Kreedl - Data Processing Agreement

"Personal data", "controller", "processor", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR"). "Customer Personal Data" means personal data that the Customer provides or makes accessible to Kreedl, or that Kreedl collects on the Customer's behalf in providing the services, including communication content, recordings and transcripts, regardless of whether the data identifies the Customer or a third party entering into a contractual relationship with the Customer. "Subprocessor" means any third party engaged by Kreedl to process Customer Personal Data. "UK GDPR" means the GDPR as retained in the law of the United Kingdom.

The Customer is the controller of Customer Personal Data. Kreedl is the processor of that data. Kreedl is an independent controller only for the Customer's own account, billing, usage and marketing data, or where a third party uses Kreedl's services without having entered into a contractual relationship with the Customer. The activities are described in more detail in Kreedl's document titled Privacy Policy, available at kreedl.com/privacy ("Privacy Policy").

Subject matter and purpose. Operating an AI assistant that communicates on the Customer's behalf with tenants, residents, facility users, applicants, vendors and other persons by phone, WhatsApp, SMS and email and carries out the actions the Customer has authorised.

Nature of processing. Receiving, recording, transcribing, storing, analysing and summarising communication; reading or storing the Customer's records according to the chosen mode (section 4); booking appointments; dispatching vendors; and, where instructed, ranking applicants or summarising publicly available information about prospective tenants.

Categories of data subjects. Tenants, residents, prospective tenants or buyers, store managers and facility users, vendors and technicians, employees and representatives of the Customer, and any other person contacting a building served by Kreedl.

Types of personal data. Name, contact details, building and unit, tenancy term and conditions, rent amount and payment status, lease documents, fault reports, photos, voice notes, call recordings, transcripts, message content and metadata. For prospective tenants or buyers, additionally the expected move-in date, household size, employment, income, method of financing and references, where the Customer requires them to assess the application. Where the Customer instructs identity verification, the last four digits of the Czech national identification number may be compared against the Customer's records; the full number is not stored. Kreedl does not process door codes or other physical access credentials.

Duration. Personal data is processed for the duration of the ordered service and thereafter until return and deletion under section 12 are completed. The parties set data retention limits so that they reflect the inherent nature of the service provided. In particular, but not exclusively, the retention limits take into account the termination of tenancy relationships between the Customer and third parties, the protection of the Controller's legitimate interests in relation to its property, and the mandatory retention periods laid down by generally binding legislation.

4.1 The Customer chooses one of the three modes described in the Privacy Policy. Mode A - no access to the Customer's records. Mode B - read access to the Customer's systems without storing records. Mode C - the Customer's records stored by Kreedl. In every mode Kreedl stores communication content, recordings, transcripts and the contact details of the persons communicating with it.

4.2 The Customer's documented instructions consist of the chosen mode, the configuration agreed at onboarding, the settings the Customer makes in the Kreedl application, the data the Customer uploads or makes accessible, and any written instruction sent to [email protected]. Uploading data, activating a subscription, creating a profile or otherwise providing data to Kreedl constitutes the Customer's instruction to process that data for the purposes of section 3.

4.3 The Customer may change the mode or its instructions at any time by email, in the application or by conduct from which the change is clearly apparent. Kreedl implements changes within 14 days.

4.4 Kreedl may refuse an instruction that in its reasonable opinion infringes the GDPR or other law, and informs the Customer accordingly. Kreedl may also process Customer Personal Data where required by EU or Member State law; in that case it informs the Customer unless the law prohibits it.

The Customer represents and undertakes that -

• it has, and properly determines, a valid legal basis for all Customer Personal Data it obtains and transfers to Kreedl and for every communication it instructs Kreedl to initiate. The Customer is solely responsible for any absence of a legal basis for providing or transferring the data;
• it fulfils the duty to inform data subjects under Articles 12, 13 and 14 GDPR, including publishing the information for callers contained in Part A of Kreedl's Compliance Terms, and bears that duty alone regardless of whether Kreedl publishes information about the activity in question in its Privacy Policy. This is without prejudice to Kreedl's duty to inform in its capacity as an independent controller;
• where it instructs Kreedl to collect publicly available information about prospective tenants, it informs those persons of the source of the data no later than at first contact;
• where it provides Czech national identification numbers, it complies with Section 13c of Act No. 133/2000 Coll.;
• it is responsible for the autonomy limits it sets and for handling escalations;
• it adopts technical and implementation measures ensuring the highest possible protection of data subjects' personal data, and is solely responsible for them, unless the data is held on a device or in a database exclusively held or operated by Kreedl;
• its instructions comply with the law. The Customer is solely responsible for the lawfulness of its instructions and for any penalties connected with a failure to comply. Should either party conclude that carrying out a Customer instruction may be conditional on a Data Protection Impact Assessment ("DPIA"), the instruction is deferred until its lawfulness has been approved on the basis of a DPIA, the cost of which is borne by the Customer. Kreedl is not, however, obliged to actively review or otherwise verify the lawfulness of the Customer's instructions.

