Data Processing Agreement
1. Parties and Definitions
The organisation (company, institution, or individual) that has accepted the KS Agents Terms of Service. Identified by the account name and email registered at sign-up.
Terms defined in Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and equivalent data protection laws have the same meaning herein. In particular:
- Personal data, processing, controller, processor, data subject — as defined in GDPR Art. 4.
- Sub-processor — any processor engaged by KS Agents to carry out processing activities on behalf of Controller.
- SCCs — Standard Contractual Clauses adopted by Commission Decision 2021/914/EU.
- Services — the KS Agents platform and all features described in the Terms of Service.
- Customer content — all personal data uploaded, generated, or processed through the Services by Controller.
2. Nature and Purpose of Processing (Annex A)
KS Agents processes personal data as described in Annex A solely to provide the Services to Controller. The full description of processing — including categories of data subjects, categories of personal data, and duration — is set out in Annex A at the end of this document.
3. Processor Obligations
KS Agents shall process personal data only on documented instructions from Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which KS Agents is subject; in such a case, KS Agents shall inform Controller of that legal requirement before processing, unless that law prohibits such information on grounds of public interest.
The Terms of Service and this DPA constitute the complete set of documented instructions. Controller may issue further instructions via the platform's administrative interface or in writing to [email protected]. KS Agents shall promptly notify Controller if, in its reasonable opinion, any instruction infringes applicable data protection law.
KS Agents ensures that persons authorised to process personal data on its behalf have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to customer content is restricted to KS Agents personnel and sub-processors who require access for the purpose of providing the Services.
KS Agents shall implement and maintain the technical and organisational measures set out in Annex C. These measures take into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons. KS Agents may update the measures in Annex C from time to time, provided the updated measures maintain at least an equivalent level of security.
By accepting this DPA, Controller grants KS Agents general written authorisation to engage the sub-processors listed in Annex B (Sub-processor Register).
For the purposes of this clause, sub-processor means a third party engaged by KS Agents that has access to customer content in connection with providing the Services. Ancillary services that do not involve such access — including telecommunications and connectivity, postal and shipping providers, maintenance and end-user support tooling, and other measures intended to safeguard the confidentiality, availability, integrity and resilience of KS Agents' systems — are not sub-processors within the meaning of this clause and do not require notice under this section.
KS Agents shall notify Controller at least 30 days before adding or replacing any sub-processor that may access customer content, by updating the sub-processor register at ks-agents.com/legal/subprocessors/ and sending email notice to Controller's registered email address.
Controller may object in writing to such addition or replacement within the 30-day notice period, on reasonable data protection grounds. If an objection is not resolved within the notice period, Controller may terminate the affected Services without penalty by providing written notice before the new sub-processor's intended effective date.
Where KS Agents engages a sub-processor, it shall impose on that sub-processor the same data protection obligations as set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of GDPR.
KS Agents shall assist Controller in responding to requests from data subjects exercising their rights under Chapter III GDPR (including the rights of access, rectification, erasure, restriction of processing, data portability, and objection).
KS Agents provides self-service data rights tools (erasure and export) accessible to users within the platform. KS Agents shall notify Controller of any direct data subject request received within 5 business days and shall not respond to such request without Controller's prior authorisation, unless required by applicable law.
KS Agents' assistance is provided free of charge for requests that can be fulfilled using standard platform tools. KS Agents may charge a reasonable fee for requests requiring custom extraction or unusual effort.
Taking into account the nature of processing and the information available, KS Agents shall assist Controller in ensuring compliance with its obligations under GDPR Articles 32–36, including: (a) security of processing; (b) notification of personal data breaches to the supervisory authority; (c) communication of personal data breaches to data subjects; (d) data protection impact assessments; and (e) prior consultation with supervisory authorities.
Upon termination of the Terms of Service for any reason, KS Agents shall, at Controller's choice and upon written request made within 30 days of termination: (a) delete all customer content and provide written certification of deletion; or (b) return all customer content in machine-readable format (JSON/CSV).
