Last updated 15 October 2026.
These terms form part of the terms of service and apply automatically when huesix processes personal data for you. Need a signed copy? Ask at support@huesix.com.
1. Roles
You (the customer) are the controller of the personal data in your workspace. Bcube Technology Services, operating huesix, is your processor. Where you are yourself a processor for someone else, we are your sub-processor and these terms apply in the same way.
2. What is processed
- Subject matter and purpose: hosting and serving your configurators, receiving and storing their enquiries and quote requests, sending them to the destinations you set up and by email to your owners and admins (unless you turn that off), counting what shoppers do in your configurators for your analytics (unless you turn that off), and giving your team access in Studio.
- Duration: as long as you use huesix, then until deletion as in section 9.
- People concerned: your shoppers and prospects, your team members, and people named in content you upload.
- Kinds of data: names, email addresses, phone numbers, messages, chosen product designs, the page and language an enquiry came from, and your team’s account details. For analytics: what shoppers do in a configurator, the type of device, the country, the site they came from and the page it’s on, with a visitor hash whose salt is replaced daily; no IP address, cookie or device identifier is kept.
- Special category data: none is needed; please don’t collect it through configurator forms.
3. Your instructions
We process personal data only on your documented instructions: these terms, your settings in Studio, and what you ask us in writing. If we think an instruction breaks data protection law, we’ll tell you. If the law requires us to process data otherwise, we’ll tell you first unless the law forbids it.
4. Our people
Everyone at huesix who can access personal data is bound by confidentiality, and access is limited to what their role needs.
5. Security
We keep these measures, and improve them over time without lowering their protection:
- Encryption in transit (TLS) everywhere, and encryption at rest by our hosting, database and storage providers.
- Passwords stored only as salted hashes; sessions in secure, HTTP-only cookies.
- Every workspace’s data kept apart by access checks on every request, and the database closed to direct public access (row-level security).
- Role-based access for your team (owner, admin, member), and for our own staff on a need-to-know basis.
- A log of billing and administrative actions.
- Automatic database backups, kept for up to 35 days, so data can be restored.
- Bot checks and limits on public forms, and webhooks signed so you can verify they came from us.
- Dependencies kept up to date, and security fixes applied promptly.
6. Sub-processors
You authorise the sub-processors on the sub-processors page. We bind each one to data protection terms at least as protective as these, and remain responsible for them. We’ll announce a new sub-processor on that page and by email to workspace owners at least 30 days before it starts. If you object on reasonable data protection grounds and we can’t address it, you may end the affected service and get a refund of prepaid time.
7. Helping you
We help you answer people who use their data protection rights (Studio lets you find, export and delete enquiries yourself), and with security, breach notifications, data protection impact assessments and consultations with authorities, as far as our part of the processing allows.
8. Personal data breaches
If we become aware of a breach affecting your personal data, we’ll tell you without undue delay and within 48 hours, with what we know, what we’re doing about it, and updates as we learn more.
9. Deletion at the end
You can export your data at any time. When you delete a workspace, we delete its personal data from our live systems at once and from backups within 35 days, unless the law requires us to keep it.
10. Audits
We’ll give you the information you need to show we meet these terms. If that isn’t enough, or an authority asks, you may audit us once a year with 30 days’ notice, at your cost, under confidentiality, in a way that doesn’t disrupt the service or expose other customers’ data.
11. International transfers
Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the EU standard contractual clauses (Commission Decision 2021/914) apply and are incorporated by reference: module 2 where you are a controller, module 3 where you are a processor. Clause 7 (docking) applies; clause 9 option 2 (general authorisation, 30 days); clause 11’s optional wording doesn’t; clause 17 and 18: the law and courts of Ireland. The annexes are sections 2 and 5 of these terms. For the UK, the ICO’s International Data Transfer Addendum applies; for Switzerland, the clauses are read with the FADP as the law and the FDPIC as the authority. Transfers from the UAE follow the cross-border rules of the UAE Personal Data Protection Law.
12. US state privacy laws
Where the CCPA or another US state privacy law applies, we are your service provider (or processor). We won’t sell or share your personal data, keep, use or disclose it outside our direct business relationship with you or for any purpose other than providing huesix, or combine it with data from elsewhere except as those laws allow. We’ll tell you if we can no longer meet these obligations.
13. Order of precedence and liability
For personal data, these terms take precedence over the terms of service, and the standard contractual clauses take precedence over both. Liability under these terms is subject to the limits in the terms of service, as far as the law allows.