Data Processing Addendum

This Data Processing Addendum ("DPA") summary applies when Kellexa Technologies Pvt. Ltd. processes personal data on behalf of a business customer ("Customer") in connection with the Kellexa Services. Customer is the data controller; Kellexa acts as data processor under GDPR Article 28 and equivalent laws.

Consumers using Kellexa for personal creator accounts are governed by the Privacy Policy, not this DPA, unless they enter a separate business agreement.

Processing is limited to providing workflow automation, integrations, billing, support, and security as described in the Terms and Privacy Policy, for the duration of the subscription plus retention periods specified therein.

• Storage and execution of workflow definitions and media.
• OAuth token management for connected social accounts.
• Run logging, analytics, and credit metering.
• Customer support and incident response.

• Data subjects: Customer personnel, end users, and individuals appearing in Customer content.
• Categories: identifiers, professional data, content metadata, usage logs, and technical data as defined in the Privacy Policy.

• Process personal data only on documented instructions from Customer, including via account configuration and Terms.
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see Security Policy).
• Assist with data subject requests, DPIAs, and breach notifications as reasonably required.
• Delete or return personal data upon termination, subject to legal retention.
• Make available information necessary to demonstrate compliance and allow audits upon reasonable notice (no more than annually for standard plans).

Customer authorizes use of sub-processors listed in our sub-processor register. We will provide 30 days' notice of material additions; Customer may object on reasonable grounds. Alternative arrangements or termination may apply if unresolved.

Transfers outside the EEA/UK use Standard Contractual Clauses (2021 modules) or UK IDTA as applicable, plus supplementary measures where required by Schrems II guidance.

Kellexa will notify Customer without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting Customer data, with information to support regulatory notification obligations.

Liability under this DPA is subject to the limitations in the Terms. In case of conflict between this summary and a fully executed enterprise DPA, the executed DPA prevails.

Enterprise and agency customers may request a countersigned DPA at info@kellexa.com. Include company legal name, address, signatory, and estimated data subjects processed.

Governing law for the DPA: laws of India, unless otherwise agreed in writing.