Data Processing Agreement

When you use Kirora to email, message or track the people you do business with, you decide what data goes in and what happens to it, and we process it for you. This Data Processing Agreement (“DPA”) sets out how we do that and what each of us is responsible for under the data protection laws that apply: the EU General Data Protection Regulation, the UK GDPR, Nigeria’s Data Protection Act 2023, and the California Consumer Privacy Act as amended by the CPRA.

You do not need to sign anything. This DPA forms part of our Terms of Service and takes effect when you accept them.

1. Parties and scope

This DPA is between Kirora Technologies Limited of Woodland Court, DPK Estate, Orchid, Lagos, Nigeria (“Kirora”, “we”, “us”) and the customer that has accepted the Terms (“Customer”, “you”).

It applies whenever Kirora processes Customer Personal Data in providing the Service. It does not cover personal data that Kirora handles as a controller in its own right, such as account, billing and sign-in details of your users, which our Privacy Policy covers.

2. Definitions

Words defined in the Terms have the same meaning here. In addition:

Data Protection Laws means all laws on the processing of personal data that apply to the processing under this DPA, including the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Nigeria Data Protection Act 2023 (“NDPA”), and the California Consumer Privacy Act of 2018 as amended (“CCPA”), each as updated or replaced.
GDPR means Regulation (EU) 2016/679.
UK GDPR means the GDPR as it forms part of UK law.
Customer Personal Data means personal data that Kirora processes on your behalf in providing the Service, as described in Annex 1.
Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR, and include the equivalent terms in other Data Protection Laws (such as “business” and “service provider” under the CCPA, and “data controller” and “data processor” under the NDPA).
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
Sub-processor means a third party that Kirora engages to process Customer Personal Data.
SCCs means the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914.
UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
Workspace means a separate space in the Service holding its own contacts, messages and settings.
Partner Account means an account that creates and manages Workspaces for its own customers (“Tenants”) through the Service.

3. Roles of the parties

You are the controller, we are your processor. For Customer Personal Data, you decide why and how it is processed, and Kirora processes it only on your behalf. If you act as a processor for someone else (for example, an agency running campaigns for its clients), Kirora acts as your sub-processor, and you confirm that your instructions have been authorised by the relevant controller.

Partner Accounts. A Partner Account may create Workspaces for its Tenants. In that case the Partner usually acts as a processor for each Tenant, and Kirora acts as the Partner’s sub-processor. The Partner is responsible for having its own data processing terms in place with each Tenant that are at least as protective as this DPA, and for passing on to its Tenants any notices we give under this DPA. Kirora takes instructions from the Partner, not from Tenants directly, unless the law requires otherwise.

Your responsibilities. You are responsible for:

having a lawful basis for the processing and for any messages you send, including consent where it is required for marketing or tracking;
giving data subjects the notices the law requires;
the accuracy and quality of the data you put into the Service; and
not putting special-category data (such as health, religion or biometric data) or data about children into the Service, except as our Acceptable Use Policy allows.

4. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are:

this DPA and the Terms;
the way you configure and use the Service, including the dashboard and the API; and
any other written instructions you give us that we agree to in writing.

If we believe an instruction breaks Data Protection Laws, we will tell you, and we may suspend that processing until you confirm or change it. If a law requires us to process Customer Personal Data in another way, we will tell you before we do, unless that law forbids it.

5. Confidentiality of personnel

Everyone at Kirora who can access Customer Personal Data is bound by a duty of confidentiality, by contract or by law. We give access only to people who need it to provide, support or secure the Service, and only as far as they need it.

6. Security

We apply technical and organisational measures appropriate to the risk, taking account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. These include:

encryption of data in transit, and encryption at rest of secrets and stored files;
hashing of API keys and session tokens, so that a copy of our database does not reveal them;
access controls, roles and two-factor authentication for users of the Service;
audit logs of sensitive actions, including data exports and erasures; and
retention limits so that data is not kept longer than needed.

Annex 2 lists these measures in more detail. We may update them over time, as long as the overall level of protection does not go down.

You are responsible for the security of your own account: keeping credentials and API keys safe, giving access only to people who need it, and turning on two-factor authentication.

7. Sub-processors

General authorisation. You authorise Kirora to engage Sub-processors to help provide the Service. Our current Sub-processors are listed on our Sub-processors page, which forms Annex 3 of this DPA.

