ARTICLE 1: INTRODUCTION AND DEFINITIONS

1.1 Introduction

This document establishes the comprehensive framework governing the relationship between hiublue, LLC (“hiublue”) and its Customers (“Customer” or “You”) regarding the use of its services. hiublue specializes in providing communication solutions, including but not limited to SMS, Voice, Email, Push Notifications, and Video Services. The document reflects hiublue’s commitment to transparency, compliance, and adherence to the highest standards of data protection, lawful processing, and customer-centric service delivery.

1.2 Purpose

The primary purpose of this document is to:

1. Define the roles, rights, and responsibilities of the parties.
2. Establish clear guidelines for the use of hiublue’s services in compliance with applicable laws.
3. Protect the confidentiality, security, and integrity of personal and business data processed through hiublue’s platform.
4. Provide transparency on hiublue’s data collection, usage, and sharing practices.

This document ensures that Customers are equipped with a clear understanding of their obligations and the operational standards hiublue adheres to, fostering a relationship built on trust and legal certainty.

1.3 Definitions

The following terms are integral to this document and are defined as follows:

1. “Affiliate”: Any entity that directly or indirectly controls, is controlled by, or is under common control with hiublue. Control is established by ownership of more than 50% of voting interests or equivalent management influence.

1. “Customer Data”: Refers to any information provided by or for the Customer, including Personal Data, that is processed by hiublue to deliver its services.

1. “Personal Data”: Any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, phone numbers, and IP addresses.

1. “Data Controller”: The entity that determines the purposes and means of processing Personal Data.

1. “Data Processor”: An entity, such as hiublue, that processes data on behalf of the Data Controller in compliance with documented instructions.

1. “End-User”: An individual who interacts with hiublue’s services as a recipient of the Customer’s communications or a participant in Customer-managed activities.

1. “Data Breach”: Any unauthorized access, loss, alteration, or disclosure of Personal Data that compromises its security, integrity, or availability.

1. “Data Protection Laws”: All applicable laws and regulations regarding the confidentiality, privacy, security, and processing of Personal Data, including but not limited to the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant regional laws.

1. “Services”: The suite of communication tools and solutions offered by hiublue, including but not limited to SMS, Voice, Email, Push Notifications, and associated APIs and platforms.

1. “Sub-processor”: A third-party vendor engaged by hiublue, such as AWS or OpenAI, to process Customer Data under strict contractual obligations.

1. “Standard Contractual Clauses (SCCs)”: Legal frameworks mandated by the European Union for transferring Personal Data outside the European Economic Area (EEA). hiublue adopts SCCs exclusively for sub-processors, including AWS and OpenAI, to maintain international data compliance.

1. “Terms”: The terms and conditions outlined in This document , as well as any referenced documents, policies, or service-specific appendices.

1.4 Roles and Responsibilities

hiublue acts as a Data Processor for Customer Data and is responsible for processing data exclusively within the scope and purpose defined by the Customer. hiublue adheres to strict data security measures and ensures that all sub-processors meet equivalent standards.

Customers act as Data Controllers, holding responsibility for obtaining valid consent, ensuring data accuracy, and adhering to lawful data processing principles. Customers must also ensure that their use of hiublue’s services complies with all applicable regulations.

End-Users engage with hiublue’s platform indirectly through Customer activities. While Customers manage their interactions with End-Users, hiublue ensures platform-level compliance to safeguard their data.

1.5 Scope of Document

This document applies to all hiublue services, including:

1. SMS Services – Facilitating compliant message transmission.
2. Voice Services – Ensuring lawful call handling and recording.
3. Email Services – Supporting marketing campaigns under anti-spam laws.
4. Push Notifications – Delivering time-sensitive alerts.
5. Video Services – Enabling secure video conferencing with data privacy compliance.

All activities under this document are conducted in compliance with applicable Data Protection Laws, including cross-border data transfer frameworks, ensuring legal and regulatory adherence in all jurisdictions where hiublue operates.

ARTICLE 2: DISCLOSURE REQUESTS AND COMPLIANCE OBLIGATIONS

 

2.1 Submitting Disclosure Requests

hiublue responds to disclosure requests only when they meet all the following criteria, ensuring compliance with legal, procedural, and jurisdictional standards:

1. Source: The request must originate from a recognized government or law enforcement agency with verifiable credentials.
2. Jurisdiction: The request must be issued by an authority within a jurisdiction where hiublue is subject to legal obligations.
3. Legal Instrument: The request must be supported by a valid and enforceable legal instrument, such as a subpoena, court order, or search warrant.
4. Specificity: Requests must specify the type and scope of records sought, including a detailed description of data categories and timeframes.

hiublue requires that authorities explicitly state legal provisions that prevent notification to customers if customer notification is prohibited. In the absence of such provisions, hiublue commits to notifying affected customers promptly.

2.2 International Disclosure Requests

For requests originating outside hiublue’s jurisdiction, additional requirements apply to ensure compliance with international legal frameworks, such as:

1. Mutual Legal Assistance Treaties (MLATs): These treaties are essential for international cooperation and legally binding disclosure.
2. Letters Rogatory: A formal request issued by a foreign court, processed through diplomatic channels.

hiublue discloses data only when such mechanisms are employed, ensuring adherence to both local and international laws.

2.3 Emergency Disclosure Requests

In cases involving an immediate and substantial threat to life or physical safety, hiublue may disclose information to prevent the threat. Emergency disclosure requests are subject to the following stringent criteria:

1. Submission: Must be submitted in writing from a verifiable government or law enforcement email domain.
2. Authorization: Requests must be issued by an official with legitimate authority.
3. Emergency Justification: The requesting party must provide a detailed explanation of the nature and imminence of the emergency, linking the data requested to the potential threat.
4. Necessity and Proportionality: The request must demonstrate why the data is essential to preventing the threat and why alternative procedures are inadequate.
5. Identification and Contact Information: Includes the identity and contact details of the official making the request.
6. Specificity: Requests must detail the exact data sought, including account identifiers and the relevant timeframe.

2.4 Response Time

hiublue strives to respond to valid disclosure requests within ten (10) business days, subject to the complexity and scope of the request. Expedited responses are considered for emergencies or urgent legal requirements, provided the urgency is explicitly detailed in the request.

