1. Our Role Under GDPR

ConnectorHub may act as:

Data Processor

When we process data on behalf of customers using our platform (e.g., workflow logs, connector metadata, integration execution details).

Data Controller

When processing data related to marketing, analytics, website interactions, and account management.

We maintain strict separation between customer data and operational data.

2. Lawful Basis for Processing

ConnectorHub processes data under these lawful bases:

• Contractual necessity (to deliver our platform)
• Legitimate interests (security, analytics, improving services)
• Legal obligations (fraud prevention, record-keeping)
• Consent (marketing or cookie preferences)

We process only what is necessary and never access customer payload data without explicit customer authorization.

3. Data Minimization & Purpose Limitation

ConnectorHub adheres to GDPR principles:

• We do not store excess personal data.
• We only process data needed to deliver workflows or support operations.
• We never use customer data for unrelated purposes.
• We avoid direct access to customer payloads unless support is requested.

We ensure configurations, logs, and metadata remain isolated and protected.

4. Your GDPR Rights

If you reside in the EU/EEA, you have the right to:

• Access your personal data
• Rectify inaccurate information
• Erase your data (“right to be forgotten”)
• Restrict processing
• Object to processing
• Port your data to another provider
• Withdraw consent at any time

We respond within the required legal timeframes.

5. Data Security Standards

ConnectorHub applies enterprise-grade security controls including:

• AES-256 encryption at rest
• TLS 1.2+ encryption in transit
• Role-Based Access Control (RBAC)
• Multi-factor authentication (MFA)
• Secure credential vaulting
• Tenant isolation
• Audit logging & monitoring
• Regular penetration testing
• Automated anomaly detection

We maintain alignment with SOC 2 Type II, HIPAA-ready frameworks, ISO 27001, GDPR, and industry security standards. Our security practices are regularly audited by independent third parties.

6. Subprocessors

ConnectorHub uses trusted third-party providers (e.g., cloud hosting, analytics tools). Every subprocessor undergoes:

• Security evaluation
• GDPR compliance checks
• Data Processing Agreement (DPA) execution
• Least-privilege data access limits

A current list is available upon request.

7. International Data Transfers

ConnectorHub may store or process data outside the EU. All transfers comply with:

• EU-U.S. Data Privacy Framework (DPF), UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF (where applicable)
• Standard Contractual Clauses (SCCs)
• GDPR-approved safeguards
• Commitments to equivalent data protection standards

We conduct Data Transfer Impact Assessments (DTIAs) as needed and ensure our subprocessors maintain adequate protection mechanisms.

8. Data Processing Agreements (DPAs)

We offer customizable DPAs for enterprise customers to support their compliance needs. Request a DPA

9. Breach Notification Policy

In the unlikely event of a data breach, ConnectorHub will:

• Notify affected customers without undue delay
• Notify EU supervisory authorities within 72 hours (where applicable)
• Provide details of scope, impact, and mitigation steps

10. Data Retention & Deletion

ConnectorHub retains data only for:

• Operational purposes
• Legal and audit requirements
• Security and performance records

11. Accountability & Governance

We maintain:

• Documented internal security policies
• Annual GDPR reviews
• Employee training on data protection
• Vendor risk assessments
• Continuous monitoring standards