Data Processing Agreement

1. Definitions

The following terms have the meanings given below. Capitalised terms not defined here have the meanings given in the Koachly Terms of Service.

• Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
• Processor means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.
• Personal Data means any information relating to an identified or identifiable natural person (“data subject”), as defined in GDPR Article 4(1) and equivalent provisions in applicable laws.
• Processing means any operation or set of operations performed on Personal Data, whether or not by automated means, as defined in GDPR Article 4(2).
• Data Subject means the identified or identifiable natural person to whom Personal Data relates.
• Supervisory Authority means the independent public authority responsible for monitoring the application of the GDPR in its member state, or the equivalent authority under applicable privacy law.
• Standard Contractual Clauses (SCCs) means the contractual clauses adopted by the European Commission pursuant to Decision 2021/914 of 4 June 2021, for the transfer of Personal Data to third countries.

2. Scope and Purpose

This DPA applies to the processing of Personal Data by Koachly in the course of providing the Koachly service (“Service”) to Customer.

The parties acknowledge and agree that with regard to the processing of Personal Data described in this DPA:

• Customer is the Controller of Personal Data of its end users, prospects, and contacts processed through the Service.
• Koachly is the Processor of that Personal Data, acting only on Customer’s behalf and in accordance with Customer’s instructions.
• Processing is limited to: delivering the Service, maintaining and improving the Service infrastructure, complying with legal obligations, and as otherwise described in the Koachly Privacy Policy.

3. Processing Instructions

Koachly will process Personal Data only on documented instructions from Customer, including with regard to transfers of Personal Data to a third country or an international organisation. Customer’s instructions are set out in this DPA, the Terms of Service, and any additional written instructions Customer provides via the Service configuration or written correspondence.

Koachly will inform Customer if, in Koachly’s opinion, an instruction infringes applicable data protection laws. Koachly may process Personal Data where required to do so by applicable law, provided Koachly informs Customer of that legal requirement before processing unless prohibited by law.

Koachly ensures that persons authorised to process Personal Data are subject to appropriate confidentiality obligations and receive the appropriate training.

4. Subprocessors

Customer authorises Koachly to engage sub-processors to assist in providing the Service. The current list of sub-processors is published at koachly.ai/privacy#subprocessors.

Koachly will give Customer at least 30 days’ advance notice of any intended changes concerning the addition or replacement of sub-processors. This notice is provided by email to the address associated with Customer’s account. To receive these notifications, ensure your account email is current or opt in on the privacy page.

Customer may object to a new sub-processor within 14 days of receiving notice. If the parties cannot resolve the objection in good faith, Customer may terminate the affected Service by providing written notice.

Koachly imposes data protection obligations on each sub-processor equivalent to those set out in this DPA and remains liable to Customer for the acts and omissions of sub-processors to the extent Koachly is liable under this DPA.

5. Data Subject Rights

Koachly will assist Customer in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under applicable data protection laws, including rights of access, rectification, erasure, portability, restriction of processing, and objection.

When Koachly receives a Data Subject request directly, Koachly will promptly notify Customer (within 5 business days) and will not respond to the request on behalf of Customer except on Customer’s documented instructions or as required by applicable law.

Koachly will provide Customer with the technical and organisational measures necessary to assist Customer in responding to Data Subject requests within the applicable statutory time limits.

6. Security

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Koachly implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, at a minimum:

• AES-256 encryption for all data at rest, including call transcripts and personal information.
• TLS 1.3 for all data in transit.
• Multi-factor authentication enforced for all Koachly team members with access to production systems.
• Role-based access controls limiting data access to authorised personnel on a need-to-know basis.
• Comprehensive audit logging of access to personal data.
• Regular security assessments and penetration testing.
• Data minimisation — call audio is not retained after transcription.

Full details of Koachly’s security practices are available at koachly.ai/security.

7. Data Retention and Deletion

Koachly retains Personal Data for as long as necessary to provide the Service or as required by applicable law. Upon termination or expiry of the Customer’s subscription, Koachly will, at Customer’s choice, delete or return all Personal Data and delete existing copies within 30 days, unless applicable law requires storage of the Personal Data.

Call audio is never retained after the real-time transcription session ends. Transcription text, call scores, summaries and coaching notes are retained for the duration of Customer’s subscription and for up to 90 days after termination (configurable to 30 days) unless Customer requests earlier deletion.

Customers may delete individual calls or their entire account and all associated data at any time through the Service settings. Deletion requests are processed immediately.

8. International Transfers

Where Koachly transfers Personal Data from the European Economic Area (EEA), the United Kingdom, or Switzerland to a country that has not been recognised as providing an adequate level of data protection, such transfers are made pursuant to the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), Module 2: Transfer Controller to Processor, which are incorporated into this DPA by reference.

For customers requiring EU data residency, Koachly supports Cloudflare’s Data Localization Suite, which ensures EU Personal Data is processed only within the EU. Please contact legal@koachly.ai to enable this option.

9. Breach Notification

Koachly will notify Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer’s Personal Data, providing sufficient information for Customer to meet its own breach notification obligations under applicable law.

The notification will include, to the extent then known: the nature of the breach, the categories and approximate number of Data Subjects concerned, the categories and approximate number of records concerned, the likely consequences of the breach, and the measures taken or proposed to address the breach.

Koachly will cooperate with Customer and take such reasonable steps as are directed by Customer to assist in the investigation, mitigation, and remediation of each such breach.

10. Audit Rights

Koachly will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer.

Koachly will, upon request, provide Customer with: (a) completed security questionnaire responses, (b) relevant third-party certifications or audit reports (e.g. SOC 2, ISO 27001 when available), and (c) a summary of penetration testing results.

Where Customer exercises audit rights requiring on-site inspection, reasonable notice is required, and Customer agrees to share the costs of any such inspection where the audit is not triggered by a suspected breach.

To request audit information or a security questionnaire, contact security@koachly.ai.

11. Term and Termination

This DPA is effective from the date Customer first uses the Service and continues for the duration of Customer’s subscription to the Service, including any renewal periods.

This DPA automatically terminates when the last Service agreement between the parties expires or is terminated. Upon termination, the data retention and deletion obligations in Section 7 continue to apply.

12. Governing Law

This DPA is governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of law principles — or such other jurisdiction as specified in the applicable Terms of Service.

For EU/EEA customers, to the extent this DPA conflicts with mandatory requirements of the GDPR or any applicable Supervisory Authority guidance, those requirements prevail.

Questions and Countersigned DPAs

By using Koachly’s services, you agree to this DPA. For enterprise agreements requiring a countersigned DPA, or to discuss specific data processing requirements for a regulated industry, contact us at legal@koachly.ai.

For security-related questions or audit requests, contact security@koachly.ai.