Snapshot 20282
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement
Valid from: 10 September 2026
Preamble
This Data Processing Agreement ("DPA") is concluded between Kolsetu GmbH ("Processor") and the Customer ("Controller") pursuant to Art. 28 GDPR and forms an integral part of the Contract for the provision of the Elba AI platform and related services ("Agreement"). This DPA applies to both enterprise and self-serve customers of the Elba platform.
Note on scope: This DPA governs Kolsetu's processing of Customer Personal Data in its capacity as Processor. Kolsetu also processes personal data of platform users (administrators and operators) in its capacity as Controller; that processing is described in the Kolsetu Product Privacy Policy available on the homepage (www.kolsetu.com).
The Controller determines the purposes and means of processing described herein. The Processor processes personal data solely on the Controller's documented instructions and for no other purpose.
Capitalised terms used but not defined in this DPA have the meanings given in the General Terms and Conditions, the applicable Elba Service Terms (Enterprise Service Terms or Self-Serve Terms, as applicable), and, where an Order Form has been executed, the Order Form.
1. Definitions
In this DPA, the following terms have the meanings set out below. Terms not defined here have the meanings given in Art. 4 GDPR or the Agreement.
Term
Definition
Agreement
The contract between the parties for the provision of the Services, comprising the T&C, the applicable Elba Service Terms (Enterprise Service Terms or Self-Serve Terms, as applicable), and, where applicable, the Order Form.
Customer Personal Data
Any personal data that the Processor processes on behalf of the Controller pursuant to the Agreement.
Data Protection Laws
GDPR; the German Federal Data Protection Act (BDSG); UK GDPR and the Data Protection Act 2018; the Australian Privacy Act 1988; and applicable US state and federal privacy laws (including CCPA), each as amended from time to time and only to the extent applicable.
GDPR
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
Personal Data Breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data transmitted, stored, or otherwise processed by the Processor, as defined in Art. 4(12) GDPR.
Services
The Elba AI platform and all associated services provided by the Processor under the Agreement.
Sub-processor
Any data processor engaged by the Processor to process Customer Personal Data.
TOMs
The technical and organisational measures described in Annex 2.
Data Privacy Framework
The EU–U.S. Data Privacy Framework established by Commission Decision (EU) 2023/1795.
2. General
2.1 Roles. The parties acknowledge that the Controller acts as a data controller and the Processor acts as a data processor within the meaning of applicable Data Protection Laws. The Processor processes Customer Personal Data solely on the Controller's behalf.
2.2 Instructions. The Controller instructs the Processor to process Customer Personal Data to the extent necessary for the provision of the Services and the performance of its rights and obligations under the Agreement. Instructions are initially set out in this DPA and may subsequently be amended by the Controller in writing.
2.3 CCPA. With respect to Customer Personal Data that constitutes "personal information" for purposes of the California Consumer Privacy Act ("CCPA"), the Processor shall not: (a) sell or share the personal information; (b) retain, use, or disclose the personal information for any purpose other than the business purposes specified in the Agreement or as otherwise permitted by the CCPA; (c) retain, use, or disclose the personal information outside the direct business relationship between the Processor and the Controller; or (d) combine the personal information received from the Controller with personal information received from or collected from other sources, except as permitted by the CCPA. The Processor certifies that it understands and will comply with these restrictions.
3. Processing Details (Art. 28(3) GDPR)
3.1 Subject Matter and Duration
The Processor processes Customer Personal Data for the duration of the Agreement, or until the Controller instructs otherwise, solely for the purpose of providing the Services.
