This Data Processing Agreement ("DPA") governs how Klinworks, LLC ("Klinworks," "we," "us"), a Delaware (United States) limited liability company, file no. 10704723, with its registered office at 131 Continental Drive, Suite 305, Newark, Delaware 19713, processes the personal data that you, as a customer ("you," the "Customer"), enter into or connect to the Agent CEO service (the "Service").
It applies to customers who use the Service to process personal data of third parties—their customers, contacts, and suppliers—and it meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and equivalent laws. It supplements, and is consistent with, the Terms of Service, the Privacy Policy, and the GDPR and CCPA Notice.
This document is the published version of the DPA. If you have signed a version of the DPA with us, the signed version prevails over this page.
1. Roles of each party
1.1 You are the controller. You decide why and how the personal data of your customers, contacts, and suppliers is processed, and you are responsible for having a legal basis to process it and for having informed those people.
1.2 Klinworks is the processor. When we process that data to provide the Service to you, we act on your behalf and only on your instructions.
1.3 What this DPA does not cover. We process the data of the Service's users—your account, billing, support, and platform usage—as a controller, in accordance with the Privacy Policy. This DPA does not apply to that data.
2. Subject matter, duration, nature, and purpose
2.1 Subject matter. The processing of the personal data that the Customer enters into the Service or that reaches it from the systems the Customer connects.
2.2 Duration. For as long as the Service is provided, plus the return and deletion period in section 10.
2.3 Nature. Hosting, storage, organization, retrieval, modification, transmission to the systems you connect, and processing by AI agents and language models, always according to the configuration you set.
2.4 Purpose. Solely to provide the Service to you: so that your agents carry out the work of your business that you configure. We do not use that data for our own purposes or to train AI models (Terms §7.3).
3. Categories of data and data subjects
3.1 Data subjects. The people whose data you enter or connect: your customers, contacts, suppliers, and, where applicable, other third parties your business deals with.
3.2 Categories of data. Those you decide to process, typically: name, email address, phone number, company, order and transaction history, conversations by email, WhatsApp, or other channels, and the content your agents generate about them.
3.3 Special categories. The Service is not designed to process special categories of data (health, ethnic origin, political opinions, biometrics). If you enter them, you do so under your own responsibility and must have a legal basis for doing so (Privacy Policy §2).
4. Documented instructions
4.1 Only your instructions. We process the data solely on your documented instructions, which are those that derive from the Terms, from this DPA, and from how you configure and use the Service, including its integrations and its agents.
4.2 Unlawful instruction. If we believe an instruction infringes the GDPR or another data protection law, we will inform you without delay.
4.3 Legal obligations. If the law requires us to process the data in another way, we will inform you beforehand, unless that same law prohibits it.
5. Confidentiality
People authorized to access the data are bound by a duty of confidentiality, whether contractual or statutory. Our staff's access is limited to what is strictly necessary to operate the Service and respond to incidents; we do not read your content unless you ask us to, the law requires it, or it is strictly necessary to investigate serious abuse (Security Policy §3.4).
6. Security (Art. 32)
We apply technical and organizational measures appropriate to the risk, including:
- Encryption in transit (TLS 1.2 or higher) and at rest.
- Encryption of integration credentials with a key that does not reside in the database.
- Isolation between organizations in two layers, database and application, verified with automated tests.
- Role-based access control and two-step verification available.
- Audit logging of sensitive operations, and backups.
The details, including what we do not yet have, are in the Security Policy. We may update these measures as long as they do not reduce the level of protection.
7. Subprocessors
7.1 General authorization. You give us general authorization to engage subprocessors that process personal data on your behalf to provide the Service.
7.2 Live list. The current list, with each subprocessor's purpose, location, and status, is published at /en/legal/subprocessors. That page forms part of this DPA.
7.3 Same obligations. We impose on each subprocessor, by contract, data protection obligations equivalent to those in this DPA. We remain liable to you for their compliance.
7.4 Changes and right to object. We will notify you of any new subprocessor with [PENDIENTE: days of advance notice, e.g., 30] advance notice. You may object on reasonable data protection grounds by writing to privacidad@klinworks.com, as explained on the subprocessors page (§5).
8. Assistance to the controller
8.1 Data subject rights. We will help you, insofar as possible and taking into account the nature of the processing, to respond to your data subjects' requests for access, rectification, erasure, restriction, portability, and objection. The Service lets you view, correct, export, and delete data directly. If a person contacts us about data we process on your behalf, we will refer them to you without responding on the merits.
8.2 Other obligations. We will reasonably assist you with your obligations regarding security, breach notification, impact assessments, and prior consultation with the supervisory authority (GDPR Arts. 32 to 36), with the information available to us.
9. Security breaches
If we suffer a security breach affecting the data we process on your behalf, we will notify you without undue delay and within [PENDIENTE: time frame in hours, e.g., 48 h] of becoming aware of it, and in no event later than the 72 hours set out in the Security Policy (§10).
The notification will include, to the extent known to us: what happened, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact for further information. If we do not have all the information at once, we will provide it in phases. This allows you to meet your own obligations under GDPR Arts. 33 and 34.
10. Return and deletion upon termination
When the Service ends, you have 30 days to export your content (Terms §9.3). After that period, we delete the personal data we process on your behalf, except what the law requires us to retain. Backups follow their rotation cycle and are overwritten within the period stated in the Privacy Policy (§7).
11. Audits
We will make available to you the information reasonably necessary to demonstrate compliance with this DPA, and we will allow for and contribute to reasonable audits, including inspections, conducted by you or by an auditor you appoint, subject to:
- Reasonable prior notice and agreement on scope, date, and duration.
- A duty of confidentiality on the auditor.
- No access to other customers' data and no compromise of the Service's security.
We do not currently hold SOC 2 or ISO 27001 certifications (Security Policy §8). Frequency and cost allocation of audits: [PENDIENTE].
12. International transfers
Klinworks is located in the United States and processes data there, as do most of its subprocessors. Transfers from the European Economic Area, the United Kingdom, or Switzerland rely on the following mechanism: [PENDIENTE: Data Privacy Framework / standard contractual clauses — confirm]. Currently, the GDPR and CCPA Notice (§4) specifies the Standard Contractual Clauses of Implementing Decision (EU) 2021/914, supplemented by encryption in transit and at rest, role-based access control, and minimization of the data transferred.
13. Liability and order of precedence
13.1 Liability. Each party's liability arising from this DPA is governed by the limits in the Terms (§10), except to the extent the law does not permit limitation.
13.2 Precedence. In matters of data protection, this DPA prevails over the Terms. A signed version of the DPA prevails over this published version.
14. How to sign the DPA
This published DPA applies to all customers by virtue of using the Service under the conditions in section 1. If you need a signed copy—for example, for your record of processing activities or because your own customers require it—write to us at legal@klinworks.com with your company's legal name, its address, and the signatory.
Contact
Klinworks, LLC 131 Continental Drive, Suite 305 Newark, Delaware 19713, United States Delaware file no. 10704723
- DPA signature and legal matters: legal@klinworks.com
- Privacy and subprocessor objections: privacidad@klinworks.com
- Security incidents: security@klinworks.com