Data Processing

This summarizes how Kool processes personal data on behalf of Business Customers. Our full Data Processing Agreement (DPA), including EU Standard Contractual Clauses and annexes, is available for signature — email legal@k00l.app.

Roles

For data a business customer's users put into Kool, the customer is the controller and Kool is the processor, acting on the customer's instructions.

Key commitments

• Process personal data only on documented instructions.
• Confidentiality and least-privilege access.
• Security measures per our Security Overview.
• Subprocessors limited to those listed at /subprocessors, with 30 days' change notice.
• International transfers protected by EU SCCs and the UK Addendum.
• Breach notification without undue delay, within 72 hours of awareness.
• Assistance with data-subject requests; return or deletion of data on termination.