Kraylo Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between KRAYLO LTD (company number 17324157) ("Kraylo", "Processor") and the customer identified in the applicable order form or subscription agreement ("Customer", "Controller"). It applies when Kraylo processes Personal Data for Customer in providing the Services.

1. Definitions and precedence

"UK Data Protection Laws" means the UK GDPR, Data Protection Act 2018, PECR where applicable, and other UK law relating to personal data, in each case as amended. "Personal Data", "Controller", "Processor", "Data Subject" and "Processing" have the meanings given in the UK GDPR.

If this DPA conflicts with the agreement on Personal Data processing, this DPA prevails to that extent.

2. Processing instructions

Kraylo will process Personal Data only on Customer's documented instructions, including as necessary to provide, secure, support and improve the Services in accordance with the agreement, unless UK Data Protection Laws require otherwise. If law requires processing, Kraylo will notify Customer before doing so unless prohibited by law.

Kraylo will not use Customer Data to train, fine-tune or improve any AI or machine learning model, except with Customer's prior written consent. Customer Data has the meaning given in the agreement and includes Personal Data processed under this DPA.

Customer warrants that it has provided all required notices, obtained all required consents and other lawful bases, and its instructions comply with UK Data Protection Laws.

Where Customer configures, requests or otherwise documents a retention period through the Services or in writing, Kraylo will apply that instruction subject to applicable law, technical limitations disclosed to Customer and any overriding legal requirement.

3. Confidentiality and security

Kraylo ensures that persons authorised to process Personal Data are bound by confidentiality obligations. Kraylo will implement appropriate technical and organisational measures, taking account of risk and the state of the art, including the measures described in Annex 2.

4. Subprocessors

Customer gives general written authorisation for Kraylo to use the subprocessors listed at /legal/subprocessors and their replacements. Kraylo will give at least 30 days' prior notice of a material new subprocessor where reasonably practicable. Customer may object on reasonable data-protection grounds within that period. The parties will work in good faith to resolve the objection; if they cannot, Customer may terminate the affected Services on written notice and receive a pro-rata refund of prepaid fees for the unused affected period. Kraylo will impose written obligations on each subprocessor that are no less protective than those in this DPA. Kraylo remains liable to Customer for the acts and omissions of its subprocessors to the same extent as if performing the services directly.

5. Assistance

Taking account of the nature of processing, Kraylo will provide reasonable assistance to Customer to respond to Data Subject requests. Taking account of available information and cost, Kraylo will assist Customer with security, breach notification, DPIA and prior-consultation obligations. Kraylo may charge reasonable fees where assistance exceeds normal support or is caused by Customer's breach.

6. Personal Data Breaches

Kraylo will notify Customer no later than 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data and will provide information reasonably available to help Customer meet its notification obligations. Kraylo will not notify Data Subjects unless required by law or agreed in writing.

7. Retention, deletion and return

Kraylo will retain Customer Personal Data only for as long as necessary to provide the Services, comply with Customer's documented instructions, meet applicable legal or regulatory requirements, or establish, exercise or defend legal claims.

Kraylo will maintain and apply a documented data-retention schedule covering the categories of Personal Data processed through the Services. Retention periods may vary according to the nature and purpose of the data, Customer instructions and applicable law.

On termination or expiry of the Services, Customer may instruct Kraylo to return or delete Customer Personal Data. Kraylo will, at Customer's choice, make the relevant Customer Personal Data available for export or securely delete it and will delete existing copies, unless UK law requires continued storage.

Where immediate deletion from backups or disaster-recovery copies is not technically practicable, Kraylo will place the relevant Personal Data beyond operational use, continue to protect it in accordance with this DPA, and delete it through the applicable backup expiry or destruction cycle.

Customer may request deletion, anonymisation or adjustment of retained Personal Data during the term where permitted by the Services and applicable law. Kraylo may retain Personal Data where continued retention is required by applicable law or is reasonably necessary for the establishment, exercise or defence of legal claims, and will limit such processing to those purposes.

Archiving, deactivating or revoking a user account does not by itself delete historical business or audit records associated with that user. Such records will instead be retained, deleted or anonymised in accordance with the applicable retention schedule, Customer instructions and UK Data Protection Laws.

8. Audits

On reasonable written request no more than once in any 12-month period, Kraylo will provide information reasonably necessary to demonstrate compliance. Where that is insufficient, Customer may conduct an audit through an independent auditor bound by confidentiality, during normal business hours and on reasonable notice, provided it does not unreasonably disrupt Kraylo or compromise other customers' security. Customer bears its costs.

9. Restricted transfers

Kraylo will not make a restricted transfer of Customer Personal Data unless it has a valid transfer mechanism under UK Data Protection Laws. Where appropriate, the parties agree to enter into the UK International Data Transfer Agreement or Addendum and take supplementary measures appropriate to the transfer.

Annex 1 - processing details

Annex 2 - security measures

• TLS/HTTPS in transit and provider-managed encryption at rest for databases, storage and backups;
• managed authentication with mandatory multi-factor authentication, signed sessions, role-based permissions and least-privilege access;
• tenant isolation using company identifiers and database row-level security;
• audit, authentication and security-event logging;
• input validation, controlled version-controlled releases, review/testing and post-release verification;
• managed infrastructure monitoring, daily database backups, seven-day backup retention and rollback capability; and
• time-bound, permissioned staff support access limited to product and deal configuration, without access to customer operational data.