Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Open Digital WEB LTD (trading as Klarvo), registered in England and Wales with its registered office at 36 Tyndall Court, Lynchwood Business Park, Peterborough, PE2 6LR, United Kingdom, and Customer for the provision of the EU AI Act compliance platform services ("Services").

1. Definitions

In this DPA:

• "Controller" means the Customer who determines the purposes and means of processing Personal Data.
• "Processor" means Open Digital WEB LTD (trading as Klarvo), which processes Personal Data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, and deletion.
• "Data Subject" means an identifiable natural person whose Personal Data is processed.
• "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation).
• "UK GDPR" means the GDPR as retained in UK law by the Data Protection Act 2018.

2. Roles and Responsibilities

2.1 Customer as Controller

The Customer acts as the Controller for Personal Data processed through the Services. The Customer is responsible for:

• Ensuring lawful basis for processing
• Providing appropriate notices to Data Subjects
• Ensuring accuracy of Personal Data
• Responding to Data Subject requests

2.2 Klarvo as Processor

Open Digital WEB LTD (trading as Klarvo) acts as a Processor, processing Personal Data only on documented instructions from the Customer. We will:

• Process Personal Data only as instructed by the Customer
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organisational measures
• Assist the Customer with Data Subject requests
• Delete or return Personal Data upon termination

3. Subject Matter and Details of Processing

3.1 Subject Matter

The provision of the Klarvo EU AI Act compliance platform, including AI system inventory, classification, evidence management, and reporting features.

3.2 Duration

Processing will continue for the duration of the Services agreement and as required for data retention obligations.

3.3 Nature and Purpose

Processing is necessary to provide the Services, including storing and organising compliance data, generating reports, and facilitating user access.

3.4 Types of Personal Data

• User account data (name, email, job title)
• Usage data and access logs
• Any Personal Data included in Customer's compliance documentation

3.5 Categories of Data Subjects

• Customer employees and authorised users
• Individuals referenced in Customer's compliance data

4. Security Measures

Open Digital WEB LTD implements appropriate technical and organisational measures including:

• Encryption of data at rest and in transit
• Access controls and authentication
• Regular security testing and monitoring
• Incident detection and response procedures
• Employee security training
• Physical security controls for data centres

For details, see our Security page.

5. Sub-Processors

5.1 Authorisation

The Customer authorises Open Digital WEB LTD to engage sub-processors for the provision of Services. We will:

• Maintain a list of current sub-processors
• Notify the Customer of changes to sub-processors
• Ensure sub-processors are bound by equivalent data protection obligations

5.2 Current Sub-Processors

6. Data Subject Rights

Open Digital WEB LTD will assist the Customer in responding to Data Subject requests including:

• Access to Personal Data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing

7. Data Breach Notification

In the event of a Personal Data breach, Open Digital WEB LTD will:

• Notify the Customer without undue delay (and within 48 hours where feasible)
• Provide information about the nature and scope of the breach
• Describe measures taken to address the breach
• Assist the Customer with regulatory notifications

8. International Transfers

Open Digital WEB LTD primarily processes data within the European Economic Area. Where transfers outside the EEA or UK are necessary:

• Transfers are made to countries with an adequacy decision
• Or subject to Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs)
• Supplementary measures are applied where required

9. Audit Rights

Open Digital WEB LTD will make available information necessary to demonstrate compliance with this DPA. The Customer may:

• Request and review audit reports and certifications
• Conduct or mandate audits with reasonable notice

10. Data Deletion

Upon termination of Services, Open Digital WEB LTD will:

• Provide an option to export Customer data
• Delete all Personal Data within 30 days of termination
• Certify deletion upon request

Data may be retained longer if required by applicable law.

11. Liability

Each party's liability under this DPA is subject to the limitations set forth in the main Services agreement.

12. Contact

For DPA inquiries:

• Email: dpa@klarvo.io
• DPO: dpo@klarvo.io
• Address: Open Digital WEB LTD, 36 Tyndall Court, Lynchwood Business Park, Peterborough, PE2 6LR, United Kingdom

Related Documents

This DPA should be read alongside:

• Terms of Service — Main service agreement
• Privacy Policy — How we handle personal data
• Security — Technical and organisational measures
• GDPR Compliance — Our GDPR compliance approach
• Cookie Policy — Use of cookies and tracking technologies