Kepaio Data Processing Agreement

1. Who this agreement covers

This DPA supplements the Terms of Use or the signed service agreement between the business customer and HBS MANAGEMENT SARL AU, the operator of Kepaio. It takes effect when signed or expressly incorporated into that agreement.

It covers personal data Kepaio processes on the customer’s behalf to operate its workspaces (“Customer Personal Data”). The customer is the controller or an authorized processor. Kepaio acts as processor or subprocessor accordingly. The customer is responsible for lawful instructions and any required controller authorization. Kepaio’s own account administration and billing are covered by its Privacy Policy. For Customer Personal Data, mandatory transfer clauses take precedence over this DPA, which takes precedence over conflicting service terms.

2. Instructions and security

Kepaio will process Customer Personal Data, including for transfers, only on documented instructions unless required by law. Instructions include this agreement and actions authorized through workspace settings and permissions. If law requires other processing, Kepaio will inform the customer beforehand unless prohibited by law. Kepaio will promptly flag instructions it believes infringe applicable data protection law.

Kepaio will restrict access to authorized people under confidentiality obligations and apply security measures appropriate to the risks, as described in Annex B.

3. Providers and connected services

The customer authorizes the subprocessors in Annex C. Kepaio will bind them in writing to equivalent data protection obligations and remains responsible for their performance. Kepaio will give at least 30 days’ written notice before an addition or replacement begins processing Customer Personal Data. The customer may object on reasonable data protection grounds during that period. The parties will try to resolve the objection. If they cannot, the customer may terminate the affected service before the change takes effect.

When the customer enables ChatGPT, OpenAI provides the AI and may receive records or app details needed for authorized actions. Kepaio provides the app structure, permissions, and storage. OpenAI’s handling of data through that customer-enabled connection is governed by the terms applicable to the connected ChatGPT account. Creem handles checkout and payments as merchant of record under its own terms. See the provider list.

4. Requests, incidents, and audits

Kepaio will promptly forward requests about Customer Personal Data and, where possible, assist the customer with individual rights. Kepaio will respond directly only on documented instructions or as required by law. Taking account of the processing and the information available, Kepaio will assist with security, breach notifications, impact assessments, and regulatory consultations where required.

Kepaio will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Kepaio will share available details on the incident, affected data and people, likely consequences, and response measures. Kepaio will investigate, mitigate the breach, and cooperate with the customer.

Kepaio will provide information needed to demonstrate compliance and allow and contribute to audits, including inspections by the customer or its appointed auditor, under reasonable confidentiality and security arrangements.

5. Transfers, return, and deletion

Each party will comply with applicable transfer rules, including Morocco’s Law No. 09-08 and GDPR Chapter V where applicable. Before a restricted transfer, the parties will identify the destination and transfer basis, complete required assessments, and obtain required authorizations. If relying on the EU Standard Contractual Clauses, the parties will execute the applicable module and complete its annexes before the transfer.

At the end of the service, Kepaio will, at the customer’s choice, return or delete Customer Personal Data and delete existing copies unless storage is required by law. Any copies awaiting backup expiry will remain protected. Kepaio will reapply deletions if a backup is restored and confirm completion on request.

Annex A — Description of processing

Annex B — Technical and organizational measures

Kepaio will enforce account authentication and workspace permissions, restrict administrative access to authorized personnel, protect data in transit, and maintain procedures for reporting, investigating, and responding to security incidents. The parties will document the production controls for storage encryption and key management, access review and logging, backup and restoration, vulnerability management, and secure deletion before execution. This annex makes no certification claim.

Annex C — Authorized subprocessors and transfer details

Record the contracted legal entities, production processing and remote access locations, and any required transfer safeguards before execution. Attach any required transfer clauses.

Parties and notices

Kepaio — HBS MANAGEMENT SARL AU
Place La Liberté, Angle Avenue My El Hassan et Avenue Med V, Rés Berdai, Immeuble B, Appartement 2, Guéliz, Marrakech, Morocco
ICE 00 351 5007000096 · RC 150059
Publication director : Othmane El Ouarzazi
Data protection notices : contact@kepaio.com

Customer : Legal name, address, and privacy contact as stated in the signed DPA or incorporating agreement.