DATA PROCESSING

Establish Responsible Data Handling

Data processing is an essential part of modern software.

HexaKernel is designed to make domain logic explicit, but responsible data handling must remain equally explicit.

This policy describes the principles that guide the processing of personal and other protected information in connection with HexaKernel.

1. Purpose Limitation

Data should be collected and processed for defined and legitimate purposes.

Information should not be used for unrelated purposes without an appropriate legal basis or authorization.

2. Data Minimization

Only data reasonably necessary for a defined purpose should be collected or processed.

The existence of technical capability does not by itself justify collecting additional information.

3. Accuracy

Reasonable measures should be taken to keep personal data accurate and up to date where accuracy is relevant to the processing.

4. Retention

Data should not be retained indefinitely without a legitimate reason.

Retention periods should reflect:

• The purpose of processing

• Legal requirements

• Contractual requirements

• Operational needs

• Security considerations

5. Access Control

Access to data should be limited according to legitimate responsibilities and authorization.

Where appropriate, systems should apply role-based permissions, authentication and other controls.

6. Processing by Service Providers

Where third-party providers process data on behalf of Atavistico OÜ or its customers, appropriate contractual and technical safeguards should be applied.

The specific providers and processing activities depend on the services actually used.

7. Customer Data

Where HexaKernel processes customer data as part of providing a service, the applicable contractual arrangements determine the respective responsibilities of the parties.

Where personal data is processed on behalf of a customer, a Data Processing Agreement may be required.

8. International Processing

Where data is transferred or accessed across jurisdictions, applicable requirements concerning international data transfers will be considered and appropriate safeguards applied where required.

9. Data Subject Rights

Where applicable, individuals may exercise rights relating to their personal data, including access, rectification, deletion, restriction, objection and portability.

Requests should be directed to:

[privacy@hexakernel.com]

The specific rights available depend on applicable law and the circumstances of the processing.

10. Privacy by Design

Data protection should be considered when systems are designed, not only after they are deployed.

This principle aligns with the broader HexaKernel approach:

make important things explicit from the beginning.

Data should be processed with purpose, control and accountability.