2.5 Customer Notification

Unless prohibited by applicable law, hiublue is committed to notifying customers before disclosing their data in response to any legal or government request. This notification will include:

1. Details of the Request: The legal basis and scope of the request.
2. Timeline for Disclosure: Indicating when data will be disclosed unless legally restricted.

In cases where notification is legally prohibited, hiublue will seek to challenge such restrictions, balancing its obligations to customers and compliance with the law.

2.6 Confidentiality and Data Protection

hiublue ensures that all data disclosed in response to legal requests is handled securely and with utmost confidentiality. Measures include:

1. Encryption: Data is encrypted during transfer and securely delivered to authorized entities.
2. Access Controls: Only authorized personnel handle disclosure requests.
3. Auditing: Comprehensive records are maintained for all disclosures to ensure accountability.

2.7 Contact Information for Disclosure Requests

All disclosure requests, including emergency requests, must be directed to hiublue’s legal department at disclosure@hiublue.com. Emergency requests should include “URGENT” in the subject line to ensure prompt attention.

ARTICLE 3: DATA PROCESSING AND SECURITY STANDARDS

 

3.1 Purpose and Scope of Data Processing

hiublue, LLC (“hiublue”) processes Customer Personal Data to deliver its services effectively, securely, and in compliance with all applicable Data Protection Laws. The scope of processing activities includes:

1. Provision of Services: Collecting, storing, transmitting, and analyzing data to support SMS, Voice, Email, Push Notifications, and Video Services.
2. Security and Maintenance: Safeguarding service integrity through regular updates, monitoring, and enhancements.
3. Customer Support: Addressing queries, resolving technical issues, and providing tailored assistance.
4. Regulatory Compliance: Ensuring adherence to GDPR, CCPA, and other relevant regulations.

This document and associated Data Processing Addendums (DPAs) define the full scope of hiublue’s obligations as a Data Processor.

3.2 Customer Instructions

hiublue processes Customer Personal Data solely based on documented instructions provided by the Customer, as outlined in this document and supplemental instructions agreed upon in writing. The Customer assumes responsibility for ensuring that all instructions are lawful and within the scope of applicable regulations.

3.3 Categories of Data Processed

hiublue processes the following categories of data, as detailed in Annex I of the Data Processing Addendum:

1. Personal Identifiers: Names, email addresses, phone numbers, and similar identifiers.
2. Financial Information: Billing and payment details required for invoicing and fraud prevention.
3. Traffic Data: Metadata related to communications, such as IP addresses and timestamps.
4. Communication Content: Message and call content, processed only for service delivery.

3.4 Data Security Measures

hiublue implements industry-leading technical and organizational measures (TOMs) to protect Customer Personal Data, including but not limited to:

1. Access Controls: Role-based access restrictions, multi-factor authentication, and periodic audits of access logs.
2. Encryption: End-to-end encryption of data in transit and at rest using AES-256 and TLS protocols.
3. Incident Response: Comprehensive breach detection, response, and mitigation procedures, ensuring timely notifications to affected parties.
4. Data Minimization: Limiting the collection and retention of data to what is strictly necessary for service delivery and compliance.

3.5 Sub-Processors and Third-Party Providers

hiublue may engage sub-processors to support the delivery of its services. The following streamline the definition of sub-processors while maintaining clarity:

1. Primary Sub-Processors: hiublue works with trusted sub-processors, including but not limited to:

• Amazon Web Services (AWS): Provides secure data storage, cloud hosting, and infrastructure services essential for delivering hiublue’s services.
• OpenAI: Supports artificial intelligence-driven features within hiublue’s platform. All processing is limited to documented instructions and ensures compliance with applicable Data Protection Laws.

1. Contractual Safeguards: hiublue ensures all sub-processors meet equivalent security and data protection standards, as outlined in contractual agreements, including:

• Clear data processing instructions and limitations.
• Obligations to comply with GDPR, CCPA, and other applicable regulations.

1. Streamlined Notifications: Customers are informed of new sub-processors in advance through updates published on hiublue’s website. Objections must be raised within 10 business days of notice, specifying reasonable concerns related to data security or privacy.

3.6 Data Retention and Deletion

Customer Personal Data is retained only as long as necessary for the purposes defined in this document , after which it is securely deleted or anonymized. Specific retention periods include:

1. Operational Data: Retained for up to 90 days post-termination of the service.
2. Backup Data: Securely stored for 30 days and then permanently deleted.

Upon termination of the Document, Customers may request the return or deletion of their data. hiublue will confirm completion within 30 business days of the request.

3.7 Breach Notification

In the event of a Personal Data Breach, hiublue will:

1. Notify the Customer within 48 hours of becoming aware of the breach.
2. Provide a detailed report including the nature of the breach, data affected, and mitigation steps taken.
3. Offer reasonable assistance in fulfilling legal obligations to notify Data Subjects or Supervisory Authorities.

3.8 International Data Transfers

hiublue ensures lawful cross-border data transfers by adopting mechanisms such as:

1. Standard Contractual Clauses (SCCs): Compliant with GDPR and other international standards.
2. Privacy Frameworks: Adherence to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.
3. Supplementary Measures: Additional safeguards, including encryption and data localization options.

3.9 Assistance with Data Subject Rights

hiublue supports Customers in meeting their obligations under Data Protection Laws to address Data Subject requests, such as:

1. Access: Providing records of data processed.
2. Rectification and Deletion: Facilitating corrections or deletions upon verified requests.
3. Portability: Delivering data in structured, machine-readable formats as required by law.

3.10 Compliance Audits

Customers may request summaries of hiublue’s compliance certifications, including ISO27001 and SOC 2 Type II. Additionally, independent audits can be conducted, subject to prior written approval and adherence to confidentiality agreements.

ARTICLE 4: PRIVACY AND DATA USAGE

 

4.1 Purpose and Commitment to Privacy

hiublue, LLC (“hiublue”) is committed to safeguarding the privacy of its Customers, End-Users, and Website Visitors by adhering to strong data protection principles. This section establishes the framework governing how hiublue processes, manages, and protects personal data across its services, in compliance with relevant legal and regulatory standards such as GDPR, CCPA, and PDPA. hiublue aims to provide transparency in data collection, usage, and sharing, empowering Customers to make informed decisions about their data privacy.