Our commitments. Before a Sub-processor processes Customer Personal Data, we:

check that it can give the level of protection this DPA requires;
put a written agreement in place that imposes data protection obligations no less protective than this DPA, as far as they apply to the service it provides; and
remain responsible to you for its performance of those obligations.

Notice of changes. We will give you at least 30 days’ notice before a new Sub-processor starts processing Customer Personal Data, by updating the Sub-processors page and by email to subscribers of that page and to the owner of each Workspace. In an emergency (for example, to keep the Service running or secure), we may give shorter notice, and will tell you as soon as we can.

Your right to object. You may object to a new Sub-processor on reasonable data protection grounds by emailing privacy@kirora.io within the notice period. We will discuss your concerns in good faith and try to find a solution, such as a change in configuration that avoids the Sub-processor. If we cannot resolve the objection within 30 days, you may terminate the affected part of the Service by written notice, and we will refund any prepaid fees for the period after termination.

Services you connect. If you connect a third-party service to your Workspace (for example, a payment provider that sends us order events, an automation tool that calls our API, or a CAPTCHA widget from your own Cloudflare account on your forms, instead of Kirora’s default one), that service acts under your own agreement with it, not as Kirora’s Sub-processor. The Sub-processors page lists these separately.

8. Helping you with data subject requests

People whose data you hold may ask you to access, correct, delete, export or restrict their data, or object to its use. The Service gives you tools to handle these requests yourself:

Access and portability. Export everything we hold about one contact (profile, consent history, events, messages, group and segment membership, form submissions, and push devices, without device tokens) as one JSON document, from the dashboard or with GET /v1/contacts/{id}/data-export.
Erasure. Erase a contact from the dashboard or with POST /v1/contacts/erase. Erasure deletes the contact and anonymises their message history in the same step, so campaign totals stay accurate but the person can no longer be identified from them.
Correction. Update contact attributes in the dashboard, by import or through the API.
Objection to marketing. Every marketing email carries a one-click unsubscribe link, and you can withdraw a contact’s consent per channel at any time. Each change is recorded in an append-only consent log.

When a contact is erased, we keep their email address or phone number on your suppression list if they had unsubscribed, bounced or complained, so that they are not messaged again. This is the minimum needed to honour their objection.

If we receive a request directly from one of your data subjects, we will not respond to it ourselves (other than to tell them to contact you), and we will forward it to you without undue delay where we can identify you as the controller. Where your own tools are not enough, we will give you reasonable help, taking into account the nature of the processing.

9. Personal Data Breaches

If we become aware of a Personal Data Breach, we will notify you without undue delay and in any case within 48 hours of becoming aware of it, so that you can meet your own obligation to notify regulators within 72 hours.

Our notice will describe, as far as we know at the time:

the nature of the breach, including the categories and approximate number of data subjects and records concerned;
the likely consequences;
the measures we have taken or propose to take to deal with it and reduce its effects; and
a contact who can give more information.

Where we cannot give all of this at once, we will give it in stages without further undue delay. We will notify the owner of each affected Workspace by email, and for Partner Accounts, the Partner. Notifying a breach is not an admission of fault or liability.

We will take reasonable steps to contain and investigate the breach, and will cooperate with you on notices to regulators and data subjects. You decide whether and how to notify them, unless the law requires us to.

10. Impact assessments and prior consultation

Where you need to carry out a data protection impact assessment, or consult a supervisory authority, about your use of the Service, we will give you reasonable help with information about the Service that you do not otherwise have. This DPA, the Sub-processors page and Annex 2 are designed to cover most of what you will need.

11. International transfers

Where your data is hosted. We host Customer Personal Data in the European Union: the application, database and cache with Brimble in Germany, and email delivery and file storage on Amazon Web Services’ eu-central-1 region in Frankfurt, Germany.

Transfers to Sub-processors. Some Sub-processors process Customer Personal Data outside the European Economic Area, the UK or Nigeria, as listed on the Sub-processors page. Where Data Protection Laws restrict such a transfer, we rely on:

EU data: an adequacy decision (including the EU-US Data Privacy Framework, where the Sub-processor is certified), or the SCCs, Module 2 (controller to processor) or Module 3 (processor to processor), as the case may be;
UK data: UK adequacy regulations (including the UK Extension to the Data Privacy Framework), or the SCCs with the UK Addendum; and
Nigerian data: the grounds in sections 41 to 43 of the NDPA, including an adequacy finding, binding contractual terms that give an adequate level of protection, or another ground those sections allow.