If no instruction is received within 30 days of termination, KS Agents shall delete all customer content. KS Agents may retain personal data where required by applicable Union or Member State law; in such case KS Agents shall notify Controller of the retention obligation and the legal basis.
Backup carve-out. The deletion obligation above does not extend to backup copies that exist solely for disaster-recovery purposes. Such backups are retained for a rolling window of up to 7 days from their creation, are not accessible for retrieval or restore in the ordinary course, and age out automatically. KS Agents shall not restore deleted customer content from backup except when required by law. Personal data required to be retained for compliance with statutory obligations (e.g. tax law) is similarly outside the scope of the deletion obligation, but shall be subject to appropriate processing restrictions for the duration of the retention period.
KS Agents shall make available to Controller all information necessary to demonstrate compliance with its obligations as a data processor, and shall allow for and contribute to audits, including inspections, conducted by Controller or a mandated third-party auditor.
KS Agents may demonstrate compliance through any of the following forms of evidence:
- adherence to an approved code of conduct under Art. 40 GDPR;
- an approved certification mechanism under Art. 42 GDPR;
- current assessments, reports, or excerpts thereof from independent parties (external auditors, internal auditors, the data protection officer, IT security, quality control);
- sub-processor certifications under recognised frameworks such as ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 2 Type II, or equivalent IT security audits;
- the public sub-processor register and the Technical and Organisational Measures set out in Annex C of this DPA.
Controller shall provide at least 30 days' prior written notice of any on-site audit. On-site audits shall be conducted: (a) during normal business hours; (b) no more than once per calendar year, unless a confirmed personal data breach warrants additional review; (c) at Controller's expense, including reasonable KS Agents staff time; and (d) subject to a confidentiality agreement protecting KS Agents' other customers' data and trade secrets. Where Controller mandates a third-party auditor, KS Agents may object on reasonable grounds, including where the third party is a direct competitor of KS Agents.
The parties agree that Controller's review of this DPA, the sub-processor register, Annex C (TOMs), and applicable security certifications of sub-processors shall constitute sufficient audit evidence for routine compliance purposes.
4. Controller Obligations
Controller represents, warrants, and undertakes that:
- It has, and will maintain throughout the term of this DPA, a lawful basis for each processing activity carried out or instructed under this DPA (Art. 6 GDPR or equivalent);
- It has provided, and will continue to provide, data subjects with all information required by GDPR Articles 13–14 regarding KS Agents' role as data processor;
- It shall not instruct KS Agents to process personal data in a manner that would violate applicable data protection law;
- It shall not upload special categories of personal data (GDPR Art. 9) — including health, biometric, or political data — without prior written agreement with KS Agents and documentation of an appropriate legal basis;
- It is solely responsible for the accuracy and lawfulness of personal data provided to KS Agents;
- Where Controller operates outside the EU/EEA, it shall ensure that its use of the Services complies with applicable local data protection law, including but not limited to CCPA/CPRA (California), LGPD (Brazil), UK GDPR, PIPEDA (Canada), and APPI (Japan).
5. International Data Transfers
Personal data processed under this DPA may be transferred to countries outside the European Economic Area ("EEA") to the extent necessary for sub-processors performing the Services. Each such transfer relies on one or more of the safeguards listed in Articles 44–49 GDPR:
- an adequacy decision of the European Commission (Art. 45 GDPR);
- Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 — see Annex D (Art. 46(2)(c) GDPR);
- binding corporate rules approved by a supervisory authority (Art. 47 GDPR);
- approved codes of conduct under Art. 40 GDPR (Art. 46(2)(e));
- approved certification mechanisms under Art. 42 GDPR (Art. 46(2)(f));
- derogations for specific situations under Art. 49 GDPR, used only where another safeguard is unavailable.