Kreedl -

• processes Customer Personal Data solely on the Customer's documented instructions and only for the purposes of section 3;
• ensures that persons authorised to process Customer Personal Data are bound by secrecy and confidentiality agreements, where Kreedl has authorised them to carry out the processing;
• implements the technical and organisational measures in Annex 1;
• does not use Customer Personal Data to train or fine-tune any AI model;
• assists the Customer with data subject requests (section 9), security, breach notification and data protection impact assessments (section 10), taking into account the nature of the processing;
• deletes or returns Customer Personal Data in accordance with section 12;
• makes available the information necessary to demonstrate compliance with Article 28 GDPR and allows audits in accordance with section 11;
• keeps the data made accessible by the Customer separate from the data it processes as an independent controller;
• adopts technical and implementation measures ensuring the highest possible protection of data subjects' personal data where the data is held on a device or in a database exclusively held or operated by Kreedl.

7.1 The Customer gives Kreedl general authorisation to engage subprocessors. The current list is in section 7 of the Privacy Policy at kreedl.com/privacy.

7.2 Kreedl notifies the Customer of the addition or replacement of a subprocessor by email at least 14 days before the change takes effect.

7.3 If the Customer objects within 14 days of the notice on reasonable data protection grounds, Kreedl may propose an alternative. If no agreement is reached, the Customer's sole remedy is to terminate the affected services by written notice, without penalty for the terminated part, with effect from the date the subprocessor change takes effect. Kreedl is not obliged to change the subprocessor.

7.4 Kreedl imposes on each subprocessor data protection obligations no less strict than those in this DPA and remains responsible for their performance.

7.5 Where Kreedl engages a new subprocessor, Kreedl is responsible for stating the new subprocessor's identity in the Privacy Policy and notifying the Customer under clause 7.2, so that the Customer can fulfil its duty to inform under section 5.

Kreedl stores Customer Personal Data in the European Union. AI processing and telephony may involve providers outside the EEA or the United Kingdom. For every such transfer Kreedl relies on the EU Standard Contractual Clauses, an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified), or, for UK data, the UK International Data Transfer Addendum. Kreedl offers an EU-only processing configuration on written request; requesting it is the responsibility of the Customer. The Customer authorises Kreedl to enter into the Standard Contractual Clauses with subprocessors on its behalf. The UK Addendum is available on request.

Where Kreedl receives a data subject request concerning Customer Personal Data, it forwards it to the Customer within 3 working days and does not respond on the merits without instruction. Kreedl provides reasonable assistance so that the Customer can respond within the statutory deadlines. Assistance beyond five requests per month, or requiring more than reasonable effort, is charged at Kreedl's current hourly rate.

10.1 Kreedl notifies the Customer of a breach of Customer Personal Data without undue delay and no later than 48 hours after becoming aware of it. The initial notice contains the information known at the time. The parties provide each other with the assistance necessary under Articles 33 and 34 GDPR to eliminate risks, the consequences of the breach and supervisory authority fines, and to investigate the breach successfully.

10.2 Notification of the supervisory authority and of data subjects is the responsibility of the party that manages the database or device in which the personal data breach occurred.

10.3 Where the Customer must carry out a DPIA, Kreedl provides it with a description of the processing, the measures in Annex 1 and reasonable further information strictly necessary for preparing the DPIA. The assessment is completed, approved and owned by the Customer. The Customer bears the cost of preparing the DPIA.

10.4 Notwithstanding the Customer's approval under clause 10.3, Kreedl is not obliged to carry out a Customer instruction where, despite the existence of a DPIA, Kreedl has reasonable grounds to suspect that the instruction is unlawful, that the principle of data minimisation was insufficiently taken into account in preparing the DPIA, or that the quality and legitimacy of the assessment are deficient.