3.2 Nature and Purpose of Processing
The Processor processes Customer Personal Data in connection with:
Providing and operating the Elba AI voice automation platform
Processing voice interactions, generating transcripts, and delivering conversation analytics
Omnichannel orchestration (voice, chat, email, SMS, WhatsApp) on behalf of the Controller
Integrations with the Controller's enterprise systems including CRM, ERP, telephony, and communication platforms, via native connectors, REST API, and webhook framework, as configured by the Controller
User account management, access control, and authentication
Security monitoring, fraud prevention, and incident management
Customer support and technical troubleshooting
3.3 Categories of Personal Data
Depending on the Controller's use case and configuration, the Processor may process:
Contact information (name, phone number, email address)
Voice recordings and derived audio data
Conversation transcripts and interaction logs
Customer service records and case data
Account credentials and authentication data
Usage data, session logs, and activity metadata
Data from integrated enterprise systems as configured by the Controller
3.4 Categories of Data Subjects
Data subjects may include:
End customers of the Controller who interact with the Elba platform
The Controller's employees and authorised users of the platform
Other individuals whose data is processed through integrations configured by the Controller
3.5 Sensitive Data
The Processor processes special categories of personal data within the meaning of Art. 9 GDPR solely on the documented instructions of the Controller.
The Controller is solely responsible for ensuring that any submission of special category data to the Services is supported by a valid legal basis under Art. 9 GDPR, that all applicable conditions for such processing are satisfied, and that any required safeguards are in place.
The technical and organisational measures set out in Annex 2 apply to such processing and are implemented taking into account the nature and risk of the processing, including the processing of special categories of personal data where applicable.
3.6 Frequency and Transfer
Customer Personal Data is transferred to the Processor periodically throughout the term of the Agreement, depending on how the Controller uses the Services.
4. Processor Obligations
4.1 Processing instructions
4.1.1 Process Customer Personal Data only on the Controller's documented instructions, unless required to do so under applicable law. In such cases, the Processor shall inform the Controller before processing, unless doing so is prohibited by law.
4.1.2 If the Processor considers that an instruction infringes Data Protection Laws, it shall immediately inform the Controller of its legal concerns and may suspend the instruction pending resolution.
4.2 Confidentiality
4.2.1 Ensure that all personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations (whether contractual or statutory) and receive relevant data protection training.
4.3 Security
4.3.1 Implement and maintain appropriate technical and organisational measures (TOMs) as set out in Annex 2 to ensure a level of security appropriate to the risk, including as required by Art. 32 GDPR. The Processor may update TOMs from time to time provided that such updates do not result in a degradation of the overall security level.
4.4 Sub-processors
4.4.1 Not engage a new sub-processor or materially change the role of an existing sub-processor without providing prior written notice (minimum 30 business days) to the Controller. The sub-processor list in Section 6 of this DPA constitutes the authoritative and current record of approved sub-processors.
4.4.2 Ensure that any sub-processor engaged is bound by data protection obligations no less protective than those in this DPA, by contract or other legal act. The Processor remains fully responsible for the performance of its sub-processors' data protection obligations.
4.5 AI Processing Obligations
4.5.1 AI training exclusion. Neither the Processor nor any of its sub-processors shall use Customer Personal Data - including voice recordings, transcripts, conversation data, or any data derived therefrom - to train, fine-tune, or improve any general-purpose AI or machine learning model. This restriction applies regardless of whether the data has been pseudonymised. The Processor shall ensure that equivalent restrictions are contractually imposed on all AI sub-processors.
4.5.2 Data minimisation for AI inference. Where Customer Personal Data is transmitted to AI sub-processors for inference processing, the Processor shall ensure that only the minimum data necessary for the specific inference request is transmitted. AI sub-processors shall not retain Customer Personal Data beyond the duration of the inference session, except as required by applicable law.
4.5.3 Biometric data. The Processor does not derive biometric identifiers or voiceprints from voice recordings processed through the Elba platform and does not process voice recordings as biometric data within the meaning of Art. 9 GDPR or equivalent provisions under applicable Data Protection Laws. Voice recordings are processed solely for the purposes of transcription, intent analysis, and conversation analytics as described in Annex I-B.
4.6 Data Subject Rights
4.6.1 Assist the Controller in fulfilling its obligations to respond to Data Subject requests under Chapter III GDPR (rights of access, rectification, erasure, restriction, portability, and objection). Requests received directly by the Processor from Data Subjects shall be forwarded to the Controller without undue delay and in any event within five (5) business days. The Processor shall not respond to Data Subject requests directly without the Controller's prior authorisation, unless legally compelled to do so.
4.7 Regulatory Assistance
4.7.1 Assist the Controller in ensuring compliance with Arts. 32–36 GDPR (security, breach notification, DPIAs, and prior consultation with supervisory authorities), taking into account the nature of processing and information available to the Processor.
