Legal
Data processing agreement
The terms on which Honch processes personal data on behalf of clients - client-uploaded lists, content and messaging, and campaign activity.
Last updated September 2026. Questions: privacy@honch.co.
Roles
For the Honch dataset, Honch is controller. For client-uploaded lists, content, messaging, mailbox sends and CRM feeds, Honch is processor and the client is controller.
Instructions
Honch processes client data only on the client’s documented instructions, which are the use of the service as configured by the client’s own users.
Security
Encryption in transit and at rest; OAuth-only mailbox and CRM connections; send-only mailbox scope; entitlement that fails closed; per-account isolation enforced in code; access logging; suppression applied on every read.
Sub-processors
Listed in Schedule 1 and notified 30 days before change: hosting (UK/EU), transactional email, AI inference under contract with no training on client data.
Assistance
Honch assists with data-subject requests, DPIAs and breach notification, notifying the client without undue delay and within 48 hours of becoming aware of a personal data breach affecting client data.
Deletion and return
On termination, client data is returned on request and deleted within 30 days, save where retention is required by law.
Audit
Honch provides its security summary and sub-processor list on request and permits an audit once per year on 30 days’ notice, at the client’s cost.