This Data Processing Agreement (“DPA”) forms part of the agreement between Karumi AI, Inc. (“Karumi”, “Processor”) and the customer (“Customer”, “Controller”) governing the use of Karumi’s services (the “Services”).

This DPA applies to the extent Karumi processes Personal Data on behalf of Customer in connection with the Services and reflects the parties’ agreement with respect to applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”).

1. Definitions

Capitalized terms not defined in this DPA have the meanings set forth in the applicable Terms of Service or agreement between the parties.

“Personal Data” means any information relating to an identified or identifiable natural person processed by Karumi on behalf of Customer.

2. Roles of the Parties

Customer acts as the Controller of Personal Data.
Karumi acts as a Processor and processes Personal Data solely on documented instructions from Customer and in accordance with this DPA.

3. Scope and Purpose of Processing

Karumi processes Personal Data only as necessary to:

• Provide, operate, and support the Services;

• Perform analytics, troubleshooting, and service improvements;

• Comply with applicable legal obligations.

The categories of data subjects and Personal Data processed are determined by Customer’s use of the Services.

4. Processing Instructions

Karumi will:

• Process Personal Data only in accordance with Customer’s documented instructions, including as set forth in the applicable agreement and this DPA;

• Inform Customer if it believes an instruction violates applicable data protection law, unless prohibited by law.

5. Confidentiality

Karumi ensures that persons authorized to process Personal Data are subject to appropriate confidentiality obligations.

6. Security Measures

Karumi implements appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of the data and risks involved.

7. Sub-processors

Customer authorizes Karumi to engage sub-processors to assist in providing the Services.

Karumi remains responsible for the performance of its sub-processors in accordance with this DPA.

A current list of sub-processors is available to Customer upon request. Karumi will provide reasonable notice of material changes to sub-processors where required by applicable data protection law.

8. Data Subject Rights

Taking into account the nature of the Processing, Karumi will provide reasonable assistance to Customer in responding to requests from data subjects exercising their rights under applicable data protection laws.

9. Personal Data Breach

Karumi will notify Customer without undue delay upon becoming aware of a Personal Data breach involving Customer Personal Data and will provide reasonable information to assist Customer in meeting its legal obligations.

10. International Data Transfers

To the extent Personal Data is transferred outside the European Economic Area, Karumi will ensure that appropriate safeguards are in place in accordance with applicable data protection laws.

11. Return or Deletion of Personal Data

Upon termination of the Services, Karumi will, at Customer’s choice and to the extent technically feasible, delete or return Personal Data processed on behalf of Customer, unless retention is required by applicable law.

12. Compliance Information

Karumi will make available information reasonably necessary to demonstrate compliance with this DPA as required by applicable data protection law.

13. Liability

Liability arising out of or related to this DPA is subject to the limitations of liability set forth in the applicable agreement between the parties.

14. Governing Law

This DPA is governed by the governing law specified in the applicable agreement between the parties, unless otherwise required by applicable data protection law.

15. Order of Precedence

In the event of a conflict between this DPA and the applicable agreement, this DPA will prevail with respect to data protection matters.

Contact

For data protection inquiries, contact:
privacy@karumi.ai