4.7.2 Where the Controller is required to provide information to a competent supervisory authority, provide reasonable assistance to the Controller, at the Controller's cost, by providing such information to the extent it is in the Processor's possession.
4.8 Data Return and Deletion
4.8.1 At the Controller's choice, delete or return all Customer Personal Data upon termination of the Services and delete existing copies, unless Union or Member State law requires retention. Deletion shall be completed within 30 days of termination or Controller instruction. Written confirmation of deletion is available on request.
4.9 Audit and Information
4.9.1 The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.
Where reasonably sufficient to demonstrate compliance, the parties shall first seek to satisfy audit requests through the Processor's current independent certifications or audit reports and written responses to reasonable information security questionnaires.
The Controller shall provide at least 30 business days' advance written notice of an audit, unless shorter notice is reasonably required following a Personal Data Breach, where there are reasonable grounds to suspect material non-compliance with this DPA, or where required by a competent supervisory authority or applicable law. Audits shall normally occur no more than once per year unless one of those circumstances applies.
Audits shall be conducted during normal business hours, subject to appropriate confidentiality and security requirements, and in a manner designed to minimise disruption to the Processor's operations and to protect the confidentiality and security of other customers' data.
5. Controller Obligations
5.1 Comply with all applicable Data Protection Laws with respect to Customer Personal Data. The Controller shall not use the Services in a manner that violates Data Protection Laws.
5.2 Represent and warrant that it has a valid legal basis under Art. 6 GDPR (and Art. 9 where applicable) for all personal data submitted to the Processor, and for any transfer of Customer Personal Data to the Processor. The Controller shall immediately notify the Processor if any change occurs in the legal bases for processing.
5.3 Ensure that all required notices have been given to, and where necessary all required consents obtained from, Data Subjects in connection with the processing performed under this DPA.
5.4 Have sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which the Controller acquires it.
5.5 Promptly inform the Processor of any inquiry or complaint received from a Data Subject or supervisory authority relating to the processing of Customer Personal Data under this DPA.
5.6 General sub-processor consent. The Controller provides general written authorisation for the Processor to engage sub-processors and Processor affiliates in the processing of Customer Personal Data, subject to the notification and objection procedure in Section 6.
6. Sub-processors
6.1 The authoritative list of sub-processors engaged by the Processor as at the effective date of this DPA is set out in Annex I-C. Any changes to sub-processors are subject to the notification and objection procedure in clauses 6.2 and 6.3, and result in a new version of Annex I-C being issued to the Controller.
6.2 The Processor will provide at least 30 business days' advance written notice of any intended addition to or replacement of sub-processors. The Controller may, within 10 business days of receiving such notice, object to a new or replacement sub-processor on substantiated data protection grounds ("Legitimate Reasons"). If the Controller does not notify the Processor of an objection within this period, the Controller is deemed to have accepted the new sub-processor.
6.3 If the Controller raises an objection, the Processor shall work with the Controller in good faith to address the Legitimate Reasons. If the parties cannot agree within 20 business days of the Processor's receipt of the objection, the Controller may by written notice terminate the service components that require the use of the proposed sub-processor.
6.4 The Processor remains fully responsible to the Controller for the data protection performance of all sub-processors.
6.5 Customer-supplied AI providers. Where the Controller configures the Services to use third-party AI model providers under the Controller's own accounts and agreements (including but not limited to self-supplied LLM API keys), the Controller is solely responsible for compliance with applicable Data Protection Laws in respect of those providers, including the conclusion of any required data processing agreements. Such providers are not sub-processors of the Processor and are not covered by this DPA.
7. International Transfers
7.1 LLM inference processing of Customer Personal Data performed by the Processor takes place through Azure OpenAI Service within the Azure EU region.
Other processing necessary for the provision of the Services, including speech-to-text, text-to-speech and related voice-processing services, may be performed by the Sub-processors identified in Annex I-C.
