Data Processing Addendum

1. Conditional application

This DPA applies automatically only to the extent that:

1. Karemelo processes personal data on behalf of the Customer in connection with the Services; and
2. applicable Data Protection Law requires controller-processor, business-service-provider, contractor or comparable processing terms.

This DPA does not apply to processing for which Karemelo acts as an independent controller.

No separate signature is required where applicable law permits electronic incorporation by reference.

2. Definitions

“Applicable Data Protection Law” means privacy and data-protection law applicable to processing under this DPA, including the EU GDPR, UK GDPR and applicable US state privacy legislation to the extent relevant.

“Customer Personal Data” means personal data contained in Customer Data that Karemelo processes on the Customer's behalf.

“Controller”, “Processor”, “Personal Data”, “Personal Data Breach”, “Process” and “Data Subject” have the meanings given by Applicable Data Protection Law.

“Subprocessor” means another processor appointed by Karemelo to process Customer Personal Data on the Customer's behalf.

3. Roles

For Customer Personal Data, the Customer acts as Controller or, where it acts for another Controller, as Processor.

Karemelo acts as Processor or Subprocessor, as applicable.

The Customer determines the purposes and material instructions for processing Customer Personal Data.

Karemelo may separately act as an independent Controller for account management, security, legal compliance and other activities identified in the Privacy Policy.

4. Customer instructions

Karemelo will process Customer Personal Data only:

1. on the Customer's documented instructions, including these Terms, Customer configuration and written support instructions;
2. to provide and secure the Services; or
3. where applicable law requires processing.

Where legally permitted, Karemelo will inform the Customer before processing required by law.

If Karemelo reasonably believes an instruction violates Applicable Data Protection Law, it will inform the Customer and may suspend the affected instruction while the parties address the issue.

5. Processing details

The subject matter is provision of Karemelo's AI communications and business-workflow SaaS.

The duration is the Customer's subscription and any limited post-termination processing needed for export, deletion, backups or law.

The nature of processing may include collection, receipt, storage, organisation, retrieval, analysis, transcription, AI inference, transmission, display, modification, deletion and other operations instructed through the Services.

The purposes include operating configured AI agents, communication channels, customer records, appointments, leads, workflows, support and associated platform functionality.

6. Categories of Data Subjects

Depending on Customer use, Data Subjects may include:

• Customer employees and Authorised Users;
• the Customer's existing or prospective customers;
• patients or clients where lawfully used;
• leads and business contacts;
• callers and message recipients; and
• other individuals whose information the Customer lawfully directs Karemelo to process.

7. Categories of personal data

Depending on Customer configuration:

• names and contact details;
• business and account identifiers;
• telephone and social-media identifiers;
• messages and attachments;
• voice recordings and transcripts;
• appointment, service and order information;
• customer notes and preferences;
• lead information;
• technical and usage data; and
• other information supplied during an interaction.

8. Sensitive data

The Services are not automatically authorised for every type of sensitive or regulated information.

Where the Customer instructs processing of special-category, sensitive or regulated information, it represents that the instruction is lawful and that any additional agreement and Service configuration required by Karemelo has been completed.

9. Customer obligations

The Customer is responsible for:

1. the lawfulness of its instructions;
2. notices and lawful bases;
3. obtaining legally required consent;
4. accuracy and proportionality of Customer Personal Data;
5. responding to Data Subjects as Controller;
6. conducting any required DPIA or other risk assessment; and
7. determining that use of Karemelo is appropriate for its processing.

10. Confidentiality

Karemelo will ensure that personnel authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access will be limited to personnel with a legitimate need.

11. Security

Karemelo will maintain appropriate technical and organisational measures taking into account the nature, scope, context and purposes of processing and the risks to individuals.

Subject to verification of the production implementation before this DPA is published, measures include:

• encryption in transit;
• encryption at rest in supported production storage;
• authentication and access controls;
• multifactor authentication for appropriate privileged access;
• role-based access;
• workspace permissions;
• administrative-access controls;
• security and operational logging;
• backup/recovery measures appropriate to the Service;
• vulnerability and dependency management; and
• incident-response procedures.

Karemelo may update measures where the change does not materially reduce overall protection.

12. Subprocessors

The Customer gives Karemelo general written authorisation to use the subprocessors identified in the Karemelo Subprocessor List.

Karemelo will impose data-protection obligations on subprocessors appropriate to the services they perform and required by Applicable Data Protection Law.

Karemelo remains responsible for a Subprocessor's performance of its processor obligations to the extent required by Applicable Data Protection Law.

13. New subprocessors

Karemelo will provide active notice, ordinarily by email to the account administrator or an equivalent in-product notification, at least 15 days before a new material Subprocessor begins processing Customer Personal Data.

The notice will identify the provider and relevant processing.

The Customer may object during that period on reasonable, documented data-protection grounds.

The parties will attempt in good faith to resolve a valid objection, including through a commercially reasonable alternative where available.

If no reasonable solution is available, either party may terminate the materially affected Service. Where the Customer terminates solely because Karemelo cannot reasonably address a valid objection, Karemelo will arrange a pro-rata refund of prepaid fees for the terminated affected Service period.

An objection is not valid merely because the Customer prefers a different commercial provider without identifying a material data-protection concern.

14. Data Subject requests

Taking account of the nature of processing, Karemelo will provide reasonable technical and organisational assistance to enable the Customer to respond to legally valid Data Subject requests.

