Legal
Data processing agreement
This page summarizes the data processing agreement (DPA) that applies when Klayno processes personal data on your behalf. The full text is a PDF we sign on request; the summary is here so you can read it before you ask.
Last updated
1. When the DPA applies
The DPA applies to every workspace, on every plan, from the moment Customer Data is put into Klayno. It is included in the Enterprise agreement and available on request for the other plans. Where it conflicts with the terms of service, the DPA wins for anything about personal data.
2. Roles
- You, the customer, are the controller of the personal data in your workspace. You decide why it is collected and how it is used.
- Klayno is your processor. We process that data only to provide the Service, on your documented instructions, which include these terms and the settings you choose in the app.
- If you are yourself a processor for your own clients, Klayno acts as your sub-processor and the same obligations apply.
3. What is processed
| Item | Description |
|---|---|
| Subject matter | Hosting and processing of Customer Data to run a Klayno workspace and the features the customer turns on, including the AI employee. |
| Duration | As long as the workspace exists, plus the deletion period in section 7. |
| Nature | Storage, organization, retrieval, display, transmission to connected services, analysis by AI models on the customer's instructions, deletion. |
| Purpose | Sales pipeline, calls and follow-ups, forms, booking pages, e-signature, documents, tasks, finance, community and content analytics, as used by the customer. |
| Data subjects | The customer's prospects, clients, contacts, form respondents, signatories, booking invitees, community members, workspace members and employees. |
| Data categories | Identity and contact details, professional information, communication content (notes, messages, call transcripts), contractual and payment information, custom fields the customer defines, and any other data the customer chooses to store. |
| Special categories | None expected. The customer must not store special-category data (health, beliefs, biometrics, etc.) without a prior written agreement with Klayno. |
4. Klayno's obligations
- Process Customer Data only on your instructions, unless the law requires otherwise, in which case we tell you first where we may.
- Make sure everyone with access to Customer Data is bound by confidentiality.
- Apply the technical and organizational measures described on the security page: EU hosting, encryption in transit and at rest, per-workspace row-level security, role-based access, audit trails, daily backups.
- Help you answer data-subject requests (access, deletion, portability and the rest), with the tools in the app and, where needed, by hand.
- Help you with data protection impact assessments and consultations with a supervisory authority, to the extent the information is in our hands.
- Give you the information needed to show that both of us comply with article 28 of the GDPR.
5. Sub-processors
You authorize the sub-processors on our public list. We bind each one to data-protection obligations equivalent to ours and remain responsible for them. We update that list before a new sub-processor handles Customer Data. If you have a reasonable objection to one, write to us and we look for an alternative.
6. Personal data breaches
If we become aware of a breach affecting your Customer Data, we notify you without undue delay and at the latest within 72 hours, with what we know: what happened, which data and how many people are likely affected, what we are doing, and a contact. We then keep you updated so you can meet your own notification duties.
7. Return and deletion
You can export Customer Data from the app at any time during the contract and for 30 days after it ends. After that, we delete it from live systems within 30 days, and it leaves the backups as they rotate, within 30 days after that. We keep only what the law obliges us to keep, for example invoices.
8. International transfers
Customer Data of European customers is hosted in the European Union, on AWS. Where Klayno, a United States company, or a sub-processor processes it outside the EU, the transfer is covered by the European Commission's Standard Contractual Clauses or by the EU-US Data Privacy Framework for certified providers, plus supplementary measures where needed. Details per provider are on the sub-processors page.
9. Audits
On request, we answer your written security questionnaire and share the reports and certifications we hold from our providers. If that is not enough for a legal requirement, you can audit us once a year, with 30 days' notice, during business hours, at your cost, under a confidentiality agreement, and without disturbing other customers.
10. Request the signed PDF
Email privacy@klayno.com with your workspace name and the legal name of your company. We send the DPA as a PDF for electronic signature, usually within two business days. Enterprise customers receive it with their order form.