Where Customer Personal Data is transferred to a third country outside the EEA, the Processor shall ensure that the transfer complies with Chapter V GDPR by relying on an applicable transfer mechanism, including:
(a) an adequacy decision adopted by the European Commission;
(b) the EU Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914; or
(c) where applicable, the EU-U.S. Data Privacy Framework established by Commission Implementing Decision (EU) 2023/1795.
7.2 Transfer mechanism precedence. Where more than one lawful transfer mechanism is applicable to a transfer, the Processor may rely on the transfer mechanism appropriate to the relevant Sub-processor and transfer, as identified in Annex I-C.
7.3 The Processor conducts transfer impact assessments where required under applicable Data Protection Laws in connection with transfers of Customer Personal Data to third-country Sub-processors. Relevant information regarding such assessments shall be made available to the Controller on reasonable written request, subject to appropriate confidentiality and security restrictions.
8. Security
The Processor implements and maintains appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Full details are set out in Annex 2. Key measures include:
Encryption of Customer Personal Data in transit and at rest using industry-standard algorithms
Role-based access controls and multi-factor authentication for all privileged access
Logical tenant isolation - each customer's data is processed in a dedicated, logically isolated environment
Regular penetration testing and continuous vulnerability management by qualified providers
Documented incident detection, response, and escalation procedures
Personnel data protection training and appropriate background screening
Business continuity and disaster recovery provisions, tested at least annually
Sub-processor oversight ensuring equivalent data protection standards throughout the supply chain
9. Personal Data Breach Notification
9.1 In the event of a Personal Data Breach, the Processor shall notify the Controller without undue delay, and in any event within 48 hours of becoming aware.
9.2 The notification shall include, to the extent known: the nature of the breach; the categories and approximate number of Data Subjects affected; the categories and approximate number of records affected; likely consequences; and measures taken or proposed. Where complete information is not available in the initial notification, it shall be provided in phases without undue delay.
9.3 The Processor shall document all breaches and remediation measures in accordance with Art. 33(5) GDPR.
10. Government Disclosure Requests
10.1 The Processor has implemented measures to regulate the disclosure of Customer Personal Data to government entities. These measures require the Processor to consider its obligations to comply with any governmental order or demand and its legal obligations to protect Customer Personal Data.
10.2 To the extent permitted by law, the Processor shall promptly notify the Controller of any legally binding request for disclosure of Customer Personal Data by a law enforcement or government authority before responding to such a request. If the Processor is not permitted to provide notification to the Controller, it will seek permission to do so or ask the issuing authority to seek the information directly from the Controller.
10.3 The Processor shall challenge a governmental order or demand when appropriate and valid legal grounds exist. If production is required to comply with a valid court order or demand, the Processor shall disclose the minimum amount of Customer Personal Data necessary to comply.
10.4 With regard to personal data of EEA residents, the Processor abides by the obligations set forth in the EU SCCs in respect of government access requests.
11. Data Protection Impact Assessments
Where a processing activity is likely to result in a high risk to the rights and freedoms of Data Subjects, the Processor shall provide reasonable assistance to the Controller in conducting a Data Protection Impact Assessment (DPIA) under Art. 35 GDPR, including by providing information about its processing activities and security measures.
12. Liability
12.1 Each party's liability under this DPA is subject to the limitations set out in the T&C. Claims brought under this DPA shall be subject to the terms and conditions of the Agreement, including the exclusions and limitations set forth therein; provided that neither party has limited liability under the Agreement with respect to any Data Subject's rights under Data Protection Laws where such limitation is prohibited by applicable law.
12.2 In the event of a conflict between the Agreement and this DPA, the provisions of this DPA shall prevail.
13. Term and Termination
This DPA enters into force upon signature (or, where the Agreement is executed via an Order Form, upon execution of the Order Form) and remains in force for the duration of the Agreement. Upon termination of the Agreement, this DPA terminates automatically. The obligations in Sections 4.2 (confidentiality), 4.8 (data return and deletion), and 9 (breach notification) shall survive termination.
14. Miscellaneous
14.1 Governing law. This DPA is governed by the laws of the Federal Republic of Germany. Disputes are subject to the dispute resolution provisions of the T&C.
14.2 Amendments. Amendments to this DPA require written form. In the event of conflict, this DPA takes precedence over the Agreement.