The specific safeguard relied upon for each sub-processor is recorded in the transfer table below and in the public sub-processor register. Where multiple safeguards apply, the strongest applicable safeguard governs.
| Sub-processor | Destination | Transfer mechanism |
|---|---|---|
| Hetzner Online GmbH | Helsinki, Finland (EU) | No transfer outside EEA |
| Cloudflare, Inc. | R2: EU jurisdiction. CDN/DNS: global edge. | SCCs 2021 Module 2 + Cloudflare DPA |
| OpenAI, L.L.C. | USA | SCCs 2021 Module 3 + OpenAI DPA + Zero Data Retention |
| Anthropic PBC | USA | SCCs 2021 Module 3 + Anthropic DPA + Zero Data Retention |
| Google LLC (Gemini API) | USA | SCCs 2021 Module 3 + Google Cloud DPA |
| Google LLC (Vertex AI, EU live audio) | Netherlands (EU) | Intra-EU processing (europe-west4) + Google Cloud DPA — no third-country transfer |
| Microsoft Corporation (Azure OpenAI) | EU (West Europe / Sweden Central) | Intra-EU processing + Microsoft DPA — no third-country transfer |
| OpenRouter Inc. | USA | SCCs 2021 Module 3 + OpenRouter privacy terms + Zero Data Retention |
| Requesty (EU) | EU | Intra-EU processing + Requesty terms + Zero Data Retention |
| Stripe, Inc. | USA / Ireland | SCCs 2021 Module 3 + Stripe DPA |
| Email providers (Postmark / Resend) | USA | SCCs 2021 Module 3 + provider DPA |
The SCCs referenced above are those adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021. Module 3 (Processor-to-Processor) applies when KS Agents, acting as processor for Controller, engages a sub-processor outside the EEA. Module 2 (Controller-to-Processor) applies when Controller is established outside the EEA and engages KS Agents as its processor. By entering into this DPA, the parties are deemed to have executed the applicable SCC module as set out in Annex D. In the event of any conflict between the SCCs and this DPA solely with respect to international transfer obligations, the SCCs shall prevail.
6. Data Breach Notification
In the event of a personal data breach affecting customer content, KS Agents shall notify Controller without undue delay and within 48 hours of becoming aware of the breach. Such notification shall include, to the extent then known:
- A description of the nature of the personal data breach, including the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- The name and contact details of the Data Protection Officer or other privacy contact;
- A description of the likely consequences of the personal data breach;
- A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.
KS Agents shall cooperate with Controller and provide reasonable assistance in investigating and remediating the breach, including a written post-incident report within 14 days of notifying Controller.
KS Agents shall not notify any supervisory authority or data subject of a breach on Controller's behalf without Controller's prior written consent, unless required to do so by applicable law. The 48-hour notification window is designed to allow Controller to comply with its own 72-hour notification obligation to supervisory authorities under GDPR Art. 33.
7. Liability
Each party's liability under or in connection with this DPA is subject to the exclusions and limitations set forth in the Terms of Service. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities under applicable data protection law.
Where a party ("Paying Party") has paid damages or fines to a data subject, supervisory authority, or other third party arising from a breach of this DPA or applicable data protection law, and the other party ("Responsible Party") bears partial or full responsibility for that breach, the Paying Party has a right of reimbursement from the Responsible Party for the amount attributable to the Responsible Party's breach, as determined by agreement or competent judicial decision.
8. Term and Termination
This DPA is effective from the date Controller accepts the Terms of Service and remains in force for the duration of the Terms of Service, plus the post-termination period required for deletion or return of customer content under Section 3.7.
Termination of the Terms of Service automatically terminates this DPA, subject to Section 3.7 (deletion/return obligations) and any data retention obligations imposed by applicable law. Clauses that by their nature should survive termination (including confidentiality, data deletion, liability, and governing law) shall survive.
9. Governing Law and Jurisdiction
This DPA is governed by the laws of Italy. Disputes arising from this DPA that are not resolved amicably shall be subject to the exclusive jurisdiction of the competent courts of the city of KS Agents' registered office, except as required by the SCCs incorporated in Annex D.
Where Controller is established in an EU Member State other than Italy, the supervisory authority of that Member State shall be the lead supervisory authority for Controller's obligations, while the Italian Data Protection Authority (Garante per la protezione dei dati personali) shall be competent for KS Agents' obligations as processor.
Annexes
Annex A — Description of Processing
Nature of processing
Storage, retrieval, display, AI-assisted analysis, generation of summaries and insights, and transmission to authorised users of Controller.
