Data processing agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Krellixlabs ("Krellixlabs", "we", "us", or "our") and the customer entity that has agreed to those Terms ("Customer", "you", or "your").

This DPA applies where Krellixlabs processes personal data on behalf of the Customer in the course of providing the Services. It reflects the requirements of the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation ("EU GDPR"), and other applicable data protection laws.

By using the Services, the Customer agrees to the terms of this DPA. If you are using Krellix on behalf of an organisation, you confirm that you have authority to enter into this DPA on that organisation's behalf.

Contact details: Email: support@krellixlabs.com. Address: 100 Greengate, Manchester, UK.

"Controller" means the entity that determines the purposes and means of processing personal data. In the context of this DPA, the Customer is the Controller.

"Processor" means the entity that processes personal data on behalf of the Controller. In the context of this DPA, Krellixlabs is the Processor.

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection law.

"Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

"Data Subject" means the natural person to whom personal data relates.

"Subprocessor" means any third party engaged by Krellixlabs to process personal data in connection with the Services.

"Services" means the Krellix platform and related services as described in the Terms of Service.

2.1 Controller and Processor: The Customer acts as the Controller of personal data submitted to or processed through the Services. Krellixlabs acts as the Processor of that data, processing it only on behalf of and under the instructions of the Customer.

2.2 Independent Controller Processing: Krellixlabs also processes certain personal data as an independent Controller, for example account registration data, billing data, and website analytics, as described in the Privacy Policy. This DPA does not apply to that processing.

3.1 Processing on Instructions: Krellixlabs will process personal data only on documented instructions from the Customer, including as set out in this DPA and the Terms of Service, unless required to do so by applicable law. In that case, Krellixlabs will inform the Customer of the legal requirement before processing, unless prohibited by law.

3.2 Customer Responsibility: The Customer is responsible for ensuring it has a lawful basis for submitting personal data to the Services and for any instructions it gives to Krellixlabs. The Customer is also responsible for ensuring that data subjects have been informed about how their data will be processed, to the extent required by applicable law.

The following describes the nature of personal data processing carried out by Krellixlabs as Processor on behalf of the Customer.

Subject matter: Providing the Krellix platform and related AI-powered features.

Duration: For the duration of the Customer's subscription to the Services, and thereafter for as long as required to fulfil the purposes set out in this DPA or comply with legal obligations.

Nature of processing: Hosting, storage, retrieval, display, transmission, and deletion of personal data submitted by the Customer through the Services.

Purpose of processing: Enabling the Customer and its authorised users to use the features and functionality of Krellix, including AI agent conversations, project management, file uploads, and collaboration features.

Types of personal data: Personal data submitted by the Customer, which may include names, email addresses, job titles, and any other information contained within prompts, messages, files, documents, or notes uploaded to the Services.

Categories of data subjects: The Customer's employees, contractors, clients, or other individuals whose personal data the Customer chooses to submit to the Services.

Krellixlabs will ensure that all personnel authorised to process personal data under this DPA are subject to appropriate confidentiality obligations, whether by contract or statutory duty.

Krellixlabs will implement and maintain appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures take into account the nature of the data, the risks involved, and the state of the art.

Specific measures include encryption of data in transit and at rest, access controls and authentication requirements, regular security monitoring and logging, and incident response procedures.

7.1 Authorisation: The Customer provides general authorisation for Krellixlabs to engage Subprocessors to assist in providing the Services. Current Subprocessors are listed on our Subprocessors page at krellixlabs.com/en/subprocessors.

7.2 Changes to Subprocessors: Krellixlabs will provide reasonable notice of any intended changes to the list of Subprocessors, giving the Customer an opportunity to raise objections. If the Customer reasonably objects to a new Subprocessor on data protection grounds and Krellixlabs cannot accommodate the objection, the Customer may terminate the affected Services in accordance with the Terms of Service.

7.3 Subprocessor Obligations: Krellixlabs will impose data protection obligations on each Subprocessor that are substantially equivalent to those set out in this DPA. However, Krellixlabs does not accept liability for the acts, omissions, errors, or failures of any Subprocessor. Each Subprocessor operates under its own terms, policies, and agreements, and the Customer acknowledges that Krellixlabs has no control over the independent operations of Subprocessors. In the event of a data breach, loss, or non-compliance caused by a Subprocessor, Krellixlabs' sole obligation is to notify the Customer in accordance with section 10 and to take reasonable steps to assist the Customer in pursuing any available remedies directly against the relevant Subprocessor.

Krellixlabs will assist the Customer, through appropriate technical and organisational measures, in meeting its obligations to respond to requests from data subjects exercising their rights under applicable data protection law, including rights of access, correction, deletion, restriction, portability, and objection.

Where a data subject makes a request directly to Krellixlabs, Krellixlabs will promptly forward that request to the Customer and will not respond to the data subject directly unless instructed or required by law.

Krellixlabs will provide reasonable assistance to the Customer where requested in carrying out data protection impact assessments (DPIAs) and, where required, prior consultations with supervisory authorities, to the extent that such assistance relates to processing carried out by Krellixlabs under this DPA.

10.1 Notification: Krellixlabs will notify the Customer without undue delay upon becoming aware of a personal data breach affecting data processed under this DPA. Notification will be provided to the email address associated with the Customer's account.

10.2 Contents of Notification: Krellixlabs will provide, where available, a description of the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed to address the breach.

10.3 Customer Responsibility: The Customer is responsible for determining whether and how to notify relevant supervisory authorities and affected data subjects, in accordance with applicable law.

Upon termination or expiry of the Customer's subscription, or at the Customer's written request, Krellixlabs will delete or return personal data processed under this DPA, and delete existing copies, unless retention is required by applicable law. Krellixlabs will confirm completion of deletion upon request.

Krellixlabs will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA. Krellixlabs will allow for and contribute to audits, including inspections, conducted by the Customer or a third-party auditor mandated by the Customer, subject to reasonable notice, confidentiality obligations, and cost arrangements agreed in advance. Krellixlabs may satisfy audit requests by providing relevant certifications or third-party audit reports where available.

13.1 Transfers Outside the UK or EEA: Where personal data is transferred outside the UK or European Economic Area (EEA) in connection with the Services, Krellixlabs will ensure that appropriate safeguards are in place as required by applicable law, such as the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), or adequacy decisions.

13.2 Subprocessor Transfers: Krellixlabs will ensure that transfers of personal data to Subprocessors located outside the UK or EEA are subject to appropriate transfer mechanisms.

This DPA remains in effect for as long as Krellixlabs processes personal data on behalf of the Customer under the Terms of Service. It terminates automatically upon termination of the Terms of Service, subject to any provisions that by their nature should survive termination.

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service, to the extent permitted by applicable law.

This DPA is governed by the laws of England and Wales, consistent with the Terms of Service, unless required otherwise by applicable data protection law.

For questions about this DPA or to submit a data processing request, contact:

Krellixlabs

Email: support@krellixlabs.com

Address: 100 Greengate, Manchester, UK