Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of the agreement between Graaho Technologies LLC, operating as Koronik.AI (“Koronik,” “we,” “us,” or “our”), and the Client that governs the Client’s use of the Services, whether that is our Terms of Use, an Order Form, or another written agreement (together, the “Agreement”).

This DPA applies whenever Koronik processes Client Personal Data on the Client’s behalf in providing the Services. It does not apply to personal data that Koronik processes as an independent controller, such as account, billing, and website information, which is described in our Privacy Policy.

If this DPA conflicts with the Agreement on a matter of data protection, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

Capitalised terms not defined in this DPA have the meanings given in the Agreement.

• Client Personal Data means personal data contained in Client Data that Koronik processes on the Client’s behalf, including data provided by Authorized Users and data collected from End-Users through the Client’s agents.
• Data Protection Laws means all laws that apply to the processing of Client Personal Data under the Agreement, which may include the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the California Consumer Privacy Act (“CCPA”).
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data processed by Koronik.
• Sub-processor means any third party engaged by Koronik to process Client Personal Data in connection with the Services.
• Standard Contractual Clauses or SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

The terms “controller,” “processor,” “data subject,” “processing,” “business,” and “service provider” have the meanings given in the applicable Data Protection Laws.

For Client Personal Data, the Client is the controller (or a processor acting for its own customers), and Koronik is a processor (or sub-processor) acting on the Client’s behalf. Where the CCPA applies, Koronik acts as a service provider to the Client.

Each party will comply with the Data Protection Laws that apply to it in connection with the Services.

Koronik will process Client Personal Data only on the Client’s documented instructions. The Agreement, this DPA, and the Client’s use and configuration of the Services, including its agents’ instructions, knowledge sources, integrations, and permissions, are the Client’s complete instructions. Additional instructions require written agreement between the parties.

Koronik will inform the Client if, in its opinion, an instruction infringes Data Protection Laws, unless the law prohibits Koronik from doing so.

Koronik will not:

• sell or share Client Personal Data, as those terms are defined in the CCPA;
• retain, use, or disclose Client Personal Data for any purpose other than providing the Services, or outside the direct business relationship with the Client, except as permitted by Data Protection Laws; or
• use Client Data to train general-purpose AI models. Client knowledge-base content is used only to ground that Client’s own agents and is not shared with other Clients.

Koronik may create aggregated or de-identified operational information about the use of the Services to operate, secure, and improve the Services, provided that it cannot reasonably be used to identify the Client or any individual.

The Client is responsible for the lawfulness of the Client Personal Data it provides and collects through the Services. In particular, the Client will:

• have a valid legal basis, and any required notices and consents, for collecting Client Personal Data and for Koronik’s processing under this DPA;
• configure its agents, integrations, and access permissions appropriately for the data they handle;
• not submit special categories of personal data, such as health, biometric, or financial-account information, unless the parties have agreed in writing that the Services may be used for that data; and
• keep its account credentials secure and manage its Authorized Users’ access.

Koronik will ensure that personnel authorised to process Client Personal Data are bound by appropriate obligations of confidentiality, receive training appropriate to their role, and have access only to the extent needed to perform their duties.

The Client gives Koronik general authorisation to engage Sub-processors to provide the Services. The categories of Sub-processors we use are listed in Annex 3, and a current list of named Sub-processors is available on request at legal@graaho.com.

When Koronik engages a Sub-processor, it will:

• enter into a written agreement that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the services provided;
• give the Client reasonable advance notice of any new Sub-processor, so that the Client can object on reasonable data protection grounds. If the parties cannot resolve an objection in good faith, the Client may terminate the affected Services; and
• remain responsible to the Client for the Sub-processor’s performance of its data protection obligations.

Koronik will implement and maintain appropriate technical and organisational measures to protect Client Personal Data, including the measures described in Annex 2. Koronik may update these measures over time, provided that the updates do not materially reduce the overall level of protection.

The Client is responsible for its own security configuration, including the permissions it grants to agents and integrations, the security of its credentials, and the review of agent outputs where accuracy matters.

Koronik will notify the Client without undue delay after becoming aware of a Personal Data Breach. The notice will be sent to the Client’s account contact and will include, as information becomes available, the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address it.

Koronik will take reasonable steps to contain and remediate the breach and will provide reasonable assistance to help the Client meet its own notification obligations. A notice under this section is not an admission of fault or liability.

If Koronik receives a request from a data subject about Client Personal Data, it will refer the individual to the Client and will not respond directly, unless the law requires otherwise. Taking into account the nature of the processing, Koronik will provide reasonable assistance, primarily through the features of the Services, to help the Client respond to requests to access, correct, delete, restrict, or port personal data.