Purpose of processing
Provision of the KS Agents knowledge-sharing, performance management, and organisational intelligence platform as described in the Terms of Service.
Duration of processing
For the duration of the Terms of Service, plus 30 days post-termination for deletion/return. Longer retention only where required by applicable law.
Categories of data subjects
- Controller's employees and contractors
- Survey and 360° review respondents
- AI interview participants
- CRM contacts and leads
- Email campaign recipients
- Users of KS Agents platform accounts
Categories of personal data
- Identity: name, email address, job title, department
- Performance: survey and interview responses, 360° review scores and comments, development plans
- Behavioural: platform activity logs, chat and assistant interaction history
- Professional: skills assessments, organisational structure position
- Contact: telephone number, LinkedIn profile (where provided)
- Voice / audio: real-time voice input from live AI conversations and AI interviews. For EU-zone tenants, processed exclusively in europe-west4 (Netherlands) via Google Cloud Vertex AI; project-level caching disabled; no model training on tenant content.
- Special categories (Art. 9): NOT to be uploaded without prior written agreement.
Annex B — Approved Sub-processors
The current list of approved sub-processors is maintained at: ks-agents.com/legal/subprocessors/. This list is updated when sub-processors are added or removed, with 30 days' advance notice to Controller for additions.
By accepting this DPA, Controller grants general written authorisation to engage all sub-processors listed at that URL at the time of acceptance, and any subsequently notified sub-processors where Controller has not objected within the notice period.
Annex C — Technical and Organisational Security Measures (TOMs)
1. Access Control
- Multi-factor authentication enforced for all staff with production access
- Role-based access control (RBAC) per tenant — strict data isolation
- Principle of least privilege; periodic access reviews
- Unique individual credentials; no shared passwords or accounts
2. Encryption
- Data in transit: TLS 1.2+ on all connections
- Data at rest: AES-256 server-side encryption (Cloudflare R2)
- Audit module: field-level encryption with rotating Key Encryption Key (KEK) hierarchy — per-tenant keys via HKDF-SHA256
- LLM API calls: Zero Data Retention (ZDR) — no persistent storage or model training on customer content
3. Logical Tenant Isolation
- Strict multi-tenant separation: all data queries scoped by app_id foreign key at ORM layer
- Cross-tenant data access not possible through platform interfaces
4. Availability and Resilience
- Primary hosting: Hetzner Online GmbH, Helsinki, Finland (EU), ISO 27001 certified data centre
- Automated database backups (daily, 7 most recent retained)
- Health monitoring and alerting for all service components
- Documented incident response and disaster recovery procedures
5. Sub-processor Management
- Written data processing agreements with all sub-processors
- ZDR enabled for LLM providers where available
- Periodic review of sub-processor compliance certifications
6. Personnel Measures
- Confidentiality agreements for all staff
- Data protection training for staff handling personal data
- Documented breach notification and response runbook
Annex D — Standard Contractual Clauses (SCCs)
Where personal data originating in the EEA is transferred to a sub-processor located outside the EEA, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 3 (Processor-to-Processor), are hereby incorporated by reference and form an integral part of this DPA.
For the purposes of Module 3: (a) KS Agents acts as data exporter (processor) on behalf of Controller; (b) each relevant non-EEA sub-processor acts as data importer (sub-processor); (c) Annex I of the SCCs is satisfied by Annex A of this DPA; (d) Annex II of the SCCs is satisfied by Annex C of this DPA; (e) Annex III of the SCCs is satisfied by Annex B (Sub-processor Register) of this DPA. The SCCs are available in full at: EUR-Lex 2021/914/EU.
Where Controller is established outside the EEA, Module 2 (Controller-to-Processor) of the same SCCs applies between Controller (data exporter) and KS Agents (data importer / processor), to the extent required by applicable law.
Questions about this DPA?
For DPA negotiation (enterprise), compliance questions, breach notifications, or sub-processor objections, contact us at [email protected]. Enterprise customers on annual contracts may request a signed PDF version or negotiate custom clauses.