4.2 Scope

This section applies to all personal data processed by hiublue through its services, website, and affiliated platforms. hiublue processes personal data related to:

1. Website Visitors: Data collected through forms, cookies, and other web-based interactions.
2. Customers: Data provided by individuals or entities subscribing to hiublue’s services.
3. End-Users: Data of individuals interacting with hiublue’s services through Customer accounts, including recipients of SMS, Voice, Email, or other communication services.

4.3 Legal Basis for Data Processing

hiublue processes personal data based on one or more of the following legal bases:

1. Explicit Consent: Obtained prior to processing for marketing, analytics, or other specified purposes.
2. Contractual Necessity: Processing required for the performance of contractual obligations between hiublue and the Customer.
3. Legal Obligations: Compliance with statutory or regulatory requirements, such as financial reporting or responding to disclosure requests.
4. Legitimate Interest: Processing necessary for legitimate business purposes, including service improvement and fraud prevention, provided it does not infringe on individual rights.

4.4 Categories of Data Collected

hiublue collects and processes various types of personal data, including:

1. Personal Identifiers: Names, email addresses, phone numbers, and IP addresses.
2. Account Information: Payment details, subscription preferences, and account credentials.
3. Communication Data: Content and metadata of SMS, Voice, Email, or Push Notification communications.
4. Technical Data: Browser type, operating system, device identifiers, and cookie data.
5. hiublue ensures that all collected data is strictly necessary for the specified purposes and minimizes data processing wherever possible.

4.5 Data Usage and Sharing

hiublue uses personal data to deliver services, enhance user experience, and ensure regulatory compliance. Specifically:

1. Service Delivery: Processing data to facilitate SMS, Voice, Email, and other communication services.
2. Customer Support: Using data to resolve queries, troubleshoot issues, and provide tailored assistance.
3. Fraud Prevention: Monitoring and analyzing usage patterns to detect and prevent unauthorized or malicious activity.
4. Marketing and Analytics: Subject to consent, hiublue may use data for promotional campaigns and performance analysis.
5. Personal data is shared only under the following circumstances:

• Service Providers: Trusted partners assisting in data hosting, analytics, and communication delivery under strict confidentiality agreements.
• Government Authorities: Data disclosed in response to valid legal requests, as outlined in hiublue’s Disclosure Policy.
• Affiliates: Sharing data within the hiublue group of companies to ensure seamless service delivery.

4.6 Rights of Data Subjects

hiublue upholds the rights of data subjects as prescribed by applicable laws, ensuring Customers and End-Users can:

1. Access Data: Request copies of personal data held by hiublue.
2. Rectify Errors: Correct inaccuracies in personal data.
3. Request Deletion: Seek erasure of personal data, subject to legal and contractual obligations.
4. Restrict Processing: Limit data processing under specific conditions.
5. Data Portability: Receive data in a structured, machine-readable format for transfer to another service provider.
6. Data subject requests are handled promptly and transparently, typically within 30 days of receipt.

4.7 International Data Transfers

hiublue facilitates cross-border data transfers in compliance with GDPR and other regulatory frameworks. Safeguards include:

1. Standard Contractual Clauses (SCCs): For transfers to jurisdictions lacking adequate data protection laws.
2. Privacy Frameworks: Adherence to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.
3. Encryption and Anonymization: Use of technical measures to secure data during international transfers.

4.8 Data Retention

hiublue prioritizes data retention policies for SMS and iMessage services as its core offerings. Non-core services such as email, push notifications, and video communications are excluded from hiublue’s internal data retention mechanisms. Customers utilizing non-core services must implement their own data management strategies.

4.9 Security Measures

hiublue implements stringent security protocols, including:

1. Encryption: Encrypting data in transit and at rest using AES-256 standards.
2. Access Controls: Restricting data access to authorized personnel.
3. Regular Audits: Conducting periodic security assessments to ensure ongoing compliance.

4.10 Data Breach Notification

In the event of a data breach, hiublue will:

1. Notify affected parties and regulatory authorities within 48 hours of detection.
2. Provide detailed information on the nature of the breach, affected data, and mitigation measures.
3. Offer assistance to affected Customers in fulfilling their legal obligations.

ARTICLE 5: GENERAL TERMS OF SERVICE

 

5.1 Scope and Applicability

This Article outlines the general terms governing the use of all services provided by hiublue, LLC (“hiublue”), including SMS, Voice, Email, Push Notifications, Video Services, and related offerings. These terms apply to all Customers, End-Users, and affiliates utilizing hiublue’s services, ensuring legal compliance, proper use, and adherence to hiublue’s policies and agreements.

The use of hiublue services signifies agreement to these terms, which are supplemental to any specific terms detailed in agreements or product-specific clauses. Violations may result in service suspension, termination, or liability for damages.

5.2 Permitted Use of Services

Customers are authorized to use hiublue’s services solely for lawful purposes and in compliance with applicable laws and regulations, including but not limited to:

1. Obtaining Consent: Ensuring valid opt-in consent is obtained from all recipients for communications, including marketing and non-essential messages.
2. Adhering to Local Laws: Compliance with country-specific laws governing telecommunication, spam prevention, and data privacy.
3. Content Standards: Ensuring that transmitted content is lawful, non-discriminatory, and free from hate speech, harassment, or malicious intent.
4. Identity Disclosure: Accurate representation of sender identity, prohibiting spoofing or misrepresentation of sender details.
5. Failure to adhere to these conditions may result in the immediate suspension of services without prior notice.

5.3 Prohibited Activities

hiublue strictly prohibits the following activities across its platforms:

1. Spam and Unsolicited Communications: Sending bulk or unsolicited messages without recipient consent.
2. Fraudulent Activities: Engaging in scams, phishing, or any activity designed to mislead recipients.
3. Transmission of Prohibited Content: Sharing illegal, harmful, or objectionable material, including but not limited to:
4. Hate speech or harassment.
5. Malware, viruses, or other harmful software.
6. Content violating intellectual property rights.
7. System Misuse: Using services to bypass spam filters, evade regulations, or conduct activities that disrupt hiublue’s operations.
8. Customers are responsible for monitoring End-User activities and ensuring compliance with these standards.

5.4 Customer Responsibilities

To maintain the integrity and functionality of hiublue’s services, Customers are required to:

1. Maintain Accurate Records: Including opt-in documentation and proof of consent for all recipients.
2. Secure Credentials: Protecting account details from unauthorized access.
3. Monitor and Address Complaints: Responding promptly to complaints or inquiries related to service usage.
4. Regularly Review Policies: Ensuring ongoing compliance with updates to hiublue’s terms and policies.