Koronik will provide reasonable information and assistance to help the Client carry out data protection impact assessments and any prior consultations with supervisory authorities that Data Protection Laws require, to the extent the Client cannot reasonably obtain that information itself. Where assistance requires significant resources, the parties will agree any applicable costs in advance.

During the term of the Agreement, the Client can access and export Client Data using the features of the Services. When the Agreement ends, Koronik will delete or return Client Personal Data in line with the Client’s settings and the Agreement, unless the law requires Koronik to retain it.

Copies held in backups or retained to meet legal obligations will remain protected under this DPA and will be deleted in line with Koronik’s standard retention cycles.

On written request, and no more than once a year unless required by a supervisory authority or following a Personal Data Breach, Koronik will make available the information reasonably necessary to demonstrate its compliance with this DPA, such as responses to security questionnaires and summaries of relevant policies.

Where Data Protection Laws or the SCCs give the Client a right to audit and that information is not sufficient, the Client may conduct an audit, which will be remote where possible, on reasonable advance notice, during normal business hours, under appropriate confidentiality obligations, and at the Client’s cost. Audits will not extend to other clients’ data or to information whose disclosure would compromise the security of the Services.

Koronik is based in the United States, and Client Personal Data may be processed in the United States and other countries where Koronik or its Sub-processors operate. Enterprise Clients may be able to select a hosting region or deploy in their own AWS account.

Where Client Personal Data from the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not received an adequacy decision, the parties agree that:

• EEA transfers are governed by the SCCs, which are incorporated into this DPA by reference, applying Module Two (controller to processor) where the Client is a controller and Module Three (processor to processor) where the Client is a processor. Annex 1 and Annex 2 of this DPA complete Annexes I and II of the SCCs;
• UK transfers are governed by the SCCs as amended by the UK Addendum, completed using the information in this DPA; and
• Swiss transfers are governed by the SCCs, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner acting as the competent supervisory authority where required.

The specific elections and governing law under the SCCs are those set out in the Client’s Order Form or signed DPA. Clients that need to complete these elections can contact legal@graaho.com.

Each party’s liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the SCCs do not permit such limitations.

This DPA takes effect on the Effective Date and remains in force for as long as Koronik processes Client Personal Data under the Agreement. Sections that by their nature should survive will continue after termination.

Koronik may update this DPA to reflect changes in the Services or in Data Protection Laws. We will post the updated version on this page and notify Clients of material changes. Updates will not reduce the overall level of protection for Client Personal Data during a Client’s current subscription term without the Client’s agreement.

Questions about this DPA can be sent to legal@graaho.com.

Subject matter

Provision of the Koronik.AI platform for creating and operating AI agents, as described in the Agreement.

Duration

The term of the Agreement, plus any period after termination during which Koronik returns or deletes Client Personal Data as described in Section 11.

Nature and purpose

Hosting, storing, retrieving, analysing, and transmitting Client Personal Data so that the Client’s agents can respond to End-Users, carry out authorised actions in connected systems, and provide reporting, together with support, security, and troubleshooting.

Categories of data subjects

The Client’s Authorized Users, such as employees and contractors; the Client’s End-Users who interact with its agents, such as customers and website visitors; and other individuals whose data the Client chooses to include in its knowledge sources or connected systems.

Categories of personal data

Contact and identification details, such as names, email addresses, and phone numbers; conversation content and messages; account, transaction, or record details that agents access in connected systems; and technical information, such as device and usage data.

Special categories

None intended. The Client will not submit special categories of personal data unless the parties have agreed in writing.

Frequency of transfer

Continuous, for as long as the Client uses the Services.

Koronik maintains administrative, technical, and physical safeguards designed to protect Client Personal Data, including:

• Encryption in transit for data transmitted to, from, and within the Services;
• Access control based on least privilege, with access to Client Personal Data limited to personnel who need it for their role;
• Logging and monitoring of systems to detect and respond to suspicious activity;
• Isolated storage for Enterprise deployments, with the option for eligible Clients to select a hosting region or deploy in their own AWS account;
• Personnel confidentiality obligations and role-appropriate training;
• Sub-processor due diligence and written data protection terms with each Sub-processor;
• Client controls over agent instructions, escalation rules, human hand-off, integrations, and user permissions; and
• Incident response procedures for investigating, containing, and notifying Personal Data Breaches.

Cloud hosting and infrastructure

Hosting, storage, and compute for the Services, including Amazon Web Services.

AI model providers

Large language model and AI infrastructure providers that process the data needed to generate agent responses.

Communications

Email delivery providers used to send service and account messages.

Analytics

Providers that help us understand and improve how the Services are used.

Integrations that the Client chooses to connect, such as messaging and social platforms, receive data according to the Client’s configuration and their own terms, and are not Koronik Sub-processors. A current list of named Sub-processors is available on request at legal@graaho.com.