14.3 Notices. All notices under this DPA shall be sent to the addresses provided in the Agreement.
14.4 Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
14.5 SCCs. To the extent the EU SCCs conflict with any provision of this DPA, the SCCs shall prevail to the extent of such conflict. It is not the intention of the parties to contradict or restrict any provision of the SCCs.
14.6 Language and translations. This DPA is made available in English and German, both of which have been reviewed for legal accuracy. The English text is the authoritative version for all purposes, including interpretation, dispute resolution, and enforcement. Translations into other languages may be published for ease of reference only and have no legal effect. In the event of any inconsistency between the English text and any translation, the English text prevails.
15. Contact
Privacy Contact: [email protected]
Address: Kolsetu GmbH, Gaensemarkt 33, 20354 Hamburg, Germany
Annex I-A Parties
Controller
Name: As defined in the Order Form, or as provided during account registration for self-serve customers
Address: As defined in the Order Form, or as provided during registration for self-serve customers
Contact: As defined in the Order Form, or as provided during registration for self-serve customers
Signature: Enterprise customers accept this DPA by signing an Order Form or other agreement that incorporates or references this DPA. Self-serve customers accept this DPA by completing account registration and accepting the Elba Self-Serve Terms.
Role: Controller
Processor
Name: Kolsetu GmbH
Address: Gaensemarkt 33, 20354 Hamburg, Germany (HRB 191266)
Privacy Contact: [email protected]
Role: Processor
Note: As Kolsetu GmbH is established in Germany (EEA), the primary controller–processor relationship does not require EU Standard Contractual Clauses. SCCs apply only to onward transfers to third-country sub-processors as set out in the sub-processor table in Section 6 and Annex I-C.
Annex I-B Description of Processing
Item
Detail
Subject matter
Processing of personal data in connection with the provision of the Elba AI platform and Services.
Duration
For the term of the Agreement, unless the Controller instructs earlier deletion or return.
Nature of processing
Collection, storage, use, transfer, and deletion of Customer Personal Data by automated means, including real-time AI processing of voice interactions and conversation data.
Purposes
Provision and operation of the Elba platform; AI voice automation and omnichannel orchestration; enterprise integrations; analytics and reporting; security and support.
Categories of data
As listed in Section 3.3 of this DPA.
Categories of subjects
As listed in Section 3.4 of this DPA.
Sensitive data (Art. 9 GDPR)
The Processor processes special categories of personal data solely on the documented instructions of the Controller. The Controller is solely responsible for ensuring that any submission of special category data to the Services is supported by a valid legal basis under Art. 9 GDPR or equivalent applicable law, that all applicable conditions for such processing are satisfied, and that any required safeguards are in place. The technical and organisational measures set out in Annex 2 apply to such processing and are implemented taking into account the nature and risk of the processing, including the processing of special categories of personal data where applicable.
Sub-processors
As listed in Annex I-C of this DPA.
Transfer frequency
Periodically throughout the term of the Agreement, depending on the Controller's usage of the Services.
Retention
Voice recordings: as configured by the Controller (default maximum 90 days). All other data: for the term of the Agreement unless earlier deletion is instructed.
Supervisory Authority
The competent supervisory authority is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI), in accordance with Clause 13 of the SCCs, as Kolsetu GmbH is established in Hamburg, Germany.
Annex I-C Sub-Processor List
This Annex lists all sub-processors engaged by Kolsetu GmbH as at the effective date of this DPA. Changes to this list are subject to the notification and objection procedure in Section 6. A new version of this Annex will be issued to the Controller when sub-processor arrangements change.
Subprocessor
Country
Service
Data location
Transfer basis
Amazon Web Services EMEA SARL
38 Avenue John F. Kennedy, L-1855 Luxembourg
Cloud infrastructure (compute, storage, network); EU data centres (Frankfurt)
EEA
No transfer required
Microsoft Ireland Operations Ltd. (Azure)
One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Cloud hosting and infrastructure; EU data centres (Frankfurt / West Europe)
EEA
No transfer required
Microsoft Ireland Operations Ltd. (Azure OpenAI)
One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
AI inference (voice, NLP, LLM) via Azure OpenAI Service; processed exclusively within Azure EU region
EEA
No transfer required
Anthropic (Claude)
Anthropic Ireland Ltd., 77 Sir John Rogerson's Quay, Dublin 2, Ireland
AI language model for internal security, compliance, and operational use cases; EU region
EEA
No transfer required
Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland
Google Workspace — internal collaboration, email, calendar, and document management; may incidentally contain customer support and operational data
EEA
No transfer required
LiveKit Inc.
