Data Processing Addendum (DPA)

GDPR Article 28, UK GDPR, and California CPRA compliant data processing agreement for commercial enterprise customers.

Last updated August 30, 2026 · Effective August 30, 2026

Effective Date: August 30, 2026 Contracting Entity: Kuklabs Inc. (Delaware, USA)

This Data Processing Addendum ("DPA") supplements the Terms of Service between Kuklabs Inc. ("Processor" or "Kuklabs") and the Customer ("Controller" or "Customer") regarding the processing of Personal Data through the Services.

1. Definitions & Interpretation

• "Personal Data": Any information relating to an identified or identifiable natural person processed by Processor on behalf of Controller.
• "Data Protection Laws": All applicable global data privacy regulations, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act / CPRA.
• "Standard Contractual Clauses (SCCs)": The standard contractual clauses approved by the European Commission for cross-border data transfers.

2. Processing Obligations

2.1. Scope and Purpose: Processor shall process Personal Data solely on documented instructions from Controller, including with respect to transfers of Personal Data to a third country. 2.2. Confidentiality: Processor ensures that all personnel authorized to process Personal Data have committed themselves to confidentiality. 2.3. Technical & Organizational Measures: Processor maintains comprehensive technical safeguards as detailed in [Schedule 2](#schedule-2-security-measures) below.

3. Subprocessing

3.1. Authorized Subprocessors: Controller provides general authorization for Processor to engage the third-party subprocessors listed at Subprocessors. 3.2. Notice of Changes: Processor shall provide at least thirty (30) days' prior electronic notice before adding or replacing any subprocessor. Controller may reasonably object on data security grounds within fourteen (14) days of notice. 3.3. Subprocessor Agreements: Processor imposes contractual obligations on every subprocessor that are no less protective than those stipulated in this DPA.

4. Security Incidents & Breach Notification

4.1. Notification: In the event of a confirmed Security Incident resulting in unlawful or accidental destruction, loss, alteration, or unauthorized disclosure of Customer Personal Data, Processor shall notify Controller without undue delay and within forty-eight (48) hours of confirmation. 4.2. Remediation: Processor shall promptly take reasonable steps to mitigate the effects and provide Controller with information required for regulatory breach reporting.

5. Data Subject Rights & Audits

5.1. Assistance: Taking into account the nature of processing, Processor shall assist Controller by appropriate technical and organizational measures to enable Controller to respond to Data Subject requests (e.g., access, deletion, rectification). 5.2. Audit Rights: Upon Controller's reasonable written request, Processor shall make available summaries of third-party security audits or complete standard security questionnaires to verify compliance with this DPA.

Schedule 1: Details of Processing

• Categories of Data Subjects: Customer's employees, contractors, clients, vendors, and end-consumers.
• Types of Personal Data: Names, business email addresses, billing addresses, phone numbers, tax identifiers, invoice payment records, and employment identifiers.
• Duration of Processing: The term of the primary subscription agreement plus the applicable post-cancellation retention window.

Schedule 2: Security Measures (TOMs)

• Logical database multi-tenant isolation.
• Encryption of data in transit (TLS/HTTPS with HSTS); storage protections as described in our Security & Trust Overview.
• Role-Based Access Control (RBAC) with least-privilege scoping.
• Automated daily cryptographic database snapshots stored in encrypted buckets.
• Immutable logging of security events and administrative privilege elevations.