Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between KognitHQ ("Processor", "we") and the customer ("Controller", "you") and governs the processing of personal data by Kognit on your behalf.

"Personal Data" means any information relating to an identified or identifiable natural person as defined under GDPR Article 4(1), CCPA Section 1798.140(o), or equivalent applicable law.

"Processing" includes any operation performed on personal data, including collection, storage, retrieval, use, transmission, erasure, or destruction.

This DPA applies to all personal data processed through the Kognit platform, including data from connected channels (WhatsApp, email, Shopify), AI-generated content, and customer support interactions.

You (the Controller) determine the purposes and means of processing personal data. You are responsible for ensuring you have a lawful basis to collect and share personal data with Kognit.

We (the Processor) process personal data only on your documented instructions. We do not independently determine the purposes of processing your customers' data.

Where we process data for our own legitimate purposes (e.g., service improvement, security monitoring, billing), we act as an independent controller and our Privacy Policy applies.

Each party shall comply with its obligations under applicable data protection laws, including GDPR, UK GDPR, CCPA/CPRA, and any other relevant regulations.

Categories of data subjects: Your customers, end users, website visitors, and support ticket requesters.

Types of personal data: Names, email addresses, phone numbers, IP addresses, conversation content, order history, device identifiers, and any data you choose to send through connected channels.

Purpose of processing: Providing customer support automation, AI-powered reply generation, shared inbox management, email campaigns, e-commerce order sync, and analytics.

Duration of processing: For the term of your subscription plus 30 days after termination (data retention period). You may request earlier deletion at any time.

We implement appropriate technical and organizational measures to protect personal data, including:

Encryption in transit (TLS 1.3) and at rest (AES-256 with automatic key rotation) for all personal data.

Zero-knowledge architecture for API keys and credentials (BYOK). We never access your plaintext integration keys.

Role-based access control (RBAC) with principle of least privilege for all internal systems.

Regular security assessments including annual third-party penetration testing and continuous vulnerability scanning.

Incident response procedures with 72-hour breach notification as required by GDPR Article 33.

Employee access logging, background checks, and mandatory security training for all personnel with data access.

We use the sub-processors listed below to deliver the Kognit platform. Each sub-processor is bound by contractual obligations consistent with this DPA.

We will notify you at least 30 days before adding or replacing a sub-processor. You may object to a new sub-processor by contacting us within 14 days of notification. If we cannot reasonably accommodate your objection, you may terminate your subscription.

All sub-processors with access to EU personal data have executed Standard Contractual Clauses (SCCs) or are certified under an approved transfer mechanism.

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, Canada, and India.

For transfers from the EEA/UK, we rely on: (a) Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914), (b) adequacy decisions where applicable, or (c) other approved transfer mechanisms.

We conduct Transfer Impact Assessments (TIAs) for each sub-processor to evaluate the legal framework of the recipient country and any supplementary measures required.

You may request copies of the SCCs and TIAs by contacting our privacy team at support@kognithq.com.

We will assist you in fulfilling data subject requests (DSRs) under applicable law, including rights of access, rectification, erasure, portability, restriction, and objection.

Upon receiving a DSR directly, we will promptly redirect the data subject to you and notify you within 48 hours, unless legally prohibited.

We provide self-service tools in the Kognit dashboard for you to export, anonymize, or delete customer data. Bulk operations are available via the API.

For Shopify merchants: Customer data received through Shopify is subject to Shopify's Protected Customer Data requirements. Upon app uninstall, we purge all Shopify customer data within 48 hours as required by Shopify Partner guidelines.

Kognit uses AI models (AWS Bedrock Claude, Google Gemini) to generate replies and summaries. The following safeguards apply:

Conversation data sent to AI models is processed in real-time and is NOT stored by the AI provider. No training is performed on your data.

AI-generated content is clearly marked and remains under your editorial control. You are responsible for reviewing AI outputs before they reach end users.

Knowledge base embeddings (vector representations) are stored in your Firestore workspace and are not shared across tenants.

You may disable AI features at any time through Settings > AI Configuration without affecting other platform functionality.

In the event of a personal data breach, we will notify you without undue delay and in any event within 72 hours of becoming aware of the breach.

Notification will include: (a) nature of the breach, (b) categories and approximate number of data subjects affected, (c) likely consequences, (d) measures taken or proposed to address the breach.

We maintain a documented incident response plan and conduct regular breach response drills.

We will cooperate with you and provide all reasonable assistance to help you comply with your own breach notification obligations under applicable law.

You have the right to audit our compliance with this DPA. We will make available all information necessary to demonstrate compliance and allow for audits, including inspections, conducted by you or an independent auditor.

Audits shall be conducted with reasonable prior notice (minimum 30 days), during business hours, and no more than once per year unless required by a supervisory authority or following a data breach.

We provide SOC-equivalent audit reports, penetration test summaries, and ISO 27001 certification documents upon request under NDA.

For Enterprise plan customers, we offer dedicated compliance support and custom audit arrangements.

Upon termination of your subscription, you may export all personal data via the dashboard or API within the 30-day retention period.

After the 30-day retention period, we will permanently delete all personal data from active systems within 14 days. Encrypted backups containing personal data will be purged within 90 days.

We will provide written confirmation of deletion upon your request.

Certain data may be retained where required by law (e.g., billing records for tax purposes) or where necessary for the establishment, exercise, or defense of legal claims. Such data will be minimized and access-restricted.