4285 Payne Avenue, Suite 9154, San Jose, CA 95157, United States
Real-time audio/WebRTC for live AI interactions; data processed in EU data centres (Germany)
EEA (EU endpoint)
EU SCCs (Commission Decision 2021/914)
Meta Platforms Ireland Limited
Merrion Road, Ballsbridge, Dublin 4, Ireland
WhatsApp Business API - omnichannel customer communication via WhatsApp; EU region
EEA
No transfer required
Twilio Ireland Limited
25–28 North Wall Quay, Dublin 1, Ireland
Cloud communication APIs (SMS, VoIP, WebRTC, two-factor authentication)
EEA
No transfer required
Soniox
Cesta v Gorice 34B, 1000 Ljubljana, Slovenia
speech-to-text service
EEA
No transfer required
Slack Technologies Limited
One Park Place, Hatch Street Upper, Dublin 2, Ireland
Internal communication and real-time customer support routing; may incidentally contain customer interaction data shared in support workflows
EEA
No transfer required
Stripe Payments Europe Ltd.
1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland
Payment processing (self-serve invoicing and collections)
EEA
No transfer required
UAB Revolut Business
Konstitucijos ave. 21B, Vilnius, LT-08130, Lithuania
Payment processing (enterprise invoicing and collections)
EEA
No transfer required
11Labs
Floor 4, 33 Broadwick Street, London, England, W1F 0DQ, United Kingdom
Text-to-speech and voice synthesis API for generating spoken audio
United States
EU SCCs (Commission Decision 2021/914)
Composio
548 Market St, San Francisco, CA 94104, United States
Integration platform enabling API-based connections to third-party tools and services
United States
EU SCCs (Commission Decision 2021/914)
mem0
156 2nd St Ste 416, San Francisco, CA 94105, United States
Memory layer for storing and retrieving limited conversation context across sessions
United States
EU SCCs (Commission Decision 2021/914)
PostHog
2261 Market Street #4008, San Francisco, CA 94114, United States
Product analytics and usage tracking, including event analytics and session replay; data processed in EU data centres (Germany)
EEA (EU endpoint)
EU SCCs (Commission Decision 2021/914)
Deepgram
548 Market St Suite 25104, San Francisco, CA 94104, United States
Speech processing APIs, including speech-to-text and text-to-speech
United States
EU SCCs (Commission Decision 2021/914)
Cartesia
1766 18th Street, San Francisco, CA 94107, United States
Real-time text-to-speech API for voice generation
United States
EU SCCs (Commission Decision 2021/914)
AssemblyAI
320 Judah St Ste 5, San Francisco, CA 94122, United States
Speech-to-text API for audio transcription and analysis
United States
EU SCCs (Commission Decision 2021/914)
Axonwise
(Sarvam AI)
Villa O-81, Chaitanya Smaran, White Field Hosakote Main Road, Bangalore, Karnataka 560067, India
Speech processing APIs with a focus on Indic languages
India
EU SCCs (Commission Decision 2021/914)
Annex 2 Technical and Organisational Measures (TOMS)
Kolsetu GmbH maintains an information security management system certified to ISO/IEC 27001:2022.
Taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of natural persons, Kolsetu implements and maintains technical and organisational measures designed to ensure a level of security appropriate to the risk in accordance with Article 32 GDPR.
The following measures apply, as relevant to the Services and processing concerned:
Control area
Measures
Information Security Governance
Information security and data protection responsibilities are formally assigned. Kolsetu maintains documented security policies and procedures appropriate to the Services and reviews them regularly and at least annually.
Risk Management
Information security and data protection risks are identified, assessed, treated and periodically reviewed. Risk assessments are performed for new or materially changed processing activities where appropriate.
