Data Processing Agreement

Everyone Kadaleo authorises to process Customer Personal Data is bound by confidentiality.

Kadaleo applies the measures listed under Security in the Privacy Policy and keeps them appropriate to the risk, as Article 32 of the GDPR requires.

The customer gives Kadaleo general authorisation to use the sub-processors listed below, which process Customer Personal Data on Kadaleo's behalf. Kadaleo binds each of them to data protection obligations equivalent to this DPA and remains responsible for them. The Privacy Policy also lists recipients that act only for Kadaleo's own purposes or as independent controllers.

Twilio. Where a WhatsApp number is connected through Kadaleo's Twilio account, Twilio Ireland Limited transmits the messages as our sub-processor under Twilio's Data Protection Addendum. Separately, and not on our instructions, Twilio processes communications usage data and, to the extent necessary, message content as an independent controller for its own purposes: platform security and incident prevention, abuse and fraud prevention (including improving its internal tools and training its internal models for those purposes), legal and regulatory compliance, product development and improvement, and business analytics (Twilio Data Protection Addendum, sections 3.3 to 3.5). We do not control that processing; the customer should mention it in its own privacy notice, and the privacy page Kadaleo generates for the customer's website does.

Transfers of Customer Personal Data outside the European Economic Area rely on an adequacy decision, including the EU-US Data Privacy Framework where the recipient and the service are certified, or on the Standard Contractual Clauses in the provider's data processing terms, with supplementary measures where needed. The customer can ask for a copy of the safeguards at legal@kadaleo.com. fal.ai is not engaged to process Customer Personal Data and is therefore not a sub-processor. Every image or video request is first rewritten by our AI provider Anthropic (processor terms with the Clauses) into a purely visual description without names, addresses, contact details, references to real people or any place that shows where a business or a person is (a well-known city or landmark may stay when it is the view asked for), checked a second time, and not sent at all if either step fails. No photo uploaded by a customer is ever sent to fal; a clip made from a picture uses only a picture Kadaleo generated. We test this filter on difficult examples. Because it is automated, a rare omission cannot be fully excluded. If personal data nevertheless reaches fal, Kadaleo treats the event as a personal data breach: it contains it, asks fal to delete the request and any file made from it (every request already tells fal to keep no history of requests), and notifies the affected customer without undue delay in accordance with the Personal data breaches section. This procedure is not a transfer safeguard under Chapter V of the GDPR and does not make such a transfer lawful. Should we ever intend to send fal data that identifies a person, we will first conclude processor-to-processor terms (Module 3) and list fal as a sub-processor with 14 days' notice.

Kadaleo notifies the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information it has to help the customer meet its own notification duties.

When the owner closes an account in Settings, Customer Personal Data stays available for export for 30 days, during which the closure can be cancelled. It is then deleted, and it leaves rolling backups within 35 days after deletion, so the whole cycle ends within about 65 days. Backups are used only to recover from failures; if one is ever restored, closures already carried out are carried out again automatically. Kadaleo keeps its own invoices and tax records for the legal period, which does not extend to the customer's CRM data, conversations or backups. The customer can delete data earlier in the product or by writing to legal@kadaleo.com. Steps for data received from connected platforms are on the Data deletion page.

Kadaleo gives the customer the information needed to show compliance with Article 28 of the GDPR and allows for and contributes to audits, including inspections, by the customer or an auditor it mandates. An audit normally starts with documents and remote review. An inspection on site, or a further audit in the same year, takes place where the documents are not enough to show compliance, after a personal data breach, or where a supervisory authority requires it. The customer gives reasonable written notice, at least 30 days except after a breach or where an authority requires less, and the audit is carried out during business hours, under confidentiality, without access to other customers' data and without putting their security at risk. Each party bears its own costs, except that Kadaleo may charge reasonable costs for an audit beyond one a year that is not caused by a breach on its side. For its sub-processors, Kadaleo may rely on their certifications and audit reports.

Liability between the parties under this DPA is subject to the limits in the Terms of Use, as far as the law allows. Nothing in this DPA limits the rights of data subjects, the powers of supervisory authorities, the Standard Contractual Clauses where they apply, or remedies that the law does not allow to be limited. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails. Portuguese law and the courts of the Comarca da Madeira (Funchal) apply to disputes between the parties, as in the Terms, without prejudice to mandatory law. The English version prevails over translations.