Data processing agreement Data processing agreement

This document governs Calltek Network SL's ("the processor") processing of personal data on behalf of the customer ("the controller") in providing the Kujira platform. It takes effect automatically when you contract the service, with no separate signature required — if your organization needs a signed copy, see clause 10.

We process your organization's data solely on your documented instructions: the retention settings, access permissions, and agent behavior you configure on the platform. We don't process it for any purpose of our own or unrelated to providing the service. If we consider that an instruction breaches the GDPR or other applicable data protection law, we'll tell you before carrying it out.

Access to personal data is restricted to the staff who need it to operate the platform or support your organization — no one else on our team can reach that data. Everyone with access is contractually bound by a duty of confidentiality, both during and after their relationship with us.

Third-party credentials and private keys are stored encrypted in a vault (AES-256-GCM), never in plain text. Who can view, operate, or administer each part of your organization is up to you, as the owner (OWNER role) or through the administrators you designate — we neither assign nor change those permissions on our own. Every sensitive action is recorded in an audit log that the platform doesn't let anyone modify or delete from within the application.

These are the providers that process data on our behalf to operate the platform:

• Stripe — Payments and subscriptions.
• Resend — Sends the platform's emails.
• Cloudflare R2 — File storage.
• Sentry — Monitoring and error logging for the platform.

If we add or change any of them, we'll notify you in advance so you can object before they start processing your data.

Some of our sub-processors under the previous clause may process data outside the European Economic Area. When that happens, we rely on the European Union's standard contractual clauses or another equivalent safeguard offered by that provider.

The AI model provider, the server your agents run on, and the destination of any backups you configure fall outside this document: you choose and contract them directly, not us. Responsibility for that relationship — including any international transfer it involves — is yours, and this document doesn't cover it.

If someone exercises a right (access, rectification, erasure…) over data held in your organization, we'll notify you so you can resolve it, and we'll assist if needed. If we detect a security breach affecting your data, we'll notify you without undue delay, in accordance with Article 33.2 of the GDPR.

When the contract ends, and at your choice, we'll return your data — under the right recognized in the privacy policy — or delete it. If you don't state a preference, it's deleted under the timeframes in that same policy, except for what we must retain under a legal obligation, billing data in particular.

Backups are the exception: they aren't edited one by one to strip out a given organization's data. They simply fall out of use and disappear once their copy expires in the rotation cycle, and are never restored for anything other than recovering the service after an incident.

This right belongs to your organization as the data controller. By default, we handle it with a security questionnaire or the documentation we have available; if you need something more thorough, we'll agree the scope and timing with you in advance.

If your organization needs this document as a signed annex to the contract, write to us at soporte@kujira.so and we'll send it over.