Transfers between you and Kirora. Where you are outside the EEA, UK or Nigeria and your use of the Service involves a restricted transfer to Kirora, the SCCs (Module 2, or Module 3 where you are a processor), the UK Addendum and the NDPA transfer terms are incorporated into this DPA by reference, completed as follows:

the “data exporter” is you and the “data importer” is Kirora;
Clause 7 (docking clause) applies;
Clause 9(a) Option 2 (general written authorisation) applies, with the notice period in section 7 of this DPA;
in Clause 11, the optional redress language does not apply;
Clauses 17 and 18: the law and courts of Ireland;
Annex I of the SCCs is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by Annex 3; and
for the UK Addendum, Table 4 allows either party to end it as Section 19 of the Addendum permits.

If there is a conflict between the SCCs and this DPA, the SCCs prevail.

12. Deletion and return at the end

Export before you leave. You can export your contacts and individual contact records at any time from the dashboard or through the API.

Deleting a Workspace. A Workspace owner can ask to delete their Workspace (Partners can delete a Tenant’s Workspace through the API). Sending stops at once. The deletion can be cancelled for 14 days. After that grace period we delete the Workspace and all Customer Personal Data in it, including stored files and the email sending identities and configuration we set up for it.

When the Terms end or a Workspace is closed. When the Terms end or a Workspace is closed (other than at the owner’s request, as above), you can export Customer Data for 30 days , after which we delete it, unless the law requires us to keep it. Suspension alone does not start this period.

Backups. Deleted data may remain in our backups for up to 30 days until those backups expire in the normal cycle. Backups are protected under this DPA and are not used for any other purpose while they exist.

Data we keep. We may keep data where the law requires it, and records we keep as a controller in our own right (such as billing records and audit logs of account activity), under our Privacy Policy.

13. Audits and information

We will make available the information reasonably needed to show that we meet our obligations under this DPA. We will do this first by:

answering your reasonable security and privacy questionnaires, no more than once a year unless there has been a Personal Data Breach or a regulator asks; and
giving you summaries of any independent security assessments or certifications we hold.

If that information is not enough to show compliance, or a supervisory authority requires it, you may audit our processing of Customer Personal Data, including by on-site inspection, through an independent auditor bound by confidentiality, on at least 30 days’ written notice, during normal business hours, no more than once a year, and in a way that limits disruption to our business and protects the data of our other customers. You bear the cost of the audit unless it reveals a material breach of this DPA by us.

14. CCPA service provider terms

Where the CCPA applies, Kirora is your service provider and Customer Personal Data is personal information you disclose to us for a business purpose: providing the Service. We will not:

sell or share Customer Personal Data (as “sell” and “share” are defined in the CCPA);
keep, use or disclose it for any purpose other than providing the Service and the business purposes the CCPA allows a service provider, including for any commercial purpose other than the Service;
keep, use or disclose it outside our direct business relationship with you; or
combine it with personal information we receive from others or collect ourselves, except as the CCPA permits.

We will comply with the CCPA’s obligations that apply to service providers and give the same level of privacy protection the CCPA requires of you. We will tell you if we can no longer meet those obligations. You may take reasonable steps to stop and remediate any unauthorised use of Customer Personal Data. We certify that we understand and will comply with these restrictions.

15. Liability

Each party’s liability under or in connection with this DPA, including under the SCCs, is subject to the limitations and exclusions of liability in the Terms, as far as the law allows. Nothing in this DPA limits either party’s liability to data subjects under the SCCs or Data Protection Laws.

16. Order of precedence and general terms

If there is a conflict between documents, this order applies: (1) the SCCs and UK Addendum, where they apply; (2) this DPA; (3) the Terms. Otherwise the Terms continue to apply.

This DPA lasts for as long as Kirora processes Customer Personal Data for you. We may update it to reflect changes in law, guidance or the Service; we will tell you of material changes in advance, and no change will lower the protection given to Customer Personal Data. This DPA is governed by the law that governs the Terms (see section 25 of the Terms) .

Questions about this DPA can go to privacy@kirora.io .

Annex 1: Details of processing

Subject matter. Kirora’s provision of the Service to you: storing your contacts and sending email and push messages on your behalf, including campaigns, transactional messages, journeys and forms.

Duration. For the term of the Terms, plus the period until deletion described in section 12.

