Legal

Data Processing Addendum

Last updated: October 15, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between KloudMate Technologies, Inc. ("KloudMate", "we", "us") and the customer that has accepted it ("Customer", "you") for the KloudMate Services (the "Agreement"). It sets out how we process personal data on your behalf and applies to the extent Customer Personal Data is subject to Data Protection Laws such as the EU GDPR, the UK GDPR, or the laws of Switzerland.

If there is any conflict between this DPA and the Agreement on the processing of personal data, this DPA controls.

1. Definitions

Data Protection Laws means all privacy and data-protection laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation (2016/679) ("GDPR"), the UK GDPR, and applicable US state privacy laws.
Controller, Processor, Data Subject, Personal Data, Processing, Supervisory Authority have the meanings given in the GDPR.
Customer Personal Data means personal data contained in the Customer Data (the telemetry and content you send to the Services) that we process on your behalf.
Sub-processor means any processor we engage to process Customer Personal Data.
SCCs means the Standard Contractual Clauses approved by the European Commission in Decision 2021/914.
UK Addendum means the UK Information Commissioner's International Data Transfer Addendum to the SCCs.

2. Roles and scope

You are the controller (or, where you process on behalf of your own customers, a processor) of Customer Personal Data, and we are your processor (or sub-processor). We process Customer Personal Data only to provide and support the Services and only on your documented instructions, which are given through the Agreement, this DPA, and your configuration and use of the Services. We will tell you if, in our opinion, an instruction infringes Data Protection Laws.

This DPA applies for as long as we process Customer Personal Data. The subject matter, nature, purpose, and duration of the processing, and the categories of data and data subjects, are described in Annex I.

3. Our obligations

We will:

Process on instructions only — process Customer Personal Data solely as described in Section 2, unless law requires otherwise, in which case we will inform you unless that law prohibits it.
Confidentiality — ensure personnel authorized to process Customer Personal Data are bound by confidentiality.
Security — implement appropriate technical and organizational measures, as described in Annex II, taking into account the risk (GDPR Article 32).
Assist with data-subject rights — provide reasonable assistance so you can respond to requests from data subjects to exercise their rights.
Assist with compliance — provide reasonable assistance with your obligations for security, breach notification, data-protection impact assessments, and prior consultation (GDPR Articles 32–36), taking into account the information available to us.
Breach notification — notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information you reasonably need to meet your own notification duties.
Deletion or return — on termination, delete or return Customer Personal Data in accordance with the Services' retention behavior (telemetry is retained for the data-retention period of your plan) and delete existing copies unless law requires us to keep them.
Audits — make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, subject to reasonable confidentiality and security conditions. We may satisfy audit requests by providing current third-party certifications or reports where available.

4. Sub-processors

You give us general authorization to engage Sub-processors to process Customer Personal Data. We impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance.

Our current Sub-processors are listed in our Privacy Policy and made available on request. We will give you notice before adding or replacing a Sub-processor, and you may object on reasonable data-protection grounds. If we cannot resolve your objection, you may terminate the affected part of the Services.

5. International data transfers

Where we process Customer Personal Data originating from the EEA, the UK, or Switzerland in a country that has not received an adequacy decision, the following apply and are incorporated into this DPA by reference:

EU transfers — the SCCs, with Module Two (controller to processor) or Module Three (processor to processor) applying as the case may be; the optional docking clause (Clause 7) applies; the general sub-processor authorization option (Clause 9, Option 2) applies with the notice period in Section 4; the Annexes of the SCCs are completed by Annex I and Annex II of this DPA.
UK transfers — the UK Addendum applies to the SCCs.
Swiss transfers — the SCCs apply with the amendments needed under Swiss law.

[Counsel to confirm the Clause 17 governing law and Clause 18 forum for the SCCs — commonly the Republic of Ireland.]

6. US state privacy laws

Where US state privacy laws apply, we act as your "service provider" (or "processor"). We do not sell or share Customer Personal Data, and we do not retain, use, or disclose it for any purpose other than providing the Services as set out in the Agreement and this DPA.

7. General

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. This DPA is governed by the law and jurisdiction of the Agreement, except where Data Protection Laws or the SCCs require otherwise.

Annex I — Details of processing

Data exporter: the Customer.
Data importer: KloudMate Technologies, Inc.
Categories of data subjects: the Customer's own personnel and end users whose personal data appears in the telemetry and content the Customer sends to the Services.
Categories of personal data: identifiers and online identifiers (such as user IDs, IP addresses, and email addresses) and any other personal data the Customer chooses to include in logs, metrics, traces, error events, and real-user-monitoring data. The Services are not intended to process special categories of personal data, and the Customer should not send them.
Nature and purpose: collection, storage, analysis, and display of observability telemetry to provide the Services, including monitoring, alerting, investigation, and AI-assisted features.
Duration: for the term of the Agreement; telemetry is retained for the data-retention period of the Customer's plan.
Frequency: continuous, as telemetry is sent to the Services.

Annex II — Technical and organizational measures

We maintain measures appropriate to the risk, including: access controls and least-privilege access; encryption of data in transit; network and infrastructure security; logging and monitoring; secure software development and change management; personnel confidentiality and training; vendor and sub-processor management; backup and recovery; and an incident-response process.

[To be finalized against KloudMate's current security program and security page before this DPA is offered to customers.]

Annex III — Sub-processors and hosting

Our Sub-processors are listed in our Privacy Policy, and include our cloud hosting and infrastructure providers, AI/LLM providers for AI features, and providers for payments, email, product analytics, support, voice and phone verification, and notification delivery.

Hosting location: Customer Data is stored and processed in the United States. KloudMate personnel, including in India, may access it to support and operate the Services, subject to the safeguards in this DPA.

This DPA is a template provided for transparency. It should be reviewed by qualified legal counsel and may be superseded by a signed agreement between you and KloudMate. To request a signed DPA, contact hello@kloudmate.com.