If Karemelo receives a request relating to Customer Personal Data for which it acts solely as Processor, Karemelo will ordinarily refer the requester to the Customer unless law requires otherwise.

The Customer remains responsible for determining the appropriate substantive response.

15. Regulatory and DPIA assistance

Taking account of the nature of processing and information available to Karemelo, Karemelo will reasonably assist the Customer with legally required:

• security assessments;
• Personal Data Breach obligations;
• DPIAs; and
• consultation with a supervisory authority.

Extraordinary assistance requiring substantial dedicated work may be charged at reasonable professional-service rates where law permits and where the need was not caused by Karemelo's breach.

16. Personal Data Breaches

Karemelo will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

As information becomes available, Karemelo will provide reasonable details concerning:

• the nature of the incident;
• affected data or Data Subject categories;
• likely consequences where known; and
• mitigation or remediation taken or proposed.

Information may be supplied in phases where it cannot reasonably be provided at once.

Karemelo's notification does not constitute an admission of fault.

17. Return and deletion

During the Service, the Customer may export and delete data using available functionality.

After termination, Karemelo will ordinarily provide the 30-day export period stated in the Terms.

At the end of applicable service processing, Karemelo will delete or return Customer Personal Data in accordance with Customer instructions and Applicable Data Protection Law, unless law requires retention.

Residual backup data that cannot reasonably be selectively deleted immediately may remain protected, unavailable for ordinary use and subject to deletion through the normal backup cycle.

18. Audits and information

Karemelo will make available information reasonably necessary to demonstrate compliance with applicable processor obligations.

Where available, Karemelo may first satisfy an audit request through current security documentation, questionnaires, independent assessments or other reasonable evidence.

Where Applicable Data Protection Law requires an inspection and the available documentation is insufficient, the Customer may conduct or appoint an independent auditor to conduct a proportionate audit, subject to:

• reasonable advance notice;
• normal business hours;
• confidentiality;
• security restrictions protecting other customers;
• no unnecessary access to other customers' information; and
• no material interference with Karemelo's operations.

Unless an audit reveals a material breach by Karemelo, the Customer bears its own and Karemelo's reasonable incremental costs of a Customer-specific audit to the extent permitted by law.

19. International transfers generally

Karemelo may use subprocessors in multiple countries as described in the Subprocessor List.

Each party will comply with international-transfer requirements applicable to its role.

Where a legally recognised transfer mechanism is required, the mechanism in this section applies to the extent legally appropriate.

20. EU transfers

Where Customer Personal Data is transferred from the EEA in a restricted transfer requiring Standard Contractual Clauses and the European Commission's 2021 SCCs are legally available for the transfer:

1. the SCCs are incorporated by reference;
2. Module Two applies where the Customer is Controller and Karemelo is Processor;
3. Module Three applies where the Customer is Processor and Karemelo is Subprocessor;
4. Clause 7 docking applies;
5. for Clause 9, general authorisation applies subject to section 13 of this DPA;
6. the annex information is completed by the processing details, Subprocessor List and security measures in this DPA; and
7. the law and courts used for the SCCs will be those of an eligible EU Member State selected as legally required for the applicable transfer, to be specified in the applicable order or transfer schedule.

The parties will complete additional information reasonably necessary to make the SCCs effective.

If those SCCs are not legally available for a particular transfer scenario, the parties will use another valid transfer mechanism where required.

21. UK restricted transfers

For a restricted transfer governed by UK GDPR, the parties will use, as applicable, the ICO-approved International Data Transfer Addendum to the EU SCCs or the International Data Transfer Agreement.

Where the Addendum is used, the parties incorporate the approved mandatory clauses by reference and will complete the required tables using information from this DPA and the relevant order.

If the ICO replaces or updates the approved mechanism, the updated lawful mechanism will apply where required according to its transition rules.

22. Azerbaijan transfers

The EU SCCs and UK mechanisms do not by themselves establish compliance with Azerbaijani cross-border rules.

Where Azerbaijani personal-data law applies, each party will comply with the requirements applicable to its own role, including any necessary consent, equivalent-protection assessment, registration or authority requirement.

23. US state privacy terms

To the extent Karemelo is a “service provider”, “contractor” or analogous processor under applicable US state privacy legislation:

1. Karemelo will process covered Customer Personal Data for the limited business purposes described in the Agreement and Customer instructions;
2. Karemelo will not sell or share Customer Personal Data for cross-context behavioural advertising as those terms are defined by applicable law;
3. Karemelo will not retain, use or disclose Customer Personal Data outside the permitted purposes except where law allows;
4. Karemelo will provide the level of privacy protection required of the applicable service-provider/contractor role; and
5. Karemelo will notify the Customer if it determines it can no longer meet an applicable statutory obligation.

These terms apply only where the relevant US law covers the processing.

24. Liability

Liability arising under this DPA is subject to the liability provisions of the Terms, including the enhanced contractual cap applicable to Karemelo's data-protection obligations, except to the extent Applicable Data Protection Law or incorporated transfer clauses prohibit contractual limitation.

Nothing limits the rights of a Data Subject or regulator where those rights cannot legally be limited.

25. Conflict

If this DPA conflicts with the Terms regarding Customer Personal Data, this DPA prevails.

An incorporated statutory transfer mechanism prevails to the extent it cannot legally be modified by this DPA.

26. Duration

This DPA remains effective while Karemelo processes Customer Personal Data on the Customer's behalf and thereafter for any continuing obligations concerning retained copies.