Data Processing Addendum

This addendum forms part of the agreement between you, the customer, and Kilma AI.

For personal data processed through the service, you are the controller and Kilma AI is the processor. Where you are yourself a processor for another party, we act as sub-processor on the same terms.

We process personal data to operate voice agents that place and receive calls on your instructions.

Processing continues for the term of the agreement and the retention periods set out below.

Data subjects are the people your agents call or who call you.

• Identifiers: name, phone number, and any account or policy reference given on the call.
• Call content: audio recordings and transcripts.
• Call metadata: time, duration, outcome, language, and routing.
• Anything else the caller volunteers during a call.

We process personal data only on your documented instructions, including the agent configuration and call flows agreed with you.

We will tell you if an instruction appears to breach applicable data protection law, and may pause that processing until it is resolved.

Access is limited to personnel who need it to deliver or support the service. All are bound by written confidentiality obligations and receive data protection training.

• Encryption in transit and at rest.
• Role based access control on a least privilege basis, with administrative access logged.
• Segregation of customer data at the application layer.
• Vulnerability management and periodic penetration testing.
• Documented backup and disaster recovery procedures.

You give general authorisation for us to appoint sub-processors for speech recognition, language models, speech synthesis, telephony, hosting, and billing.

A current list is available on request. We will give at least 30 days notice before adding a sub-processor, and you may object on reasonable data protection grounds.

Each sub-processor is bound by written terms no less protective than this addendum. We remain liable for their performance.

We process data in the United States and the European Union. Regional data residency is available on Enterprise plans.

Where data leaves its region of origin we rely on Standard Contractual Clauses or another approved transfer mechanism, together with a transfer risk assessment.

We will assist you, so far as reasonably possible, with data subject requests, data protection impact assessments, and consultations with a supervisory authority.

If a data subject contacts us directly about data we hold for you, we will refer them to you rather than respond on your behalf.

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data.

The notice will describe what we know, the likely consequences, and the measures taken or proposed.

Retention is configurable per account. Absent a customer setting we apply the defaults below.

On termination we delete or return personal data at your choice, except where we are required by law to retain it.

• Call recordings: 30 days by default.
• Transcripts and call metadata: 12 months by default.
• Account and billing records: the term plus 7 years.

We do not use customer call content to train publicly available AI models, and our sub-processors are contractually barred from doing so.

We may use aggregated, de-identified statistics to improve service quality and reliability.

On reasonable written notice, and no more than once a year unless required by a supervisory authority, we will make available the information needed to demonstrate compliance with this addendum.

Where available, current third party audit reports or certifications will satisfy this obligation.

For questions about this addendum, or to request the sub-processor list or a signed copy, contact help@kilma.ai.