Data Processing Addendum
This addendum is part of our Services Agreement and sets out how we process personal data for our customers. Accepting the agreement accepts this addendum too.
Last updated
What this addendum is
This addendum is part of the Services Agreement between SIA Ars Ratio ("we") and the business that uses Klosemore ("you"). It applies whenever we process personal data for you.
For that data, you are the controller and we are your processor, as the EU General Data Protection Regulation (GDPR) defines them. Where this addendum and the Services Agreement differ on personal data, this addendum wins.
Where we decide. We are the controller, not your processor, for your people's sign-in identity (their name, email address, picture and sign-in records, and the invitations they send), for the Chat answers they rate or report to us, and for how much they use Klosemore. Our Privacy Policy covers that data, not this addendum. What they do in Klosemore with your data is yours, under this addendum.
The Services Agreement's limits on liability apply to this addendum too. We change this addendum the way section 16 of the Services Agreement describes: an email to your admins at least 30 days ahead.
What we process
Annex A sets out what we process for you: why, for how long, whose data, and what kinds. We process it only to run Klosemore for you, which includes checking that its flags and answers are right. We never use it for anything else, and never to build or train anything for other customers.
Decisions stay yours. Klosemore's flags and answers are input to your people's judgment. Any decision about a person that rests on them is yours, as the controller.
Your instructions
We process personal data only on your documented instructions: the Services Agreement, this addendum, and the settings your admins choose in Klosemore. If EU or member-state law makes us process it otherwise, we tell you first unless that law forbids it. If we think an instruction breaks data protection law, we tell you straight away.
Our people
Only the people who need access to run Klosemore can reach your data, and each of them is bound to keep it confidential.
Security
We protect your data with technical and organisational measures that fit the risk. Annex B lists the ones in place today. We may change them as Klosemore develops, but never in a way that lowers the protection they give your data.
Sub-processors
A sub-processor is a company we use to run Klosemore that processes your personal data on our behalf. You authorise us to use the companies on our sub-processor list, including the ones it names as coming next, as the list stands when you accept this addendum and as it changes under this section. Each one gets only the data its job needs.
The tools you connect to Klosemore, such as Pipedrive, are not our sub-processors. You chose them, you have your own contract with each one, and Klosemore reads from them on your instruction.
Each sub-processor has a written agreement with us that imposes the data protection obligations Article 28(4) of the GDPR requires. Before one starts, we check where it processes data and what covers the data if it leaves the EU. We stay responsible to you for what each one does, and we send you a copy of the data protection terms we hold with any of them if you ask.
At least 30days before a company not on the list starts processing your data, we email your workspace's admins, and any address you give us for data protection notices, and add the company to the list with the date it starts.
You can object within those 30 days by writing to privacy@klosemore.com, on reasonable data protection grounds. We then look for a way to run Klosemore for you without that company. If we cannot find one, you can end the Services Agreement with effect from the day that company starts, with the refund its section 16 gives.
If we must replace a company at short notice, because it stops its service or has a security problem, we tell you as soon as we can.
Transfers outside the EU
Your data stays in the EU except where the sub-processor list says otherwise. Where a sub-processor handles it outside the EU, we rely on the EU-US Data Privacy Framework if that company is certified under it, and otherwise on the European Commission's standard contractual clauses (processor to processor) in our agreement with that company. We send you a copy of those clauses, with their annexes completed, on request. Before we rely on the clauses alone for a company, we assess the transfer, and we send you that assessment on request too.
If a government asks us for your data, we tell you before we answer unless the law forbids it, and we give only what the request lawfully requires.
Helping you meet your duties
When someone asks to see, correct, delete or move their data, we help you answer in time for your own deadline, and we aim to do so within 10 days of your request: we find that person's data in Klosemore and export, correct or delete it as you ask. If such a request reaches us directly, we pass it to you rather than answer it ourselves.
We also help you with security and with consultations with a supervisory authority, as far as the information we hold allows. For a data protection impact assessment, we give you Annexes A and B, an account of how Klosemore uses AI, and answers to your questions.
If something goes wrong
If we become aware of a breach that affects your personal data, we tell you without undue delay, and we aim to do so within 48 hours, by email to your admins and to any address you give us for security notices, with what we know: what happened, what data and people it touches, what it may lead to, and what we are doing about it. A breach at a sub-processor counts from the moment it tells us. Our first message names a person you can reach, and we keep adding to it as we learn more.
When the agreement ends
From the day the Services Agreement ends or you disconnect your CRM, whichever comes first, we keep your data for 30 days, so you can export it as the agreement describes, or reconnect. Then, within a day, we delete all personal data we process for you from Klosemore, unless the law requires us to keep some of it, and the copies expire as below.
You can ask us to delete sooner, and we aim to do so within 7 days of your request. When the deletion is done, we confirm it to you by email. Copies in our database backups and our host's logs, which can hold fragments of your data, expire within 30 days of it, and we delete the email you sent us together with your data, or sooner if you ask.
Information and audits
We give you the information you need to show that we meet this addendum. If that is not enough, you or an auditor bound to confidentiality may audit us once a year, on 30 days' notice, at your own cost, and in a way that does not expose other customers' data.
Contact
For anything in this addendum, write to privacy@klosemore.com.
Annex A. Details of processing
- Subject matter and purpose
Running Klosemore for you: copying your CRM data and analysing it with automated checks and AI models to show which deals need attention and why, answering your people's questions and remembering context for them, drafting text for their review, making the changes to your CRM they confirm, and checking that the results are right.
Klosemore evaluates deal activity automatically, including what each of your people did or did not do on a deal, which the GDPR calls profiling. It makes no automated decision about anyone. You tell your people this, and you answer any objection they make to it, as the controller.
- Duration
For as long as the Services Agreement runs, then until we delete the data as section 10 describes.
- People the data is about
Your people, whether or not they use Klosemore; your contacts, leads and customers in your CRM; and anyone named in the notes, activities and email you connect.
- Kinds of personal data
Names, email addresses, phone numbers, the companies people work for and those companies' addresses; deal, lead and activity records, including call and meeting notes, and which of your people owns each deal; the text of notes and of email synced to your CRM; what Klosemore infers from them, such as the tone of an email or that a contact has left their company; your people's Chat conversations and what Chat remembers for them; and what each of your people does in Klosemore with this data, such as the flags they act on or dismiss and the changes they confirm.
We do not ask for special categories of data, such as health data. If your CRM holds some, Klosemore processes it the same way as the rest.
Annex B. Security measures
- Access control. Only the people who need it to run Klosemore can reach its production systems, each with their own account, and every such account uses two-factor sign-in.
- Encryption. Your data is encrypted in transit and at rest.
- Location. Klosemore's database is in the EU. What any sub-processor handles elsewhere, our host's logs included, is on the sub-processor list.
- Backups and restore. Our database keeps a rolling history, so we can restore data lost by mistake.
- AI providers. Requests to the models that read and write text are processed in the EU, apart from the exceptions the sub-processor list states; the search vectors for Chat's memory are made in the United States. We use AI providers only under terms and settings that forbid them to train on your data or keep it beyond what the sub-processor list says, and we never train a model on it ourselves.
- Changes to your CRM. Klosemore changes your CRM only if your admins allow it, and only when the person using it confirms the change.
We hold no security certification yet.
Change history
None yet. Every change to this document appears here with its date.