This Data Processing Addendum ("DPA") forms part of the Agreement between Kite LLC d/b/a Kite Intel ("Kite") and Customer. It applies when Kite processes Personal Information in Customer Data on Customer's behalf. Capitalized terms not defined here have the meanings in the Terms of Service.
1. Roles
Customer is the controller or business (or a processor acting for its own customers, in which case Kite is a subprocessor). Kite is the processor, service provider, or contractor. Kite acts as a controller or business only for its own account administration, security, billing, and similar purposes, as the Privacy Policy describes.
2. Instructions and Purpose Limitation
Kite will process Customer Personal Information only to provide the Services, on Customer's documented instructions (the Agreement, Customer's configuration and use of the Services, and written instructions), and as law requires. Kite will tell Customer if it believes an instruction violates law. Under U.S. state privacy laws, Kite will not: sell or share Customer Personal Information; retain, use, or disclose it for any purpose other than the business purposes in the Agreement or outside the direct business relationship with Customer; or combine it with personal information from other sources except as law permits. Kite certifies it understands and will comply with these restrictions. Kite will tell Customer if it can no longer meet its obligations under applicable privacy law. Customer may take reasonable steps to stop and remediate unauthorized use.
3. Customer Responsibilities
Customer is responsible for the lawfulness of its Customer Data and instructions, for notices and consents (including website tracking and call-recording consent), and for the accuracy of its authorizations to agencies and Authorized Users.
4. Confidentiality
Kite will ensure that personnel who access Customer Personal Information are bound by confidentiality obligations and have a need to access it.
5. Security
Kite will maintain the security program in Section 27 of the Terms, including access controls, encryption in transit, encryption at rest where appropriate, tenant isolation, logging and monitoring, and backups.
6. Subprocessors
Customer authorizes Kite to use the subprocessors on Kite's Subprocessor List. Kite will give 30 days' notice of new subprocessors that process Customer Personal Information (through the list's notification mechanism). Customer may object on reasonable data-protection grounds within that period; the parties will work in good faith to resolve it, and if they cannot, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees. Kite remains responsible for its subprocessors, and requires written terms no less protective than this DPA.
7. AI and Speech Processing
Customer Personal Information (including call audio and transcripts) may be processed by the speech and AI subprocessors on the list to provide AI Features. Kite will not use Call Content (call audio, transcripts, message content, and summaries, tags, and classifications generated from them) for model training or development, or include it in Aggregated or Deidentified Data, and will not allow those providers to use identifiable Customer Personal Information (including Call Content) to train general models for the provider's or Kite's independent purposes, except as Customer separately and expressly agrees.
8. Provider-Restricted Data
Where Customer Data includes Provider-Restricted Data, Kite will use it only as the provider's terms permit, and will stop using and delete it where those terms require. When Customer disconnects an integration or revokes access, Kite stops accessing that system and deletes the stored credential. Data already imported is retained until Customer's organization is deleted or Customer asks Kite to delete it, as described in the Privacy Policy.
9. Assistance with Individual Requests
Kite will, taking into account the nature of the processing, help Customer respond to verifiable consumer requests (access, deletion, correction, portability, opt-out) as law requires. If an individual contacts Kite directly about Customer Personal Information, Kite will, where it can identify the Customer, refer the request to Customer and not respond substantively except as law requires. Kite will help Customer with security, breach-notification, data-protection impact assessments, and regulator consultations as law requires and as reasonably related to the Services.
10. Security Incidents
Kite will notify Customer of a Security Incident without undue delay and, where practicable, within 72 hours of confirmation, and in any event within 5 business days of confirmation, with information reasonably available to Kite, and will take reasonable steps to contain and remediate it.
11. Return and Deletion
Customer may export Customer Data through available functionality. On deletion of an organization or termination, Kite will delete or, in limited cases, scrub Customer Personal Information as the Terms and Privacy Policy describe, after a 48-hour grace period. Kite keeps an archive copy (without call audio) for 30 days and then permanently deletes it, deletes information from backups within 90 days, and keeps compliance records (which contain no deleted content) for 6 years, and will continue to protect them under this DPA while retained. Call audio is deleted rather than anonymized. Kite may retain Customer Personal Information where law requires.
12. Audits
On reasonable written request, no more than once a year (or after a Security Incident), Kite will make available information necessary to show compliance with this DPA, such as security summaries or third-party reports where available. If that is not enough, Customer may conduct a reasonable audit on at least 30 days' notice, during business hours, under confidentiality, at Customer's cost, without access to other customers' data, and in a way that does not unreasonably disrupt Kite.
13. International Transfers
Kite currently provides the Services to customers in the United States and does not accept processing of personal data subject to EEA, UK, or Swiss transfer restrictions. If Kite later does, the parties will put in place the required transfer mechanism (for example Standard Contractual Clauses and the UK Addendum) before that processing begins.
14. Liability and Precedence
Liability under this DPA is subject to Section 35 of the Terms. This DPA controls over the Terms on processing and protection of Personal Information.
Annex A — Processing Details
- Subject matter and duration: providing the Services, for the term of the Agreement plus the deletion period.
- Nature and purpose: hosting, synchronizing, normalizing, analyzing, attributing, transcribing, classifying, summarizing, forecasting, and displaying business data and communications, and supporting Customer.
- Categories of data subjects: Customer's customers, leads, callers, website visitors, homeowners, technicians and employees, vendors, and Authorized Users.
- Categories of data: identifiers and contact details, service addresses, job, invoice, and estimate records, call recordings and transcripts, messages, form submissions, advertising and attribution identifiers, and incidental sensitive data in free text and audio.
- Sensitive data: not intended; may appear incidentally.
- Frequency: continuous.