 Requests from individuals. If a Data Subject asks us to exercise their rights over Client Personal Data, we will pass the request to the Client within five business days and will not answer it ourselves except to say we have passed it on, unless the Client asks us to. Taking into account what we process, we will help the Client respond, including by finding, correcting, exporting or deleting the information, subject to section 7.

4.6 Other help. We will give the Client reasonable help with its security obligations, data protection impact assessments and consultations with supervisory authorities, taking into account the information available to us. This help is charged at our standard rates; we will give the Client an estimate before starting.

4.7 Personal Data Breach. If we become aware of a Personal Data Breach, we will:

(a) notify the Client without undue delay, and in any event within 72 hours of becoming aware of it (that is, of confirming that a Personal Data Breach affecting Client Personal Data has occurred), as section 12.3 of the T&C promises;
(b) tell the Client, as far as we know them at the time and then as we learn more, what happened, the kinds and approximate numbers of Data Subjects and records affected, the likely consequences, the steps we have taken or propose, and who to contact at Hexos;
(c) take reasonable steps to contain the breach and limit its effects; and
(d) cooperate with the Client's reasonable requests, including so it can notify supervisory authorities and Data Subjects where the law requires.

The Client decides whether to notify supervisory authorities and Data Subjects about Client Personal Data. We will not do so on its behalf without its agreement, unless the law requires us to. Notice of a breach is not an admission of fault.

4.8 Requests from governments. If a court, regulator or other authority asks us for Client Personal Data, we will refer it to the Client where we can, and tell the Client promptly before disclosing anything, unless the law forbids it. We will disclose only what we are legally required to.

5. Sub-processing

5.1 Authorization. The Client authorizes Hexos to use the Sub-processors listed in Annex 3. The same list appears in section 5 of our Privacy Policy, which also names providers we use only as a Controller.

5.2 Our duties. Before a Sub-processor processes Client Personal Data, we will put in place a written contract that requires it to protect the data to at least the standard of this DPA. We remain responsible to the Client for our Sub-processors' performance of these duties.

5.3 Changes. We will give the Client at least 30 days' notice, by email to its main contact or in the Portal, before adding or replacing a Sub-processor, and will update Annex 3. In an emergency (for example, a provider's sudden failure), we may give notice as soon as we can afterward.

5.4 Objection. The Client may object on reasonable data protection grounds by writing to operations@hexosip.com within 15 days of our notice. We will discuss the objection in good faith and, where we reasonably can, offer a way to avoid the new Sub-processor for the Client's data. If we cannot, the Client may end the affected Services by written notice before the change takes effect, without paying any fee for ending early, and section 7.13 of the T&C applies to any prepaid amounts.

6. International transfers

6.1 Where data is stored. We store Client Personal Data in the United States, including our encrypted backups. Cloudflare's network may process it in transit outside the United States.

6.2 Transfers the Services need. Renewing or recording a right in another country requires sending Case Data, which may include owners' or inventors' names and addresses, to the Authority and any Agent in that country. The Client instructs those transfers when it asks us to manage a Case in that country. We send only what the filing needs.

6.3 Clients subject to GDPR or UK GDPR. Where the law requires a transfer mechanism for the Client's transfer of Client Personal Data to Hexos in the United States, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses (the "Standard Contractual Clauses") and, for the UK, the Information Commissioner's International Data Transfer Addendum. On request, we will sign them with the Client (Module 2 where the Client is a Controller, Module 3 where it is a Processor), using Annexes 1 to 3 of this DPA as their annexes.

6.4 Onward transfers. Where the law requires it for a transfer to a Sub-processor, an Authority or an Agent, we rely on appropriate safeguards, such as standard contractual clauses or the EU-US Data Privacy Framework where a provider is certified, or on another ground the law allows.

7. Retention, return and deletion

7.1 During the Services. We keep Client Personal Data as described in section 7 of our Privacy Policy, and delete or de-identify it when it is no longer needed, subject to the expiry of our backups under section 7.3.

7.2 When the Services end. The Client may ask, in writing within 90 days after the Services end, for a copy of its Case Data, as section 19.6 of the T&C states. After that period we will delete Client Personal Data from our live systems within 90 days, except:

(a) records we keep as a Controller under section 3.2, such as records of Instructions and what we did (kept for the life of the last right we managed for the Client plus 7 years, and longer while a claim is pending), and invoice and accounting records the law requires us to keep;
(b) information that is in an Authority's public record; and
(c) copies in our backups, as section 7.3 describes.

7.3 Backups. We keep encrypted backups so that renewal records can be recovered: daily copies for 90 days, weekly copies for 13 months and month-end copies for 7 years. Backups are locked and cannot be changed or deleted early, even by us, so deleted information remains in them until those copies expire. We use backups only to recover lost or damaged information, and if we restore one, we will delete again any Client Personal Data that should already have been deleted.

7.4 Continuing protection. Anything we keep under this section stays protected by this DPA and section 11 of the T&C for as long as we keep it.

8. Audits and cooperation

8.1 Information. We will make available the information reasonably needed to show that we meet this DPA. Once a year, on request, we will answer a reasonable written security questionnaire and give the Client any independent audit reports or certifications our main Sub-processors make available to their customers for sharing.