5.5 Service Availability

hiublue commits to providing continuous and reliable service; however, it reserves the right to:

1. Suspend Services: Temporarily or permanently suspend services for non-compliance, security risks, or other violations.
2. Modify or Discontinue Features: Update or terminate service features to improve performance, address legal requirements, or ensure compatibility with evolving technologies.
3. Customers will be notified of major service interruptions or changes in advance whenever possible.

5.6 Service Fees and Billing

1. Transparent Pricing: Service fees are outlined in hiublue’s pricing documentation or Customer agreements.
2. Usage-Based Charges: Certain services, such as Push Notifications or SMS, are billed based on usage metrics.
3. Invoice Timelines: Fees are billed monthly, annually, or as specified in the Customer agreement, with payment due within 30 days of invoice issuance.
4. Failure to pay may result in service suspension, additional fees, or termination.

5.7 Data Security and Privacy

hiublue prioritizes the security and confidentiality of Customer data by implementing strong measures:

1. Encryption: Encrypting data at rest and in transit to prevent unauthorized access.
2. Access Control: Restricting access to data based on role and need-to-know principles.
3. Regular Audits: Conducting internal and third-party security assessments to identify and mitigate risks.

5.8 Liability and Indemnification

1. Customer Liability: Customers are liable for damages arising from non-compliance, misuse, or unauthorized activities conducted through their accounts.
2. hiublue Liability: hiublue is not responsible for indirect, incidental, or consequential damages arising from service use, unless otherwise specified by applicable law.
3. Indemnification: Customers agree to indemnify hiublue against claims, losses, or damages arising from violations of these terms.

ARTICLE 6: PRODUCT-SPECIFIC SERVICE TERMS

 

6.1 SMS Services

hiublue’s SMS Services allow Customers to transmit messages over various networks, including mobile and IP communication channels. The following terms govern the use of SMS services:

6.1.1 Consent and Compliance

Customers must:

1. Obtain Opt-In Consent: Ensure explicit recipient consent before sending any SMS, particularly for marketing communications.
2. Opt-Out Mechanisms: Include opt-out options in local languages and honor opt-out requests promptly.
3. Adhere to Country-Specific Laws: Comply with all local, state, and federal regulations, including do-not-call or do-not-disturb registries.

6.1.2 Prohibited Content

hiublue prohibits the transmission of the following content via SMS:

1. Illegal or Harmful Material: Content violating laws of the recipient’s jurisdiction.
2. Hate Speech and Harassment: Messages containing discriminatory or abusive language.
3. Fraudulent Content: Scams, phishing, or other misleading communications.

6.1.3 Fraud Prevention and Monitoring

Customers must:

1. Monitor Usage: Prevent unauthorized access and misuse of SMS services.
2. Provide Documentation: Supply proof of recipient consent upon hiublue’s request within 24 hours.
3. Violations may result in service suspension, penalties, or legal liability.

6.2 Voice Services

hiublue’s Voice Services enable the transmission of audio communications. These terms outline acceptable use and responsibilities:

6.2.1 Emergency Service Restriction

Voice Services cannot be used for emergency communications, such as dialing 911 or equivalent services.

6.2.2 Caller Information and Consent

Customers must:

1. Provide Accurate Caller ID: Avoid spoofing or misrepresentation of caller identity.
2. Obtain Prior Consent: Notify and secure recipient consent for call recordings, ensuring compliance with applicable laws.

6.2.3 Call Restrictions and Monitoring

Customers must adhere to:

1. Call Timing Restrictions: Avoid unsolicited calls during restricted hours.
2. Fraudulent Activity Prevention: Cease use and notify hiublue if fraudulent activities are detected.
3. hiublue reserves the right to investigate and take corrective actions, including notifying authorities.

6.3 Email Services

hiublue’s Email Services include tools for email automation, analytics, and delivery. The following guidelines govern their use:

6.3.1 Permission-Based Marketing

Customers must:

1. Use Opt-In Lists: Only send emails to recipients who have actively consented.
2. Include Unsubscribe Links: Ensure every email has a working opt-out mechanism.

6.3.2 Restricted Content

The following data must not be processed through hiublue’s Email Services:

1. Protected Health Information (PHI).
2. Financial account details.
3. Sensitive personal data under GDPR.

6.3.3 Anti-Spam Compliance

Customers must comply with anti-spam laws, including:

1. The CAN-SPAM Act (United States).
2. GDPR (European Union).
3. Local data protection regulations.

6.4 Push Notifications API Services

hiublue’s Push Notifications API facilitates real-time messaging. These terms define its use:

6.4.1 Usage Limits

1. Free usage is capped as per hiublue’s pricing policy.
2. Notifications of 80% and 100% usage thresholds will be sent to account administrators.

6.4.2 Billing

Customers are billed based on usage metrics, with invoices issued on an annual or monthly basis depending on the selected plan.

6.5 Video Services

hiublue provides video communication platforms designed to support secure and efficient virtual meetings. The following conditions govern the use of video services:

6.5.1 Recording and Storage

1. Consent Requirements: Customers must notify all participants before initiating any recording and obtain all necessary legal permissions.
2. Encrypted Storage: Recorded content is stored securely and is available for download by authorized users only.

6.5.2 Fair Use Policy

1. Customers are prohibited from exceeding reasonable usage limits as defined in their service plans. Excessive use of video services beyond agreed-upon limits may result in additional charges or temporary suspension.
2. Unauthorized integration of third-party tools with hiublue’s video platform is prohibited and may lead to service termination.

6.5.3 Prohibited Uses

1. Customers must not use video services for unlawful purposes, including but not limited to the violation of anti-spam, privacy, or data protection laws.
2. Video services cannot be used for content streaming or hosting not directly related to legitimate video conferencing.

6.5.4 Service Limitations

hiublue’s video services are not integrated with SMS or iMessage platforms. Customers seeking enhanced functionalities should consult hiublue’s product catalog for optional add-ons or additional services.

6.6 Numbers Services

hiublue provides telephone numbers and short codes for communication purposes.

6.6.1 Usage and Ownership

Customers are granted temporary use of telephone numbers but do not own these numbers. hiublue reserves the right to reclaim numbers under specific conditions, such as inactivity.

