Data Processing Agreement

This Data Processing Agreement ("DPA") applies specifically when your organization imports its own catalogue or sales data into Henshin. It doesn't cover the retail market data Henshin collects from other companies' websites (see Data Sourcing), and it sits alongside — not instead of — our Privacy Policy and Terms of Service.

For the data covered here, your organization is the "Controller" and Henshin FZ-LLC is the "Processor," processing it only on your organization's instructions and only for the purpose of providing the service to you.

Processing continues for as long as your organization's subscription is active, and stops once the data has been deleted or returned as described below.

Imported catalogue and sales data is enriched and matched against the market data Henshin tracks, to generate the signals shown in your organization's own workspace. Henshin does not blend your organization's imported data into another customer's workspace, and does not use it to train any model shared across other customers, without your explicit consent.

Typically this is business data — product, catalogue, and sales records. If a file you import happens to include personal data (for example, named contacts in a wholesale order), the same protections in this DPA apply to it.

Henshin uses infrastructure and service providers to help operate the platform. We remain responsible for their handling of your data under terms consistent with this DPA, and we'll give notice of any material change to who we use.

See our Security page for how we protect customer workspaces and data.

If your organization's imported data includes personal data and someone exercises a data-subject right against it, we'll reasonably assist your organization in responding.

Henshin is based in Dubai, UAE, with a presence in New York, and may process data in either location or through service providers operating elsewhere, always under protections consistent with this DPA.

If we become aware of a breach affecting your organization's data, we'll notify you without undue delay and share what we know as we learn it.

On termination of your subscription, we'll delete or return your organization's imported data within a reasonable window, except where we're required to retain it.

Liability under this DPA follows the limitations set out in our Terms of Service or your order form.

This DPA is governed by the laws of the United Arab Emirates, with the courts of Dubai having exclusive jurisdiction.

This page serves as our standard DPA for self-serve customers. If your organization's procurement process requires a countersigned copy, contact us at hello@crystal.re.