8.2 Audits. If that information is not enough to meet a requirement of Data Protection Laws, or a supervisory authority requires it, or after a Personal Data Breach, the Client may audit our compliance with this DPA, itself or through an independent auditor bound by confidentiality. The Client must give at least 30 days' written notice (less where a supervisory authority requires), agree the scope with us beforehand, conduct the audit during business hours without disrupting our work or seeing other clients' information, and bear its own costs. Audits are limited to once in any 12 months unless a supervisory authority requires more.

8.3 Supervisory authorities. We will cooperate with supervisory authorities as Data Protection Laws require.

9. US state privacy laws

Where the CCPA or another US state privacy law applies to Client Personal Data, Hexos, as the Client's service provider, processor or contractor:

(a) processes it only for the business purposes of providing, securing, supporting and improving the Services as described in this DPA;
(b) does not sell or share it (as the CCPA defines those words), and does not retain, use or disclose it outside our direct business relationship with the Client or for any other purpose, including any commercial purpose other than the Services;
(c) does not combine it with personal information we receive from anyone else, except as those laws allow;
(d) gives it the level of privacy protection those laws require, and will tell the Client if we can no longer meet our obligations under them;
(e) allows the Client to take reasonable and appropriate steps, under section 8, to make sure we use it consistently with those laws, and to stop and fix any unauthorized use; and
(f) keeps any de-identified data in de-identified form and does not try to re-identify it.

Hexos understands and will comply with these restrictions.

10. Liability and term

10.1 Liability. Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in section 17 of the T&C (or any signed agreement), and counts toward the same limits, except where the Standard Contractual Clauses or Data Protection Laws do not allow that.

10.2 Term. This DPA applies for as long as Hexos processes Client Personal Data, including after the Services end.

11. Changes to this DPA

We may update this DPA to reflect changes in the law or in our practices by giving at least 30 days' notice by email or in the Portal. Each version shows its version number and effective date, and we keep every earlier version. We will not reduce the protection this DPA gives Client Personal Data during the relationship, except where the law requires. Changes to Sub-processors follow section 5.

12. Contact

Questions, requests and notices about this DPA or our handling of personal data:

Hexos Incorporated, d/b/a Hexos IP

555 Fayetteville St, Ste 300, Raleigh, NC 27601-3066, USA

operations@hexosip.com · +1 (877) 439-6747

---

Annex 1. Description of the processing

Data Subjects: Owners, applicants, assignors, assignees and inventors named in Case records (where they are individuals); the Client's staff and contacts; staff of the Client's own clients; Portal users.
Categories of Client Personal Data: Names, postal addresses and nationality as they appear in Case records and assignments; business contact details (name, job title, organization, email, telephone); the content of Instructions, messages, notes and files sent to us; signatures on documents for recordals.
Sensitive data: None intended. The Client should not send special-category data, government identification numbers, payment card numbers or bank passwords.
Nature of processing: Hosting, storage, organization, retrieval, comparison with official registers, use of AI tools to read and summarize documents, transmission to Authorities and Agents, backup, deletion.
Purpose: Calculating and paying renewals, recording assignments and other changes, keeping Case records accurate, communicating with the Client, and running and securing the Portal and the API.
Frequency: Continuous while the Services are provided.
Duration and retention: As section 7 describes.
Sub-processors: Annex 3.

Annex 2. Security measures

Client Personal Data is encrypted in transit and stored with providers that encrypt it at rest (Cloudflare, Microsoft and Amazon Web Services); client-portal messages, files and backups are also encrypted by Hexos.
Two-step sign-in for every Portal user (password plus emailed code or authenticator app); passwords stored only in hashed form; automatic sign-out after 30 minutes without activity and after 12 hours at most.
Staff access limited to authorized personnel through an identity provider and role-based permissions; staff "view as user" support access to the Portal is read-only, limited to 30 minutes and recorded.
Each client sees only its own organizations and Cases; access is checked on the server for every request.
Records of sign-ins and actions in the Portal.
Encrypted backups, with the key held only by Hexos; locked backups that cannot be altered or deleted early; an encrypted off-site copy with a separate provider.
Confidentiality duties for all staff and contractors; Sub-processors bound by written contracts.
A process for receiving, assessing and notifying Personal Data Breaches.

Annex 3. Sub-processors

Cloudflare, Inc. — Hosting, databases and file storage for the Portal, the API and our internal systems; network security; AI tools that run on Cloudflare's network · United States (data stored); global network in transit
Amazon Web Services, Inc. — Hosting, databases, file storage and email for the Hexos renewals platform (Case, invoice and case-note records) · United States
Microsoft Corporation — Email delivery, including Portal emails, and document storage · United States
Backblaze, Inc. — Encrypted off-site backup copies (it cannot read them) · United States
Anthropic, PBC — AI assistant our staff use to work on Cases and to run our systems; not used to train AI models · United States
Wise Payments Ltd / Wise US Inc. — International payments to Authorities and Agents, which may carry Case references · United States and United Kingdom
Bill.com Holdings, Inc. (BILL) — Receiving and paying Agents' invoices, which may carry Case references and Agent contact names · United States
DocuSign, Inc. — Electronic signature of recordal documents, where used · United States

Authorities and Agents are not Sub-processors (section 3.3). Providers we use only as a Controller, such as Stripe (payments), Wix (our website) and our professional advisers, are listed in our Privacy Policy.

Version 2026.1 · Effective 19-Oct-2026 · Earlier versions are available on request.