Once per calendar year, on 30 days' written notice, the Customer may request Kreedl's completed security questionnaire, a copy of Annex 1 and the available documentation demonstrating compliance with this DPA. An on-site inspection takes place only at a place and time where a supervisory authority or the law requires it, subject to confidentiality, without access to other Customers' data and at the Customer's expense. Kreedl is not ISO 27001 or SOC 2 certified, does not warrant that internal investigations are carried out in accordance with such certification, and the Customer acknowledges this.

12.1 On termination of the Customer agreement, and at any time on written request, Kreedl exports Customer Personal Data in a structured, machine-readable format (JSON; audio files for recordings) and deletes Customer Personal Data within 30 days of termination. Encrypted backups are purged within 90 days. Kreedl confirms deletion in writing on request. Kreedl may retain data where required by law, and only for that purpose.

12.2 Where the legal basis on which the Customer holds a third party's data in relation to that third party ceases to exist, the Customer informs Kreedl and is solely responsible for providing that information. Kreedl carries out deletion in accordance with the personal data retention limits, unless the Customer insists on retaining the record for one of its legitimate interests, in which case the Customer substantiates the legitimate interest. The Customer is responsible for any administrative or other penalties arising from its failure to inform Kreedl that the legal basis has ceased to exist, or from the illegitimacy of its interest where that interest is the ground for extending data retention.

13.1 To the fullest extent permitted by law, Kreedl's total liability arising out of or in connection with this DPA, including any administrative fine or data subject claim, is limited to the amount paid by the Customer in the twelve months preceding the event giving rise to the claim, and Kreedl is not liable for indirect or consequential loss, loss of profit, loss of data or damage to reputation.

13.2 Kreedl has no obligation to indemnify the Customer.

13.3 The Customer indemnifies Kreedl against any claim, fine, loss or cost (including reasonable legal fees, and including the case where, due to conduct in no way attributable to Kreedl, Kreedl suffers loss or becomes obliged to pay a claim or fine under clause 13.1 in excess of the liability cap in clause 13.1) arising from the Customer's breach of this DPA or the GDPR, from a Customer instruction, from data provided without a legal basis or without the required information to data subjects where this DPA expressly so provides, or from the autonomy settings chosen by the Customer.

This DPA survives the termination of the Customer agreement until the last potential claim directly or indirectly connected with the rights and obligations under this DPA is time-barred under Czech law. The DPA is governed by the laws of the Czech Republic and disputes arising solely under this DPA are decided by the competent courts in Prague. It is published in English and Czech; the English version prevails unless the Customer agreement provides otherwise. Kreedl may unilaterally update this DPA on 14 days' email notice to Customers; continued use after the effective date means acceptance.

Encryption. Customer Personal Data is encrypted at rest (AES-256 or equivalent) and in transit (TLS 1.2 or higher). Call recordings and files are stored in encrypted object storage.

Access control. Role-based access. Only Kreedl staff who need it to operate the service have access. Multi-factor authentication is mandatory for all Kreedl staff and for all administrative access to infrastructure. Access is reviewed on personnel changes and at least quarterly.

Logging and auditability. Every action of the AI assistant and every staff access to Customer Personal Data is logged with time and identity. Logs are retained for 12 months and the Customer has access to them for its own data.

Secrets management. Provider credentials and API keys are stored in a secrets manager, never in code or exposed to users, and are rotated when a staff member leaves or compromise is suspected.

Customer separation. Each Customer's data is logically separated. No Customer has access to another's data.

Backups. Encrypted backups at least daily, retained for 90 days, restore tested at least annually.

AI model providers. Model providers are contractually prohibited from using Customer Personal Data for training. Kreedl does not train or fine-tune models on Customer Personal Data.

Personnel. All staff and contractors sign secrecy and confidentiality agreements and complete data protection training before being granted access. Access is revoked on the day of departure.

Incident response. A documented procedure with a responsible person, notification to the Customer within 48 hours and a post-incident review.

Physical security. Infrastructure is hosted with the providers listed in the Privacy Policy, operating certified data centres (ISO 27001 / SOC 2 at provider level). Kreedl does not operate its own data centres.

Deletion. Automatic retention rules delete communication data after 12 months or within another period set by the Customer under section 3 and clause 12.2. Deletion on termination within 30 days, backups within 90 days.