Access Control
Access to systems processing Customer Personal Data is restricted according to the principles of least privilege and need to know. Access rights are provisioned, reviewed and revoked according to documented procedures. Privileged access is subject to additional controls.
Authentication
Unique user identities and appropriate authentication controls are used for relevant systems. Multi-factor authentication is enforced for privileged access and applied elsewhere where appropriate to the risk.
Encryption
Customer Personal Data is encrypted in transit using secure protocols and encrypted at rest using industry-standard encryption mechanisms. TLS or equivalent secure transport encryption is used for Customer Personal Data transmitted over public networks.
Personnel and Confidentiality
Personnel authorised to process Customer Personal Data are subject to confidentiality obligations and receive appropriate information security and data protection training. Access is limited to personnel with a legitimate business need.
Data Separation
Customer Personal Data is logically separated from data processed for other customers. The Elba platform uses logical tenant isolation and access controls designed to prevent unauthorised cross-customer access.
Logging and Monitoring
Security-relevant access and system events are logged and monitored as appropriate to the processing risk to support the detection, investigation and response to unauthorised access, misuse and security incidents. Access to security logs is restricted to authorised personnel.
Vulnerability and Patch Management
Kolsetu maintains processes to identify, assess, prioritise and remediate security vulnerabilities affecting systems used to provide the Services. Security vulnerabilities and updates are addressed within risk-appropriate timeframes according to severity, exploitability and exposure.
Security Testing
Vulnerability assessments and penetration testing are performed regularly. Identified findings are assessed and remediated according to severity and risk.
Secure Development and Change Management
Software developed or maintained by Kolsetu is subject to security controls appropriate to the nature and risk of the Services, including review, testing and controlled deployment of material changes.
Availability and Resilience
Technical and organisational measures are maintained to support the ongoing confidentiality, integrity, availability and resilience of systems and services processing Customer Personal Data. Appropriate redundancy and resilience measures are implemented according to service requirements.
Backup and Recovery
Backup and recovery procedures are maintained for relevant systems and data. Backups are appropriately protected and restoration capabilities are tested at reasonable intervals according to the criticality of the relevant systems and data.
Business Continuity and Disaster Recovery
Kolsetu maintains documented business continuity and disaster recovery arrangements appropriate to the Services and processing risk. Relevant arrangements are tested or exercised periodically and at least annually for critical services.
Incident Management
Kolsetu maintains documented procedures for detecting, assessing, containing, investigating, remediating and documenting security incidents and Personal Data Breaches. Personal Data Breaches are notified to the Controller in accordance with Section 9 of this DPA.
Physical Security
Customer Personal Data is primarily processed using cloud infrastructure operated by authorised infrastructure providers. Appropriate physical access controls for data centres and underlying infrastructure are maintained by those providers. Where Kolsetu controls facilities or equipment used to process Customer Personal Data, appropriate physical safeguards are applied.
Sub-processor Management
Sub-processors are subject to appropriate security and data protection due diligence and contractual obligations in accordance with this DPA. Kolsetu maintains oversight appropriate to the nature and risk of the processing delegated to its Sub-processors.
Government and Public Authority Access
Requests from public authorities for Customer Personal Data are handled in accordance with Section 10 of this DPA, including verification of the legal basis and scope of the request, disclosure limited to what is legally required, and challenge or notification where legally permitted and appropriate.
Testing and Evaluation of Measures
Kolsetu regularly tests, assesses and evaluates the effectiveness of relevant technical and organisational measures, proportionate to the processing risk, including through security reviews, risk assessments, vulnerability management and security testing.
Data Deletion
Customer Personal Data is securely deleted when no longer required in accordance with the Agreement, the Controller's documented instructions and applicable legal requirements. Appropriate procedures are maintained for deletion of data from relevant systems and storage media.
Kolsetu may update these measures from time to time to reflect technological developments, evolving threats or changes to the Services, provided that such updates do not materially reduce the overall level of protection for Customer Personal Data.
Get started today
Ready to put your
phones on autopilot?
See how Elba handles calls, WhatsApp, and SMS for regulated teams — no commitment required.
Talk with us