Hypha / Demeter Mycolabs LLC
Document version: 1.1
Effective date. This DPA is effective on the date Customer first accepts the Agreement or otherwise first uses the Services in a way that results in Demeter processing Personal Data on Customer's behalf.
Parties. This DPA is between:
- Demeter Mycolabs LLC ("Demeter," "Processor"), and
- The entity that accepts the Agreement for business / organizational use of the Services ("Customer," "Controller").
1. Purpose and relationship
1.1 Services; incorporation. This DPA supplements and forms part of the agreement governing Customer's use of Demeter's Hypha platform and related services (the "Agreement").
1.2 Roles. Where Customer uses team or organization features and personal data is processed in connection with Customer's workspace, Customer acts as a controller, and Demeter processes such personal data as Customer's processor solely to provide the Services in accordance with Customer's documented instructions.
1.3 Independent processing. Demeter remains a separate controller for its own business purposes (for example, account security, fraud prevention, billing, product analytics, improving the Services including ML development, and legal compliance), as further described in Demeter's Privacy Policy and Terms of Service. This DPA does not apply to that independent processing.
2. Definitions
"Personal Data" means personal information / personal data (as defined under applicable Data Protection Laws) that Demeter processes on Customer's behalf.
"Data Protection Laws" means, to the extent applicable, the GDPR; the UK GDPR; and other laws governing privacy and security of Personal Data.
"Process," "processing," and cognate terms have the meanings given in applicable Data Protection Laws.
"GDPR" means Regulation (EU) 2016/679.
3. Instructions; details of processing
3.1 Demeter will process Personal Data only on documented instructions from Customer unless otherwise required by law; in that case, Demeter will inform Customer of the legal requirement before processing, unless the law prohibits such notice.
3.2 Annex A (Description of Processing) describes the subject matter, duration, nature and purpose, types of Personal Data, and categories of data subjects.
4. Confidentiality
Demeter will ensure that persons authorized to process Personal Data are bound by confidentiality obligations or an appropriate statutory obligation of confidentiality.
5. Security
Demeter will implement appropriate technical and organizational measures having regard to the state of the art, cost of implementation, and risks to data subjects.
6. Subprocessors
6.1 Customer generally authorizes Demeter to engage subprocessors to process Personal Data, subject to this DPA.
6.2 Demeter will impose data protection obligations that are materially no less protective than this DPA on any subprocessor.
6.3 Demeter will make available information about subprocessors (for example, via the Privacy Policy) and will notify Customer of new subprocessors with reasonable advance notice. Customer may object to a new subprocessor on reasonable data-protection grounds.
7. Data subject requests
Taking into account the nature of processing, Demeter will assist Customer by commercially reasonable means in responding to requests from data subjects to access, rectify, delete, restrict, port, or object, and with data protection impact assessments and prior consultations with supervisory authorities, where required.
8. Security incident notification
Demeter will notify Customer without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting Personal Data processed on Customer's behalf.
9. Return and deletion
On termination or expiration of the Services, Demeter will delete or return Personal Data in accordance with the Agreement and Hypha's deletion features, except where Demeter must retain copies as required by law or for reasonable backup rotation.
10. Audit
Where Data Protection Laws require, Demeter will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to reasonable, proportionate audits, which may be satisfied by third-party certifications, summaries of controls, or questionnaires.
11. International transfers
For transfers of Personal Data from the EEA to a country not recognized as adequate, the EU Commission Standard Contractual Clauses (Module 2, controller-to-processor) are incorporated by reference and deemed completed with Customer as "data exporter" and Demeter as "data importer."
12. Liability
Liability under this DPA is subject to the limitation of liability in the Agreement, except where Data Protection Laws provide otherwise for processors.
13. Order of precedence
If there is a conflict between this DPA and the Agreement regarding protection of Personal Data, this DPA prevails. Otherwise, the Agreement prevails.
14. Changes
Demeter may update this DPA template for new customers; changes that materially reduce protections for existing Customers require 30 days' notice.
Annex A — Description of processing
| Field | Description |
|---|---|
| Subject matter | Provision of the Hypha Services, including organization / team workspaces for controlled-environment agriculture and device monitoring. |
| Duration | For the term of the Agreement, and thereafter as needed to delete, return, or retain data per §9. |
| Nature and purpose | Hosting, storage, synchronization, authentication integration, notifications, support, security, and backups. |
| Types of Personal Data | Account identifiers (name and email), organization membership and role, workspace content (zones, devices, grow records, notes, photos), device identifiers, telemetry time-series, and technical logs. |
| Categories of data subjects | Customer's employees, contractors, or other authorized users; Customer's contacts if invited to the workspace. |
| Subprocessors | As described in Demeter's Privacy Policy §2.4 (Service providers) and updates thereto. |
Template version: 1.1 (July 1, 2026)