Snapshot 227927
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Kleene
DATA PROCESSING ADDENDUM
This Data Processing Addendum applies wherever Kleene acts as a data processor
with respect to Personal Data supplied or made available to Kleene by or on behalf
of the Customer. It should be read in conjunction with the applicable Subscription
T&Cs, Consulting Services T&Cs and/or MSA.
Subscription Terms and conditions for https://kleene.ai/resources/legal
T&Cs Kleene's cloud-based
software subscription
services
Consulting Terms and conditions for https://kleene.ai/resources/legal
Services Kleene's consulting
T&Cs services
Support SLA Service level agreement https://kleene.ai/resources/legal
for customer support
Service Details of Kleene's https://kleene.ai/resources/legal
Providers' subprocessors and
Page service providers
MSA Master services N/A
agreement
1.Definitions
1.1 In this DPA:
"Customer" means Kleene's customer for Services;
"Customer Data" has the meaning given to it in the Subscription T&Cs;
"Customer Materials" has the meaning given to it in the Consulting Service
T&Cs;
"Customer Personal Data" means any Personal Data that is processed by
Kleene on behalf of the Customer under or in relation to a Subscription or an
Engagement; this shall exclude Personal Data with respect to which Kleene
acts as a controller, such as Personal Data stored and used by Kleene in order
to communicate with the Customer and/or to manage projects on behalf of
the Customer;
"Data Protection Laws" means the EU GDPR and the UK GDPR and all other
applicable laws relating to the processing of Personal Data;
"DPA" means this data processing addendum, as it may be updated from
time to time in accordance with its own provisions or the provisions of the
applicable Subscription T&Cs, Consulting Services T&Cs and/or MSA;
"Engagement" has the meaning given to it in the Consulting Services T&Cs;
"EU GDPR" means the General Data Protection Regulation (Regulation (EU)
2016/679) and all other EU laws regulating the processing of Personal Data,
as such laws may be updated, amended and superseded from time to time;
"Kleene" means Minoro Ltd (trading as Kleene or Kleene.ai), a company
incorporated in England and Wales (registration number 10657177) having its
registered office at 11 Bracken Place, Bedford, United Kingdom, MK41 0TG;
"Order Documents" means, in relation to a Subscription, the applicable
order form agreed by the parties; and in relation to an Engagement, any
applicable order form and each applicable statement of work agreed by the
parties;
"Personal Data" means personal data under any of the Data Protection
Laws;
"Services" means the services provided or to be provided by Kleene to the
Customer under the Order Documents;
"Subscription" has the meaning given to in the Subscription T&Cs; and
"UK GDPR" means the EU GDPR as transposed into UK law (including by the
Data Protection Act 2018 and the Data Protection, Privacy and Electronic
Communications (Amendments etc) (EU Exit) Regulations 2019) and all other
UK laws regulating the processing of Personal Data, as such laws may be
updated, amended and superseded from time to time.
2. Compliance with Data Protection Laws
2.1 Each party shall comply with the Data Protection Laws with respect to the
processing of the Customer Personal Data.
2.2 The Customer warrants to Kleene that it has the legal right to disclose all
Personal Data that it does in fact disclose to Kleene under or in connection
with any Subscription or Engagement.
3. Scope of processing
3.1 The Customer shall only supply to Kleene, and Kleene shall only process,
Personal Data that:
(a)is included in the Customer Data or the Customer Materials; or
(b)is included in or relates to support Tickets (as defined in the Support SLA).
Such Personal Data may relate to any relevant individual. Where practicable,
more specific information about the categories of Personal Data that may be
processed under this DPA, and about the categories of data subject to which
that Personal Data relates, may be set out in the Order Documents or another
document agreed by the parties in writing.
3.2 Kleene shall only process the Customer Personal Data for the purposes of
providing the Services, performing its other obligations under the applicable
Subscription or Engagement and communicating with the Customer, along
with any other purposes specified in the Order Documents.
3.3 Kleene shall only process the Customer Personal Data on the documented
instructions of the Customer (including with regard to transfers of the
Customer Personal Data to a third country under the Data Protection Laws),
as set out in the Order Documents, this DPA, the Subscription T&Cs and/or
the Consulting Services T&Cs, any MSA and any other document agreed by
the parties in writing.
3.4 Kleene shall promptly inform the Customer if, in the opinion of Kleene, an
instruction of the Customer relating to the processing of the Customer
Personal Data infringes the Data Protection Laws.
3.5 Notwithstanding any other provision of this DPA, Kleene may process the
Customer Personal Data if and to the extent that Kleene is required to do so
by applicable law. In such a case, Kleene shall inform the Customer of the
legal requirement before processing, unless that law prohibits such
information on important grounds of public interest.
4. Duration of processing
4.1 Kleene shall only process the Customer Personal Data during the period of
provision of services under the relevant Subscription or Engagement and for
not more than 90 days following the end of that period, subject to the other
provisions of this DPA. The Customer acknowledges that, if Kleene does not
provide Data Warehouse Services (as defined in the Subscription T&Cs) then
Customer Data shall only be processed by Kleene on a transient basis, and no
Customer Data shall be stored by Kleene following the termination of the
Subscription.