6.6.2 Compliance Obligations

Customers must register and disclose the intended use of numbers to hiublue. Misuse or non-compliance may result in service suspension.

6.7 General Provisions for Product-Specific Services

For all hiublue services, Customers are responsible for ensuring compliance with these terms and any applicable laws. Failure to comply may result in suspension, termination, or legal action. hiublue reserves the right to update these terms periodically, with advance notice provided to Customers.

6.8 Third-Party Communication Services

6.8.1 Purpose and Scope

This section applies to Customers explicitly using hiublue’s integration with third-party communication services, including but not limited to Apple Messages for Business, WhatsApp, and similar platforms. These provisions do not affect Customers who do not use these services.

6.8.2 Customer Obligations

1. Compliance with Third-Party Terms: Customers must adhere to the specific terms and conditions of the third-party platform, including:

• Provisions on data privacy and message content.
• Rules regarding message rates, quotas, and usage limits.
• Technical guidelines for integration and operation.

1. Opt-In Requirement: Explicit opt-in consent from End-Users is mandatory for all communications sent via these platforms.

6.8.3 hiublue’s Role and Responsibilities

1. Facilitator Role: hiublue serves as a data processor and intermediary, enabling integration with third-party platforms while ensuring secure transmission and compliance with applicable regulations.
2. Service Quality: hiublue will not guarantee the availability, reliability, or performance of third-party platforms and will inform Customers of any known disruptions or policy changes.

6.8.4 Liability for Non-Compliance

Customers bear sole liability for non-compliance with the policies of the third-party platform. Any breach of these policies may result in service suspension or termination for the relevant integration.

6.8.5 Modification of Integration

hiublue reserves the right to modify or terminate support for specific third-party platforms, provided that Customers receive reasonable notice (at least 30 days), unless immediate action is required by legal or regulatory obligations.

ARTICLE 7: CUSTOMER OBLIGATIONS AND RESPONSIBILITIES

 

7.1 General Compliance Obligations

Customers agree to adhere to all applicable laws, regulations, and hiublue’s terms and policies when utilizing the services. Customers assume full responsibility for their usage and must ensure that any data processing, communication, and content transmitted comply with these requirements.

7.1.1 Legal Compliance

Customers must:

1. Adhere to Local and International Laws: Ensure compliance with laws such as GDPR, CCPA, PDPA, and others relevant to their jurisdiction.
2. Obtain Consent: Secure valid consent from individuals before processing personal data or transmitting messages.
3. Prohibit Unlawful Content: Avoid using the services to send messages containing prohibited or harmful content.

7.1.2 Compliance Documentation

Customers are required to maintain records demonstrating compliance, including:

1. Proof of consent for all recipients of communications.
2. Records of legal assessments and risk evaluations related to data processing activities.

7.2 Data Privacy and Security Responsibilities

Customers are responsible for implementing adequate measures to ensure the security and lawful processing of personal data transmitted or stored via hiublue’s services.

7.2.1 Data Accuracy

Customers must ensure that all personal data shared with hiublue is accurate, complete, and up-to-date.

7.2.2 Secure Credentials

Customers must:

1. Maintain the confidentiality of their login credentials.
2. Use multi-factor authentication (MFA) where applicable.
3. Immediately report unauthorized access or suspicious activities to hiublue.

7.2.3 End-User Data Handling

When acting as data controllers, Customers must:

1. Ensure they have the appropriate rights and consents to process End-User data.
2. Inform End-Users of data processing activities and their rights under applicable laws.

7.3 Responsibilities Regarding Messaging Services

When using hiublue’s messaging services, Customers must ensure that:

1. Opt-In and Opt-Out Mechanisms: Recipients can easily opt in or out of communications, with opt-out requests honored within 24 hours.
2. Prohibited Content: Messages do not contain hate speech, malware, or other harmful content.
3. Content Validity: All messages accurately represent the sender’s identity and purpose.

7.4 Monitoring and Reporting Obligations

Customers are required to monitor their usage of hiublue’s services and report any violations of terms or legal obligations.

7.4.1 Incident Reporting

Customers must notify hiublue within 48 hours of discovering any:

1. Data breaches involving personal data processed through hiublue’s services.
2. Unauthorized use of their accounts.

7.4.2 Cooperation with Audits

Customers agree to cooperate with any hiublue-led investigations or audits to ensure compliance.

7.5 Financial Obligations

Customers are responsible for timely payment of service fees as outlined in their agreements with hiublue. This includes charges for additional usage or violations of usage limits.

7.5.1 Penalties for Non-Payment

Failure to pay fees may result in:

1. Suspension or termination of services.
2. Accrual of late payment fees as defined in the agreement.

7.6 Content and Communication Standards

7.6.1 Prohibited Activities

Customers must not use hiublue’s services to:

1. Transmit spam, fraudulent, or misleading communications.
2. Engage in activities that harm hiublue’s network or reputation.

7.6.2 Restricted Content

Customers are prohibited from transmitting sensitive personal data, such as:

1. Financial account information.
2. Protected Health Information (PHI).
3. Government-issued identifiers, except when explicitly authorized.

7.7 Termination of Responsibilities

Upon termination of the service agreement:

1. Customers must cease using hiublue’s services immediately.
2. Customers are responsible for securely deleting or returning all data shared with hiublue.
3. Any outstanding payments must be settled before termination takes effect.

ARTICLE 8: SUB-PROCESSORS AND DATA SHARING

 

8.1 Introduction to Sub-Processors

hiublue, LLC (“hiublue”) engages Sub-Processors to support the delivery of its services while ensuring compliance with all relevant Data Protection Laws, including the GDPR, CCPA, and other applicable regulations. Sub-Processors are third-party entities contracted to process Customer Personal Data on behalf of hiublue, solely within the scope defined in this document and the associated Data Processing Agreement (“DPA”).

8.2 Appointment of Sub-Processors

hiublue ensures that all Sub-Processors meet strict security and privacy standards by following these principles:

1. Limited Access: Sub-Processors are granted access to Customer Personal Data only to the extent necessary to fulfill their designated functions under the Sub-Processor agreement.
2. Contractual Safeguards: Each Sub-Processor agreement incorporates data protection obligations consistent with this document and the DPA, ensuring compliance with applicable laws and industry standards.
3. Liability: hiublue remains fully liable to the Customer for any failure by a Sub-Processor to meet its data protection obligations.

