Data Processing Addendum

"Applicable Data Protection Law" means data protection laws applicable to the processing [LEGAL REVIEW: specify]. "Customer Personal Data" means personal data in Customer Data that Kooiprocesses for Customer. "Sub-processor" means a third party engaged by Kooito process Customer Personal Data. "Security Incident" means a confirmed breach leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.

Customer is the controller (or equivalent) and Kooi is the processor (or equivalent) for Customer Personal Data. Kooi acts as controller for its own account, billing and usage data under the Privacy Policy. [LEGAL REVIEW: role wording per law.]

Kooiprocesses Customer Personal Data only on Customer's documented instructions: the Terms, this DPA, and Customer's use of the service. Kooi will tell Customer if an instruction appears to breach law. Customer warrants it has a lawful basis and all notices and consents for the data and instructions, including for calling, recording and transcription.

Purpose: provide the AI voice calling and workflow automation service. Duration: the term plus deletion period. Data subjects:Customer's leads, prospects, customers and call participants; Customer's users and staff. Data categories: contact details, call metadata, recordings, transcripts, extracted data, notes, uploaded document content. Sensitive data: not intended; Customer must not upload special-category data unless [Policy on special-category data].

Kooi ensures personnel authorized to process Customer Personal Data are bound by confidentiality.

Kooi implements appropriate technical and organizational measures described in Annex II: [VERIFIED MEASURES ONLY, e.g. access control, encryption, logging, tenant separation]. No certifications are claimed.

Customer gives general authorization for Sub-processors listed at [Sub-Processor List URL] (including third-party AI, telephony, hosting and storage providers). Kooi will bind them to data protection obligations no less protective than this DPA and remains responsible for their performance. [LEGAL REVIEW: liability flow-down.]

Kooi will notify Customer [Notice Period, e.g. 30 days by email] before adding or replacing a Sub-processor. Customer may object on reasonable data-protection grounds within [Objection Period, e.g. 30 days]; parties will work in good faith, failing which Customer may terminate the affected service.

Kooi will notify Customer without undue delay and within [Hours, e.g. 72]after becoming aware of a Security Incident, provide available information, take reasonable steps to contain it, and cooperate with Customer's obligations. Notification is not an admission of fault.

Kooi will promptly forward requests it receives to Customer, not respond directly except to redirect, and provide reasonable assistance through the service features or as [Assistance Terms, including any fees].

Kooi will reasonably assist with impact assessments and regulator consultations, taking into account the nature of processing.

Kooi retains Customer Personal Data during the term per [Retention Periods by data type: account, leads, recordings, transcripts, logs, billing]. After termination, Kooi will delete or return it within [Deletion Period, e.g. 30 days] on request, except where law requires retention or as held in backups until overwritten [Backup Overwrite Period, e.g. 90 days].

Customer authorizes transfers to countries where Kooi or its Sub-processors operate. Where required, parties will use [Transfer Mechanism, e.g. Standard Contractual Clauses]. [LEGAL REVIEW: essential.]

Kooi will make available information reasonably necessary to demonstrate compliance and allow audits (no more than [Frequency, e.g. once per year], with [Notice Period, e.g. 30 days], during business hours, subject to confidentiality and at Customer's cost) or accept third-party reports where available.

Liability under this DPA is subject to the Terms' limits [LEGAL REVIEW]. If conflicts arise over personal data, this DPA prevails.

Annexes to complete: I (processing details), II (security measures), III (Sub-processors), IV (transfer clauses, if any).