Data Processing Addendum

The Controller determines the purposes and means of processing. HeyKiko acts as Processor and processes personal data only on documented instructions from the Controller.

• Subject matter — provision of the HeyKiko AI agent platform.
• Data types — content uploaded by the Controller and end-user conversation data.
• Data subjects — the Controller's staff and end users.

Personnel authorised to process personal data are bound by appropriate confidentiality obligations.

We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, immutable audit logging, and regular security review.

The Controller authorises the use of vetted sub-processors (such as cloud hosting and AI model providers) under terms no less protective than this DPA. We maintain a current list and will notify of material changes.

We will assist the Controller, as far as reasonably possible, in responding to requests from data subjects to exercise their rights under applicable law.

We will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data.

On termination, we will delete or return personal data in accordance with the Controller's instructions and applicable retention requirements.