8.3 Notification of Sub-Processor Changes

hiublue will notify Customers of any intended additions or replacements of Sub-Processors, providing the opportunity to object under the following conditions:

1. Notification Timeline: Customers will receive a minimum of ten (10) business days’ notice before a new Sub-Processor is engaged.
2. Grounds for Objection: Customers may object to a new Sub-Processor by providing a written explanation detailing concerns regarding data protection or security.
3. Resolution: hiublue will work in good faith to address objections. If no resolution is possible, the Customer may terminate the affected services without penalty.

8.4 Data Sharing Practices

hiublue shares Customer Personal Data with Sub-Processors and other entities only under the following circumstances:

8.4.4 Third-Party Service Providers

hiublue engages trusted third-party providers, including but not limited to Apple Messages for Business, WhatsApp, and other specialized communication platforms, under the following conditions:

1. Applicability: These provisions are relevant only to Customers who explicitly opt to integrate or utilize these third-party services as part of hiublue’s offerings. Customers who do not use these services are not subject to these specific provisions.
2. Service-Specific Terms: Third-party service usage is governed by the respective platform’s terms and conditions, including but not limited to data usage policies, rate structures, and compliance obligations. hiublue ensures alignment with such terms when acting as an intermediary.
3. Customer Responsibility: Customers using third-party services are required to:
4. Familiarize themselves with the terms of the relevant third-party service providers.
5. Ensure compliance with such terms, particularly regarding content standards, data sharing permissions, and lawful usage requirements.
6. Data Sharing Scope: hiublue may share specific Customer Data with third-party service providers solely to enable the requested services. This includes necessary metadata, such as message content, recipient information, and timestamps.
7. Notification and Consent: Customers must notify their End-Users of the involvement of third-party providers, where required by law or the terms of the third-party service.
8. Liability Disclaimer: hiublue is not liable for actions or omissions by third-party service providers, except where such liability arises directly from hiublue’s negligence or failure to adhere to its obligations under this document.
9. Termination or Modification of Service: hiublue reserves the right to discontinue integration with a third-party service provider with a 30-day prior notice to Customers using that service, unless an immediate cessation is required by law.

8.5 Cross-Border Data Transfers

To deliver global services, hiublue transfers Customer Personal Data internationally under the following safeguards:

1. Standard Contractual Clauses (SCCs): hiublue implements SCCs for transfers to non-adequate jurisdictions.
2. Binding Corporate Rules (BCRs): Where applicable, hiublue applies BCRs to standardize data protection practices across affiliates.
3. Supplementary Measures: Encryption, pseudonymization, and other technical controls are applied to mitigate risks during cross-border transfers​.

8.6 Security Standards for Sub-Processors

hiublue ensures that Sub-Processors comply with the following security requirements:

1. Access Control: Role-based access to Customer Personal Data, limited to authorized personnel.
2. Encryption: Mandatory encryption of data in transit and at rest.
3. Regular Audits: Periodic security assessments and compliance reviews to verify adherence to contractual obligations.

8.7 Customer Access to Sub-Processor Information

hiublue provides Customers with transparency regarding its Sub-Processors by:

1. Publishing an up-to-date list of active Sub-Processors on its website or Customer portal.
2. Responding to Customer inquiries about specific Sub-Processors and their compliance measures.

ARTICLE 9: INTERNATIONAL DATA TRANSFERS

 

9.1 Scope of International Transfers

hiublue, LLC (“hiublue”) provides services to a global audience, necessitating the transfer of Customer Personal Data across borders. All such transfers comply with applicable Data Protection Laws, ensuring the protection and integrity of Customer Personal Data.

9.2 Legal Mechanisms for Transfers

hiublue employs the following mechanisms for international data transfers:

1. Standard Contractual Clauses (SCCs): Used for transfers outside the European Economic Area (EEA) or to jurisdictions lacking an adequacy decision under GDPR.
2. Binding Corporate Rules (BCRs): Where applicable, ensuring consistent data protection standards across hiublue’s global entities.
3. Privacy Frameworks: Adherence to frameworks such as the EU-U.S. Data Privacy Framework for data transfers to the United States​.

9.3 Data Transfer Impact Assessments (TIAs)

Before initiating transfers to countries lacking adequate data protection laws, hiublue conducts thorough TIAs. These assessments evaluate:

1. The legal framework of the recipient country.
2. Supplementary measures required to mitigate risks, including encryption and pseudonymization.

9.4 Customer Responsibilities

Customers are required to:

1. Verify Legal Basis: Ensure the legitimacy of data transfers in their jurisdictions.
2. Provide Instructions: Clearly document data transfer instructions in agreements with hiublue.

9.5 Data Subject Rights and Remedies

hiublue guarantees data subject rights are enforceable during and after international data transfers, including the right to access, rectify, and delete data.

ARTICLE 10: RIGHTS OF DATA SUBJECTS

 

10.1 Overview of Data Subject Rights

hiublue recognizes the rights of individuals (“Data Subjects”) under applicable Data Protection Laws, including but not limited to:

1. General Data Protection Regulation (GDPR) for EEA residents.
2. California Consumer Privacy Act (CCPA) for California residents.
3. Personal Data Protection Act (PDPA) for individuals in Singapore​.

10.2 Data Subject Rights Supported by hiublue

hiublue facilitates the following rights for Data Subjects:

10.2.1 Right to Access

Data Subjects can request:

1. Details of personal data processed by hiublue.
2. The purpose of processing and categories of data involved.
3. Third-party recipients of their data.

10.2.2 Right to Rectification

Individuals may request corrections to inaccurate or incomplete personal data processed by hiublue.

10.2.3 Right to Erasure (“Right to Be Forgotten”)

Data Subjects may request the deletion of their data under the following conditions:

1. When data is no longer necessary for the purpose for which it was collected.
2. When consent has been withdrawn and no other legal basis exists for processing.

10.2.4 Right to Restriction of Processing

Data Subjects may request processing limitations in cases of:

1. Disputes over data accuracy.
2. Unlawful processing where the individual opts for restriction instead of deletion.

10.2.5 Right to Data Portability

hiublue provides structured, machine-readable data formats to support data transfer to other service providers at the Data Subject’s request.

10.2.6 Right to Object

Data Subjects can object to processing based on legitimate interests, including profiling or direct marketing. hiublue will honor objections unless overriding legitimate grounds are demonstrated.

