Data Processing Addendum

You decide why and how the personal data in your workspace is processed; we process it only on your documented instructions: these terms, your use of the product, and your written instructions. If we think an instruction breaks the law we'll tell you.

• Subject matter and duration: providing Kairoq to you, for as long as you have a workspace and for the retention periods in the Privacy Policy.
• Nature and purpose: hosting, storing, organizing, retrieving, analysing (including with AI features you switch on), transmitting and deleting data as the product is used.
• Data subjects: your leads, contacts, customers, prospects, employees and other people whose data you or your users enter or connect.
• Types of data: names, contact details, job and company details, communications (emails, messages, call recordings and transcripts), meeting details, billing details, and anything else you choose to enter.

You are responsible for having a lawful basis and any consents needed to collect and use the data and to contact the people in it, for the accuracy of what you enter, and for configuring access (roles, permissions, connected tools) appropriately.

We maintain appropriate technical and organizational measures, including:

• Logical separation of every customer's data enforced in the database (row-level security), and least-privilege access for staff, with a log of platform-staff access to a customer's data that the customer can see.
• Encryption in transit (TLS) and at rest; per-organization encryption of email bodies and meeting transcripts; encrypted storage of integration tokens and payment credentials.
• Authentication controls: two-factor sign-in, single sign-on, lockout after repeated wrong passwords, rate limits and abuse protection.
• Role-based and field-level permissions, an audit log, and human approval for AI actions that send, delete or export data.
• Backups, monitoring, vulnerability management and a documented incident process.

Details are on our Security page.

People who can access Customer Data are bound by confidentiality obligations and only access it as needed to run, secure and support the service, or when you ask us to.

You authorize us to use the sub-processors on our Sub-processors page. We bind each to written terms with data protection obligations no less protective than these, and remain responsible for them. We'll email administrators at least 30 days before adding or replacing one; if you reasonably object on data protection grounds within that time, we'll work with you to find a solution, and if we can't you may cancel the affected service and receive a refund for the unused prepaid period.

The product lets your administrators export or erase a person's data (Settings → Data → Data requests) and respond to requests themselves. If someone contacts us about data we hold for you, we'll direct them to you, and we'll help you respond where the tools aren't enough.

We'll tell you without undue delay, and within 72 hours of becoming aware, of a breach affecting your personal data, with what we know about its nature, the data and people affected, likely consequences and what we are doing about it; and we'll keep you updated. We report incidents to the authorities (including CERT-In) as the law requires of us.

We'll reasonably help with your data protection impact assessments and consultations with authorities, taking into account the nature of the processing. Once a year (or after a breach) you may ask for information needed to show our compliance with this addendum, including answers to a security questionnaire; where that is not enough, we'll agree the scope, timing and confidentiality of an audit with you, at your cost.

Customer Data is stored in India (Mumbai). Our sub-processors may process it elsewhere as listed. Where the GDPR or UK GDPR applies and personal data is transferred to a country without an adequacy decision, the EU standard contractual clauses (Module 2, controller to processor) and, for the UK, the UK addendum are incorporated by reference, and we'll sign them on request.

You can export your data at any time, including while a workspace is frozen after a trial or cancellation. We keep a frozen workspace's data for at least 90 days, then delete it after 30 days' notice to the owner unless you ask us to do so sooner; an owner can delete the workspace themselves, which erases it after a 7-day grace period. Copies in backups are removed as they roll over, and we keep what the law requires us to (for example billing records).

Using an AI feature is an instruction from you to process the content it needs. We send an AI provider only what that request needs, under written terms that forbid using it to train or improve models and that treat it as your confidential data, and we never use Customer Data to train models ourselves. AI features support a person's decision; we do not subject people in Customer Data to decisions based solely on automated processing that have legal or similarly significant effects, and you agree not to configure or use them that way. See AI transparency.

If a public authority (in any country) asks us for Customer Data, we will direct it to you, and tell you before disclosing unless the law prohibits it. We examine each request, challenge it where there are reasonable grounds to think it is unlawful or overbroad, disclose only the minimum the law requires, and keep a record of it.

Where the California Consumer Privacy Act or another US state privacy law applies, you are the business or controller and we are your service provider or processor. We process personal information only for the business purposes in this addendum and the Terms. We will not:

• sell or share personal information (as those laws define the words);
• retain, use or disclose it for any purpose other than the specified business purposes, or outside our direct business relationship with you;
• combine it with personal information we receive from others or collect ourselves, except as those laws allow for a service provider.

We will comply with these laws as they apply to us, give the same level of protection they require, tell you if we can no longer meet them, help you answer consumer requests (see "Requests from people"), and let you take reasonable steps to stop and remediate unauthorised use. You may monitor our compliance through the information and audit rights above. We certify that we understand these restrictions.

Where the Digital Personal Data Protection Act, 2023 applies, you are the Data Fiduciary and we are your Data Processor, engaged under this valid contract (section 8 of the Act). We process personal data only on your instructions and for the purposes of the contract, keep reasonable security safeguards, tell you of a personal data breach so you can inform the Data Protection Board and affected Data Principals, and erase the data when you tell us or the purpose ends, as set out above.

For transfers subject to the GDPR to a country without an adequacy decision, the EU standard contractual clauses of 4 June 2021 (Decision (EU) 2021/914) are incorporated, as Module 2 (controller to processor), with these choices:

• Clause 7 (docking clause): included.
• Clause 9(a) (sub-processors): option 2, general written authorisation, 30 days' notice as in "Sub-processors".
• Clause 11(a) (independent dispute resolution): the optional language is not used.
• Clause 17 (governing law) and Clause 18 (forum): the law and courts of Ireland, unless your own law requires another EU Member State.
• Annex I.C (competent supervisory authority): the authority of the Member State in which you are established or your representative is located.
• UK transfers: the UK International Data Transfer Addendum, with the same choices and the Information Commissioner as the authority. Swiss transfers: the clauses with the Federal Data Protection and Information Commissioner as authority, and references to the GDPR read as references to the Swiss law.

Annex I.A (parties) is the customer and Kairoq; Annex I.B (description of the transfer) is "Roles and scope" above; Annex II (technical and organisational measures) is "Security measures" above; Annex III (sub-processors) is the Sub-processors page. If the clauses conflict with this addendum, the clauses prevail.

We keep a record of the processing we do for you, as GDPR Article 30(2) requires, and cooperate with a competent authority that asks us about it. If an authority contacts us about your data we will tell you unless the law prohibits it.

Liability under this addendum is subject to the limits in the Terms of Service, except that nothing limits either side's liability to a data subject under the standard contractual clauses, or any liability the law does not allow to be limited. If this addendum and the Terms conflict about the processing of personal data, this addendum prevails.