Data Processing Agreement (template)

Status: the template Kenosis customers sign with Jorcks Consult ApS. The bracketed fields are filled in per customer. Not legal advice.

The parties

Choices in the clauses

Appendix A: information about the processing

A.1 Purpose. To provide Kenosis to the controller: AI agents that answer questions and do work using the controller's conversations, files, connected accounts and the organisational memory built from them.

A.2 Nature. Storage, organisation, retrieval, analysis by AI models (inference), text embedding for search, extraction of facts and relationships into organisational memory, display to authorised users, export and deletion.

A.3 Types of personal data.

• Names, work email addresses and roles of users.
• The content of conversations with the agents, and of files users upload: this can include any personal data the controller's users choose to enter, such as names, contact details, correspondence and business information about customers and contacts.
• Facts and relationships about people and organisations, extracted from that content.
• For connected accounts: email messages, calendar entries and files read on the connecting user's instruction.
• Usage records (token counts and costs per request).

The controller must not submit special categories of personal data (GDPR Article 9) or data about criminal offences (Article 10) without a separate written agreement.

A.4 Categories of data subjects. The controller's employees and other users it invites; the people whose personal data appears in content the users enter or connect (for example customers, suppliers and correspondents).

A.5 Duration. For as long as the main agreement runs, followed by return and deletion under C.4.

Appendix B: authorised sub-processors

B.1. On commencement, the controller authorises the sub-processors listed on https://kenosis.io/privacy/sub-processors, as at the date of signature. The list at signature (8 Oct 2026 version):

B.2 Prior notice. 30 days, as in Clause 7.3.

Appendix C: instructions for the processing

C.1 Subject and instruction. The processor provides Kenosis as described in A.1 and A.2, on the controller's documented instructions. Those instructions are the main agreement, these clauses, the controller's configuration of its workspace (agents, connected accounts, sharing choices), and what its users ask the agents to do.

C.2 Security of processing. The level of security takes into account that the service holds business correspondence and organisational knowledge for many organisations on shared infrastructure, so separation between organisations and between colleagues is essential. The processor maintains at least the following:

• Isolation: every organisation's data is separated by row-level security in the database (org_id on every table, enforced in the database, not only in the application). Content is private to the user who created it unless that user shares it.
• Encryption: TLS for all data in transit. Credentials for connected accounts are encrypted by the processor with AES-256-GCM before storage. Data at rest is encrypted by the hosting sub-processors.
• Access control: production access is limited to named people with individual accounts. Production releases and production database changes are made only by Philip Jørck.
• Logging and monitoring: an audit log of administrative actions on organisation data; error monitoring with personal data scrubbed before sending; uptime monitoring with alerts.
• Availability: daily database backups kept for 7 days.
• Testing: automated tests of organisation isolation and access rules on every database change, and review of every code change before release.

C.3 Assistance. The processor helps the controller answer data-subject requests through the export, correction and deletion features in the service, and by email on request. It gives the information listed in Clause 10.3 for breach notifications, and information for impact assessments on request.

C.4 Storage and deletion. Data is stored while the controller's organisation exists. The controller can export its data at any time. When an organisation is deleted, or the agreement ends, the data is deleted after a 30-day grace period during which the controller can still export it (Clause 11.1, Option 2).

C.5 Processing location. Storage in the EU (Ireland), application compute in the EU (Dublin), and AI inference and embeddings in the US, by the sub-processors in Appendix B.

C.6 Transfers to third countries. The controller instructs the processor to transfer personal data to the US for the purposes in Appendix B, on the basis of:

• the EU-US Data Privacy Framework (adequacy decision, GDPR Article 45), where the sub-processor is certified;
• otherwise, the EU Standard Contractual Clauses (Article 46(2)(c)) in the sub-processor's DPA.

The basis for each sub-processor is shown on the sub-processor page.

C.7 Audits. Once a year, at the controller's request and expense, the processor answers a written security questionnaire and provides the security documentation of its main sub-processors (for example their SOC 2 or ISO 27001 reports, where available). The controller may carry out an inspection, with reasonable notice, where these are insufficient or after a personal data breach.

C.8 Audits of sub-processors. The processor relies on the audit reports and certifications its sub-processors publish or provide under their DPAs, and passes them to the controller on request.

Appendix D: other terms

None. The main agreement is Kenosis's Terms of Service; in any conflict about personal data, these clauses prevail.

Signatures

For the controller: [Name, position, date, signature]. For the processor: Philip Jørck, [position], Jorcks Consult ApS, [date, signature].