10.3 Processes for Exercising Rights

hiublue ensures easy access for Data Subjects to exercise their rights:

1. Submission Methods: Data Subjects can contact hiublue via privacy@hiublue.com to submit requests.
2. Verification: Requests are subject to identity verification to prevent unauthorized access.
3. Response Time: hiublue responds to requests within 30 days, extendable by an additional 30 days for complex cases.

10.4 Customer Obligations

Customers, as data controllers, are responsible for:

1. Facilitating Requests: Supporting Data Subject rights and forwarding requests to hiublue where applicable.
2. Transparency: Informing Data Subjects about their rights and hiublue’s data processing activities in privacy notices​.

ARTICLE 11: SECURITY MEASURES

11.1 Overview of Security Measures

hiublue, LLC (“hiublue”) is committed to safeguarding the confidentiality, integrity, and availability of Customer Personal Data by implementing strong security practices in compliance with applicable Data Protection Laws, including GDPR, CCPA, and other regulations. These measures are designed to mitigate risks and ensure secure data processing environments.

11.2 Technical and Organizational Measures

hiublue employs industry-leading technical and organizational measures, including:

11.2.1 Encryption

1. Data in Transit: All data transmitted through hiublue’s platforms is encrypted using protocols such as TLS 1.2 or higher.
2. Data at Rest: Sensitive data is encrypted using Advanced Encryption Standard (AES) 256-bit encryption or equivalent technologies.

11.2.2 Access Control

1. Role-Based Access: Access to systems and data is restricted to authorized personnel based on their roles and responsibilities.
2. Multi-Factor Authentication (MFA): MFA is enforced for all administrative accounts to enhance login security.
3. Audit Trails: Comprehensive logs are maintained to track data access and modifications.

11.2.3 Intrusion Detection and Prevention

hiublue monitors its infrastructure using intrusion detection and prevention systems (IDPS) to identify and respond to unauthorized access or anomalies in real time.

11.2.4 Physical Security

hiublue’s data centers comply with ISO 27001 standards, featuring 24/7 surveillance, biometric access controls, and environmental protections to safeguard physical infrastructure.

11.3 Personal Data Breach Response

hiublue has a detailed incident response plan to address Personal Data Breaches, including:

1. Notification: Customers will be notified within 48 hours of a confirmed breach involving their data.
2. Investigation and Remediation: hiublue will investigate the breach, implement corrective measures, and provide updates to affected Customers.
3. Customer Support: Assistance will be provided to Customers in meeting their regulatory reporting obligations.

11.4 Updates to Security Measures

hiublue regularly reviews and updates its security measures to address evolving threats and ensure compliance with regulatory requirements​.

ARTICLE 12: DATA RETENTION AND DELETION

12.1 Data Retention Policy

hiublue focuses on retaining and processing Customer data only for the primary services offered.

12.1.1 Retention Periods for Core Services

hiublue retains SMS and iMessage data for the following durations, in compliance with applicable regulations:

1. a) Message Logs: Retained for up to 12 months post-transmission to ensure accurate billing, compliance audits, and customer support services.
2. b) Message Content: Retained for a maximum of 30 days to facilitate delivery, troubleshoot issues, and ensure compliance with legal obligations.
3. c) Metadata: Retained for up to 90 days for analysis and regulatory reporting purposes.

12.1.2 Non-Core Services

hiublue no longer retains email or video communication data unless expressly required by a legal or contractual obligation. Customers using such services are advised to manage retention within their own systems.

12.2 Deletion and Anonymization for SMS and iMessage Data

hiublue ensures prompt deletion or anonymization of SMS and iMessage data upon the end of its retention period. Specific measures include:

1. a) Automated Deletion: Message logs and content are automatically purged from hiublue’s systems after their respective retention periods.
2. b) Customer-Initiated Deletion: Customers may request immediate deletion of specific SMS or iMessage records, provided such deletion does not conflict with legal or regulatory requirements.

12.2.1 Exemptions

hiublue may retain SMS or iMessage data beyond standard retention periods only if:

Required by a court order or legal investigation.

Necessary for ongoing dispute resolution or contractual enforcement.

12.3 Customer Responsibilities for SMS and iMessage Data

Customers are responsible for ensuring that their usage of SMS and iMessage data complies with all relevant data retention policies, including downloading necessary records before deletion.

12.4 Exceptions to Deletion

hiublue may retain certain data if required by law or to meet the following obligations:

1. Legal Defense: Data necessary for ongoing or anticipated legal proceedings.
2. Audit Requirements: Records needed to fulfill audit or regulatory reporting standards.

12.5 Customer Responsibilities

Customers are responsible for ensuring the accuracy of their data and complying with data retention and deletion requests submitted to hiublue. Any delay in providing accurate instructions for deletion may impact compliance timelines.

ARTICLE 13: BREACH NOTIFICATION

13.1 Overview

hiublue is committed to promptly addressing and mitigating the impact of any Personal Data Breach. A “Personal Data Breach” refers to any unauthorized or unlawful access, destruction, alteration, or disclosure of personal data, as defined by applicable data protection regulations.

13.2 Notification Obligations

In the event of a confirmed Personal Data Breach, hiublue will:

1. Timely Notification: Notify the affected Customer without undue delay and no later than 48 hours after becoming aware of the breach.
2. Details of Notification: Include the following information in the notification:

• The nature and scope of the breach, including the categories and volume of data involved.
• The potential or actual consequences of the breach.
• Measures taken or proposed to address the breach and mitigate its adverse effects.

13.3 Customer Cooperation

Customers are expected to:

1. Assist hiublue in meeting any regulatory reporting requirements associated with the breach.
2. Notify impacted data subjects as required by applicable laws, unless hiublue has already done so on their behalf.

13.4 Mitigation and Follow-Up

hiublue will:

1. Investigate the cause of the breach and take corrective actions to prevent recurrence.
2. Provide regular updates regarding the status of the investigation and resolution efforts.
3. Offer reasonable support to Customers to ensure compliance with legal and regulatory obligations related to the breach.

ARTICLE 14: AUDIT AND COMPLIANCE MECHANISMS

14.1 Audit Rights

hiublue acknowledges the right of Customers to verify compliance with its data protection obligations. Audits may include evaluations of data processing activities, security measures, and compliance with relevant agreements.

