Data Processing Addendum

Roles

For partner prospect, customer, campaign, call, transcript, appointment, and connected-calendar data processed through the Kleos service, the partner is the controller and Kleos is the processor unless the parties agree otherwise in writing. For Kleos websites, accounts, pre-launch signups, billing, security, support, and Kleos acquisition data, Kleos is the controller.

Kleos processes partner personal data only on documented instructions from the partner, including instructions given through the dashboard, APIs, campaign settings, partner instructions, approval flows, order forms, support requests, and these Terms.

Subject matter and duration

The subject matter is the processing of personal data needed to provide AI sales operations, research, compliance gating, voice outreach, appointment booking, notifications, reporting, support, security, and related services. Processing continues for the term of the partner's use of Kleos and for any retention period needed to complete deletion, export, legal compliance, security, dispute, accounting, suppression, or recordkeeping obligations.

Nature and purpose of processing

• Hosting and securing partner accounts, campaign settings, users, roles, and permissions.
• Importing, storing, deduplicating, enriching, scoring, and reviewing partner prospect or customer records.
• Preparing call scripts, reasons to call, call briefs, objection handling, and partner-branded follow-up.
• Checking consent, suppression, rule packs, calling windows, caller ID, recording settings, and campaign approvals.
• Placing or preparing AI voice calls through approved providers where allowed.
• Creating call logs, transcripts, summaries, outcomes, learning insights, and reports.
• Checking connected calendars for free/busy availability and creating appointment events.
• Sending booking confirmations, reminders, account emails, billing emails, and service notifications.
• Providing support, troubleshooting, security monitoring, abuse prevention, audits, billing, and usage metering.

Data subjects and personal data categories

Data subjects may include partner users, closers, team members, prospects, customers, leads, appointment attendees, pre-launch signups, website visitors, support contacts, and persons who opt out or make privacy requests.

• Identity and contact data, including names, work emails, phone numbers, roles, company names, addresses, websites, and account identifiers.
• Business and campaign data, including niche, service area, customer/prospect status, source, reason to call, fit score, notes, imported list fields, and partner instructions.
• Consent and compliance data, including consent text, source, timestamp, revocation, suppression, DNC/TPS/CTPS status where applicable, country rule decisions, and audit logs.
• Call and communication data, including call metadata, transcripts, summaries, outcomes, recordings where enabled, email delivery logs, SMS metadata where enabled, and unsubscribe data.
• Calendar and booking data, including connected account ID, selected calendar ID, encrypted OAuth tokens, free/busy blocks, appointment times, event IDs, event titles created by Kleos, locations, meeting links, descriptions, and attendee contact details.
• Billing, usage, security, and support data.

Processor obligations

• Process partner personal data only on documented instructions unless law requires otherwise.
• Ensure personnel authorized to process personal data are bound by confidentiality obligations.
• Apply appropriate technical and organizational security measures.
• Assist the partner with data-subject requests, security obligations, DPIA support, and breach-response obligations where applicable and reasonable.
• Notify the partner without undue delay after becoming aware of a personal-data breach affecting partner personal data.
• Make available information reasonably necessary to demonstrate compliance with this DPA.
• Delete or return partner personal data after termination according to the Terms, partner instructions, product export/deletion capabilities, and legal retention obligations.

Partner obligations

• Provide lawful, documented instructions for processing.
• Maintain a lawful basis for personal data submitted to Kleos.
• Provide required notices and obtain required consents for outreach, calendar access, AI voice, recordings, messaging, and other processing.
• Keep partner instructions, scripts, offers, privacy notices, consent records, and suppression data accurate and current.
• Use Kleos only for approved regions, channels, and campaigns.

Subprocessors

The partner authorizes Kleos to use subprocessors to provide the service. Kleos requires subprocessors to protect personal data under written obligations appropriate to their role, and Kleos remains responsible for subprocessor performance as required by applicable data-protection law.

Kleos engages subprocessors across categories such as cloud hosting and database infrastructure, authentication and security, AI and voice processing, telephony and messaging, calendar connectivity, email delivery, and payment processing. The current list of named subprocessors is made available to partners on request, and Kleos provides a means to be notified of, and to object to, additions or changes as required by applicable data-protection law.

Google API data

For Google Calendar data, Kleos uses and transfers Google user data only to provide or improve the calendar features visible in Kleos: connecting a calendar, choosing a writable target, checking availability, and creating booked appointment events. Kleos does not use Google user data for targeted advertising, retargeting, personalized advertising, interest-based advertising, data-broker activity, information-reseller activity, credit-worthiness, lending, or generalized AI/ML model training.

Security measures

• Encryption in transit.
• Encryption of sensitive calendar OAuth tokens at rest.
• Tenant isolation and row-level security for partner-scoped records.
• Service-role separation for privileged operations.
• Least-privilege access and role-based dashboard access.
• Audit logs for sensitive admin, compliance, billing, DSAR, and campaign actions.
• Suppression, consent, and compliance gates before outbound calls.
• Rate limiting and anti-abuse checks on public endpoints.
• Safe-by-default feature flags for live calls, email, and retention jobs.
• Provider webhook verification and restricted admin routes where implemented.

International transfers

Where partner personal data is transferred internationally, Kleos uses appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, data minimization, and subprocessor review. The partner authorizes these transfers for the purpose of providing the service.

Data-subject requests

Kleos provides tools and assistance for access, export, correction, deletion, redaction, suppression, and objection requests. For partner-controlled data, the partner remains responsible for responding to the data subject, and Kleos assists as processor. Kleos may preserve suppression records, audit logs, billing records, and other minimal records where retention is needed to honor opt-outs, preserve security, comply with law, or resolve disputes.

Deletion, return, and retention

At the partner's request or after termination, Kleos will delete or return partner personal data using available export and deletion tools, subject to legal, security, accounting, suppression, dispute, and required telemarketing-record retention. Transcripts and summaries may be deleted or redacted where eligible. Suppression records are retained as needed to prevent re-contact.

Audits and information

Kleos will provide information reasonably necessary to demonstrate compliance with this DPA. Any audit must be reasonable, scheduled in advance, limited to relevant controls and records, protect confidential information and other customers' data, and avoid disrupting Kleos operations.

Contact

Data-protection contact: dpo@kleos.click.