1. Parties
This agreement is between Kwamle Media (the "Processor" / Data Processor) and the Customer (the "Controller" / Data Controller) using the kwamlemedia.com / app.kwamlemedia.com platform.
2. Definitions
- "Personal Data": any information relating to an identifiable natural person.
- "Processing": any operation performed on personal data (collection, storage, use, transfer, deletion).
- "GDPR": the EU General Data Protection Regulation (Regulation 2016/679).
- "CCPA": the California Consumer Privacy Act.
- "Sub-processor": any third party that processes data on behalf of Kwamle.
3. Scope of processing
Kwamle processes personal data for the following purposes:
- Operating marketing-automation services and smart bots.
- Managing Meta pages and accounts and interacting with the customer's audience.
- Generating analytics and statistics.
- Executing AI calls according to the customer's settings.
The data includes: names, phone numbers, email addresses, Facebook/Instagram identifiers, message content, and comments.
4. Kwamle's obligations as a processor
- Process data only on the customer's documented instructions.
- Ensure data confidentiality among all staff who have access to it.
- Apply appropriate security measures (Article 32 of GDPR).
- Assist the customer in responding to data-subject requests.
- Notify the customer of any data breach within 72 hours.
- Do not engage a sub-processor without the customer's consent.
- Delete or return the customer's data when the service ends.
5. Security measures
- Encryption of data in transit (TLS) and at rest.
- Role-based access control (RBAC) and the principle of least privilege.
- Audit logs of access to customer data.
- Regular vulnerability scanning and security testing.
- Two-factor authentication for staff on production systems.
- Encrypted backups stored separately from production systems.
- A vulnerability-management program plus immediate security updates.
6. Sub-processors
We use the following categories of sub-processors. The current named list, with each provider's location, is shared with customers before signing and is available on request; customers are notified of any change.
| Category | Purpose | Notes |
|---|---|---|
| Hosting and infrastructure | Servers, databases, storage and backups | Named in the current list |
| Content delivery and network protection | CDN, DNS and DDoS protection | Global edge network |
| AI model providers | AI features, using the customer's own API keys | Chosen and enabled by the customer |
| Payment processors | Subscription billing | Card details never reach our servers |
| Email delivery | Transactional email (notifications, invoices) | Named in the current list |
The customer may object to adding a new sub-processor within 30 days of being notified.
7. International data transfers
When transferring data outside the European Economic Area, we rely on:
- The new Standard Contractual Clauses (SCCs 2021).
- Adequacy decisions for countries approved by the European Commission.
- A transfer impact assessment where one is required.
8. Data breaches
When a breach is detected:
- Notify the customer within 72 hours with the incident details.
- Provide a comprehensive report on the cause, scope, and actions taken.
- Fully cooperate in the response and in reporting to regulators.
9. Right to audit
The customer has the right to:
- Request a description of our technical and organizational security measures.
- Conduct an annual audit with 30 days prior notice, at their own expense.
- Receive answers to reasonable security questionnaires.
10. Data deletion at end of service
- Upon termination of the agreement, Kwamle deletes all personal data within 90 days.
- Billing records are retained for 7 years (an accounting requirement).
- The customer is given a JSON/CSV copy of their data before deletion upon request.
Ready to sign?
Contact our legal team to receive a signed DPA for your organization.