14.2 Request for Information

Customers may request the following to confirm compliance:

1. Audit Reports: Access to summaries of third-party certifications or audit reports.
2. Documentation: Internal policies, procedures, and records demonstrating adherence to security and privacy standards.

14.3 On-Site Audit Procedures

On-site audits may be conducted under these conditions:

1. Advance written notice of at least 60 days is required.
2. Audits must occur during regular business hours and minimize disruption to hiublue’s operations.
3. Auditors must adhere to strict confidentiality agreements before beginning the audit.

14.4 Frequency of Audits

Audits are permitted no more than once annually unless:

1. A material change occurs in data processing practices.
2. A significant data breach necessitates additional oversight.

14.5 Costs and Responsibilities

1. Customers are responsible for covering costs associated with audits they initiate, including reasonable costs incurred by hiublue.
2. hiublue reserves the right to reject audit requests that compromise other customers’ confidentiality or proprietary information.

ARTICLE 15: FEES, INVOICING, AND BILLING POLICIES

15.1 Payment Obligations

All services provided by hiublue will commence only upon receipt of advance payment. Customers are required to pay service fees as outlined in the applicable Order Form, pricing page, or agreement.

15.1.1 Advance Payment Policy

1. Services, including renewals and upgrades, require full advance payment unless explicitly waived by a written agreement.
2. Payments must be made in the currency specified in the invoice or order confirmation.

15.1.2 Fee Structure

hiublue’s fees include:

1. Subscription Fees: Recurring charges for ongoing services based on selected plans.
2. One-Time Fees: Charges for setup, installation, or customization.
3. Usage-Based Fees: Charges calculated based on actual consumption of services, such as per-message or per-call rates for communication services.

15.2 Invoicing and Payment Terms

Invoices are issued in accordance with the selected billing frequency (monthly, quarterly, or annually) and must be paid within the specified payment period:

15.2.1 Invoice Details

Invoices will include:

1. Service description and applicable fees.
2. Tax amounts, if any, in compliance with local tax regulations.
3. Payment due date.

15.2.2 Payment Methods

Accepted payment methods include:

1. Credit/debit cards.
2. Bank transfers.
3. Digital wallets or payment processors as specified in the invoice.

15.2.3 Late Payments

Failure to pay invoices by the due date may result in:

1. Suspension or termination of services.
2. Late payment penalties of 1.5% per month or the maximum rate allowed by law.
3. Legal actions for recovery of unpaid amounts, with costs borne by the Customer.

15.3 Refunds and Disputes

1. Refunds will only be issued in cases of billing errors verified by hiublue.
2. Disputes must be raised in writing within 30 days of invoice issuance.

15.4 Chargebacks and Payment Reversals

15.4.1 Policy on Chargebacks

hiublue maintains a strict no-chargeback policy to ensure the integrity and continuity of its services. By agreeing to these terms, the Customer acknowledges and waives any right to dispute or initiate a chargeback for payments made for hiublue’s services.

15.4.1.1 No Chargeback Clause

1. All payments made to hiublue are final, non-refundable, and irrevocable unless otherwise stated in This document .
2. Customers agree not to initiate chargebacks, payment disputes, or reversals through their payment providers for any fees or charges associated with hiublue’s services.

15.4.1.2 Binding Nature of No Chargeback Policy

By using hiublue’s services and making payments, the Customer agrees that:

1. The payment represents a binding, authorized transaction for services rendered or to be rendered.
2. The Customer has reviewed and agreed to the terms, pricing, and service descriptions prior to payment.

15.4.2 Handling Unauthorized Chargebacks

In the event a chargeback is initiated, hiublue reserves the right to:

1. Immediate Service Suspension: Suspend all ongoing services associated with the Customer account until the matter is resolved.
2. Recovery of Disputed Amounts: Pursue recovery of the full chargeback amount, including administrative fees, legal costs, and penalties.
3. Additional Charges: Impose a chargeback penalty of up to $500 per unauthorized chargeback to cover administrative and recovery expenses.

15.4.3 Notification and Resolution Process

Customers are required to notify hiublue in writing of any billing discrepancies or concerns before initiating a chargeback. hiublue will:

1. Investigate disputes promptly and provide evidence to support the validity of the transaction.
2. Resolve legitimate disputes amicably within 30 days.
3. Failure to follow this notification process constitutes a breach of this document and nullifies any claim of unauthorized charges.

15.4.4 Liability and Indemnification

Customers initiating unauthorized chargebacks agree to:

1. Indemnify hiublue: Cover all costs, including legal fees, related to the resolution of the chargeback dispute.
2. Account Termination: Forfeit the right to future service usage if chargebacks are pursued in bad faith.

15.4.5 Prevention and Communication

1. hiublue provides detailed invoices and transaction receipts to prevent disputes.
2. Customers are encouraged to contact hiublue’s billing department immediately for clarification on charges or service-related concerns.

ARTICLE 16: SERVICE SUSPENSION AND TERMINATION

16.1 Grounds for Suspension

hiublue may suspend services under the following conditions:

16.1.1 Non-Payment

1. Failure to pay due invoices within the specified timeline.
2. Repeated chargebacks or payment reversals.

16.1.2 Breach of Terms

1. Violation of applicable laws or regulations.
2. Use of services for prohibited purposes, including spamming or unauthorized data sharing.

16.1.3 Security Threats

Detection of activities that pose a security threat, such as unauthorized access or attempted fraud.

16.1.4 Maintenance and Upgrades

Scheduled downtime for updates, provided Customers are given at least 48 hours’ notice unless urgent maintenance is required.

16.2 Termination of Services

Termination of services may occur under the following circumstances:

16.2.1 By hiublue

1. For cause: Any material breach of the agreement, including non-compliance with terms.
2. Without cause: hiublue may terminate with a 30-day notice, provided all fees are refunded for unused services.

16.3 Effects of Suspension or Termination

1. Services will cease immediately upon termination.
2. Customers are responsible for exporting data before the termination date.
3. hiublue retains the right to delete all data associated with terminated accounts after 30 days, unless retention is required by law.

16.4 Reinstatement of Services

Suspended services may be reinstated upon:

1. Full payment of outstanding dues, including penalties.
2. Resolution of issues leading to suspension.

16.5 Customer Responsibilities

Customers must:

1. Notify hiublue of intent to terminate and settle accounts promptly.
2. Adhere to data retention and export timelines post-termination.

Last Updated: November 25, 2024