Data Processing Addendum

1.Parties and roles

This Data Processing Addendum (“DPA”) supplements the Terms of Service between the merchant (“Controller”) and Aivo Solutions LLC, the operator of Kylix Agent (“Processor”). It applies to personal data of the merchant's customers and prospects that the Processor handles on the merchant's behalf. Capitalised terms not defined here have the meaning given in the GDPR.

For merchant account data (sign-up, billing, dashboard use), Aivo Solutions LLC acts as controller; see the Privacy Policy.

2.Subject matter and details of processing

• Subject matter and purpose: providing the Kylix Agent service, meaning answering customer questions, handing conversations to the merchant's team and, where the merchant enables them, helping with orders, returns and follow-ups.
• Duration: the term of the merchant's agreement, plus the period needed to delete or return data under section 9.
• Data subjects: the merchant's customers, prospects and other people who contact the merchant through a connected channel.
• Types of personal data: name, email address, phone number, channel identifiers (such as an Instagram or WhatsApp ID), message content and attachments, call transcripts where voice is enabled, and order references from the merchant's store.
• Special categories: not intended. The merchant should not ask customers to share them in conversations.

3.Documented instructions

The Processor will process personal data only on the Controller's documented instructions, which are this DPA, the Terms of Service and the settings the Controller chooses in the dashboard, unless the law requires otherwise. If the Processor believes an instruction breaches data protection law, it will tell the Controller.

4.Confidentiality

The Processor ensures that people authorised to process personal data are bound by confidentiality obligations and have access only where needed to run the Service.

5.Security of processing

The Processor applies technical and organisational measures appropriate to the risk, as described on the Security page, including encryption in transit, row-level tenant isolation, signature verification of webhooks and restricted access to production data. The Processor may update these measures if the level of protection is not reduced.

6.Sub-processors

The Controller gives general authorisation to use the sub-processors below. The Processor binds each one to data protection obligations no less protective than this DPA and remains responsible for their performance. The Processor will tell the Controller by email before adding or replacing a sub-processor, giving at least 30 days to object on reasonable data protection grounds.

7.Data subject requests

Taking into account the nature of the processing, the Processor will help the Controller respond to requests from data subjects to exercise their rights. If the Processor receives such a request directly, it will pass it to the Controller instead of answering it, unless the Controller asks otherwise.

8.Personal data breaches and assistance

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information it has to help the Controller meet its own notification duties. The Processor will also give reasonable help with security, data protection impact assessments and prior consultation (GDPR Articles 32 to 36).

9.Deletion or return

When the agreement ends, or earlier on the Controller's written request, the Processor will delete or return the Controller's personal data within 30 days, unless the law requires it to be kept. Billing records that tax or accounting law requires us to keep are not covered by this obligation. See also the Data Deletion Instructions.

10.Information and audits

The Processor will give the Controller the information needed to show compliance with Article 28 and will allow and contribute to audits, including inspections, by the Controller or an auditor it appoints. Audits need reasonable notice, should not happen more than once a year unless a breach has occurred, and are at the Controller's cost.

11.International transfers

Kylix Agent is hosted in the United States. Where the GDPR or the UK GDPR requires a transfer mechanism for data sent from the EEA or the UK, the parties agree that the European Commission's Standard Contractual Clauses (controller to processor) and, for the UK, the UK Addendum apply and are incorporated by reference. The signed version of this DPA will include them in full.

12.Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.

13.Effective date and signed copy

This template is effective from 3 November 2026. It is not signed by default. To have a signed copy countersigned for your records, email hello@kylixagent.com with your company name and the address of the person who will sign.