4.2 Subject to Clause 4.1, Kleene shall, at the choice of the Customer, delete or
return all of the Customer Personal Data to the Customer after the provision
of services relating to the processing, and shall delete existing copies save to
the extent that applicable law requires storage of the relevant Personal Data.
The Customer may exercise its rights under this Clause 4.2 by sending a
request to the Kleene support team.
5. Confidentiality and security
5.1 Kleene shall ensure that persons authorised to process the Customer Personal
Data have committed themselves to confidentiality or are under an
appropriate statutory obligation of confidentiality.
5.2 Kleene shall each implement appropriate technical and organisational measures
to ensure an appropriate level of security for the Customer Personal Data,
including any measures specified in the Order Documents.
5.3 Kleene’s personnel work remotely and may access the Customer Personal Data
from locations outside the United Kingdom. All such access takes place
through Kleene’s managed environments and is subject to access controls,
authentication and logging, and Customer Personal Data is not stored on local
or unmanaged devices.
6. Third party processors and international transfers
6.1 Kleene must not engage any third party to process the Customer Personal Data
without the prior specific or general written authorisation of the Customer. In
the case of a general written authorisation, Kleene shall inform the Customer
(by updating the Service Providers' Page and, if the Customer has so
requested, sending an email notice to the Customer) at least 14 days in
advance of any intended changes concerning the addition or replacement of
any third party processor, and if the Customer objects to any such changes
before their implementation, then the Customer may terminate the relevant
Subscription or Engagement on 7 days' written notice to Kleene, providing
that such notice must be given within the period of 7 days following the date
that Kleene informed the Customer of the intended changes.
6.2 Kleene shall ensure that each third party processor is subject to equivalent legal
obligations as those imposed on Kleene by this DPA.
6.3 Kleene is hereby authorised by the Customer on a general basis to engage, as
sub-processors with respect to Customer Personal Data, the third parties, and
third parties within the categories, identified on the Service Providers' Page as
at the date of agreement the applicable Subscription or Engagement.
6.4 The Customer hereby authorises Kleene to make the following transfers of
Customer Personal Data:
(a)Kleene may transfer the Customer Personal Data to its third party
processors in the jurisdictions identified on the Service Providers' Page
and may permit its third party processors to make such transfers,
providing that such transfers must be protected by any appropriate
safeguards identified therein; and
(b)Kleene may transfer the Customer Personal Data to a country, a territory
or sector to the extent that the competent data protection authorities
have decided that the country, territory or sector ensures an adequate
level of protection for Personal Data for the purposes of the Data
Protection Laws.
7. Assistance and cooperation
7.1 Kleene shall, insofar as possible and taking into account the nature of the
processing, take appropriate technical and organisational measures to assist
the Customer with the fulfilment of the Customer's obligation to respond to
requests exercising a data subject's rights under the Data Protection Laws.
7.2 Kleene shall assist the Customer in ensuring compliance with the obligations
relating to the security of processing of personal data, the notification of
personal data breaches to the supervisory authority, the communication of
personal data breaches to the data subject, data protection impact
assessments and prior consultation in relation to high-risk processing under
the Data Protection Laws. Kleene may charge the Customer at its standard
time-based charging rates for any work performed by Kleene at the request
of the Customer pursuant to this Clause 7.2.
7.3 Kleene shall make available to the Customer all information necessary to
demonstrate the compliance of Kleene with its obligations under this DPA.
Kleene may charge the Customer at its standard time-based charging rates
for any work performed by Kleene at the request of the Customer pursuant to
this Clause 7.3, providing that no such charges shall be levied with respect to
the completion by Kleene (at the reasonable request of the Customer, not
more than once per calendar year) of the standard information security
questionnaire of the Customer.
7.4 Kleene shall allow for and contribute to audits, including inspections, conducted
by the Customer or another auditor mandated by the Customer in respect of
the compliance of Kleene's processing of Customer Personal Data with the
Data Protection Laws and this DPA. Kleene may charge the Customer at its
standard time-based charging rates for any work performed by Kleene at the
request of the Customer pursuant to this Clause 7.4, providing that no such
charges shall be levied where the request to perform the work arises out of
any breach by Kleene of this DPA or any security breach affecting the systems
of Kleene.
8. Data breaches
8.1 Kleene must notify the Customer of any Personal Data breach affecting the
Customer Personal Data without undue delay and, in any case, not later than
36 hours after Kleene becomes aware of the breach.
9. Variation
9.1 This DPA may not be varied except as follows:
(a)to the extent reasonably necessary to ensure that the parties and this DPA
comply with the Data Protection Laws, by Kleene giving to the
Customer at least 30 days' prior written notice of the variation;
(b)in accordance with the provisions of the Subscription T&Cs, Consulting
Services T&Cs and/or any MSA as applicable between the parties; or
(c)by means of a written document signed by or on behalf of each party.