Nature and purpose. Collecting, storing, organising, segmenting, analysing and deleting Customer Personal Data so that you can:

manage contacts, consent and subscriptions;
build segments and automated journeys from contact attributes and events;
send email and push messages and measure their delivery and engagement;
collect sign-ups through forms;
connect the Service to your own systems through our API, webhooks and integrations; and
draft content and analyse performance with Kiro AI, our drafting assistant, where you have it switched on.

Types of personal data.

Contact identifiers: email address, phone number, your own contact ID, name.
Attributes: any other fields you choose to store about a contact, such as country, timezone, language, plan or order history.
Events: actions you send us or that the Service records, such as sign-ups, purchases and page views, with their properties and time.
Message content and delivery data: the content of messages sent to a contact, delivery status, bounces and complaints, and (where tracking is on) opens and clicks, with time and IP address. Tracking for contacts in the EEA and the UK follows the rule in our Privacy Policy.
Consent history: the channel, status, source, basis, wording shown, IP address and time of each consent change.
Push device data: device and browser push tokens, platform and app version.
Form submissions: the fields a person fills in on your forms, with time and IP address.
Your users: names and email addresses of the people you invite to your Workspace, only as they appear in Customer Data you create (for example, audit records in your Workspace).

Special categories. None intended. You must not send special-category data or data about children unless the Acceptable Use Policy allows it.

Categories of data subjects.

Your contacts: customers, prospects, subscribers and app users you message or track through the Service.
Your users, only as they appear in Customer Data you create (for example, audit records in your Workspace).

Frequency. Continuous, for as long as you use the Service.

Retention. As you configure, within these defaults: events 2 years; messages anonymised after 2 years; audit events 2 years; form submissions 1 year; API request logs 30 days; Kiro AI conversations 90 days after the last message; webhook delivery records 30 days (delivered) or 90 days (failed); contact export files 7 days. Deleted Workspaces are removed 14 days after the request.

Competent supervisory authority. For SCCs Module 2 or 3, the supervisory authority of the EU Member State where you are established, or, if you are not established in the EU, where your representative is, or else the Irish Data Protection Commission.

Annex 2: Technical and organisational measures

Encryption

Data in transit to and from the Service is encrypted with TLS.
Secrets you give us (such as integration keys, push credentials and CAPTCHA secrets) and two-factor authentication secrets are encrypted at rest at the application level.
Contact import and export files are stored encrypted in private storage buckets.
Web push message content is encrypted end to end between our servers and the subscriber’s browser.
Database storage is encrypted at rest.

Credentials and access

API keys and session tokens are stored only as hashes.
Users can turn on two-factor authentication; deleting a Workspace needs the password and, where on, a two-factor code.
Roles in each Workspace limit what users can see and change, and API keys carry scopes.
Cloud infrastructure follows least privilege: workloads use separate roles with only the permissions they need, and production and staging run in separate accounts.
Rate limits protect sign-in and public endpoints.

Logging and monitoring

Audit logs record sensitive actions, including contact data exports, export downloads and erasures, with the actor.
Cloud account activity is recorded in an audit trail.
Email reputation (bounces and complaints) is monitored, with automatic pauses and on-call alerts.

Data minimisation and retention

Retention limits remove or anonymise events, messages, audit events, form submissions, expired sessions, request logs and export files on a schedule.
Webhook delivery records are kept 30 days (delivered) or 90 days (failed). The payload of a delivered webhook is deleted as soon as it is delivered.
Open and click tracking can be switched off for all contacts; for contacts in the EEA and the UK it follows the rule in our Privacy Policy.

Kiro AI cannot read contact records.
Requests to our AI provider are sent with storage switched off (store: false).
A Workspace owner or admin can switch Kiro AI off for the Workspace.

Consent and messaging controls

An append-only consent log per channel records source, actor, basis, IP and time.
Every marketing send is checked for consent, topic and suppression before it goes out.
One-click unsubscribe on every marketing email; bounces and complaints suppress the address automatically.

Isolation

Each Workspace’s data is kept logically separate and every request is scoped to one Workspace.
Each Workspace sends email through its own verified domain and sending configuration.

Organisational

Staff access to Customer Personal Data is limited to those who need it, under confidentiality obligations.
Changes to infrastructure are reviewed before they are applied.
We keep a breach response procedure designed to meet the notice times in section 9.
Database backups are taken regularly and protected under this DPA.
Sub-processors are reviewed before they are engaged.

Annex 3: Sub-processors

Our current Sub-processors, what they do, what data they process, where, and the safeguard for any transfer are listed on our Sub-processors page, which forms part of this DPA.