When you use KahuLogic to handle information about your own customers, contacts, staff or website visitors, you decide how that information is used and we process it for you. This addendum sets out what we commit to when we do: we follow your instructions, keep it confidential and secure, use only the sub-processors we list, tell you promptly about a breach, help you answer people's requests, and delete it when you leave.
It forms part of our Terms of Service and applies automatically; you do not need to sign anything. Where the summary and the addendum differ, the addendum applies.
1. Scope and roles
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and Kahu Logic Limited ("KahuLogic"). It applies to personal information about the Customer's own customers, contacts, staff, website visitors, callers and other individuals that KahuLogic processes on the Customer's behalf in providing the Services ("Customer Data"). Words defined in the Terms of Service have the same meaning here.
For Customer Data, the Customer is the agency, entity or controller that decides how and why it is processed, and KahuLogic processes it on the Customer's behalf. Where the General Data Protection Regulation or the UK GDPR applies, the Customer is the controller and KahuLogic is its processor. This DPA does not apply to information KahuLogic handles for its own purposes, which our Privacy Policy covers.
2. Processing on your instructions
KahuLogic will process Customer Data only to provide, secure and support the Services and in accordance with the Customer's documented instructions. The Terms of Service, this DPA, and the Customer's configuration and use of the Services are the Customer's complete instructions. KahuLogic will tell the Customer if, in its opinion, an instruction breaches applicable privacy law, and is not required to follow it. KahuLogic will not sell Customer Data, will not use it for its own marketing, and will not use it to train AI models.
The Customer is responsible for the lawfulness of its instructions and of the Customer Data it provides, including giving every notice and obtaining every consent the law requires, and for not providing sensitive information except as the Privacy Policy allows.
3. Personnel and confidentiality
KahuLogic will ensure that personnel and contractors authorised to process Customer Data are bound by confidentiality obligations, and will limit their access to what is needed to provide the Services, give support the Customer has asked for, investigate a security, abuse, billing or technical issue, or comply with the law. Access to a workspace by KahuLogic personnel is recorded.
4. Security
KahuLogic will maintain reasonable technical and organisational measures to protect Customer Data against loss and against unauthorised access, use, modification or disclosure, appropriate to the nature of the data and the risks. They include encryption of data in transit and at rest, role-based access controls with least-privilege access for personnel, separation of each customer's workspace data, logging of administrative activity, backups, and periodic review of these measures. KahuLogic may update the measures provided it does not materially reduce the overall level of protection.
5. Sub-processors
The Customer authorises KahuLogic to engage the sub-processors listed on our Sub-processors page. KahuLogic will impose on each sub-processor data protection obligations that are no less protective in substance than those in this DPA, and remains responsible for their performance.
KahuLogic will update the Sub-processors page before a new sub-processor begins processing Customer Data, and will notify the account owner by email or in the Services at least 14 days beforehand, except where an urgent change is needed to keep the Services running or secure, in which case it will notify as soon as practicable. The Customer may object on reasonable data protection grounds within that period by writing to privacy@kahulogic.com. The parties will discuss the objection in good faith; if they cannot resolve it, the Customer may terminate the affected Services and receive a refund of fees prepaid for the period after termination.
6. International transfers
The Customer acknowledges that KahuLogic and its sub-processors process Customer Data in the countries listed on the Sub-processors page. For each transfer, KahuLogic will take reasonable steps to ensure the recipient protects the information by safeguards comparable to those in the Privacy Act 2020 (NZ), consistent with information privacy principle 12, and, where the Australian Privacy Principles apply, that it does not breach those principles. Where the GDPR or UK GDPR applies to a transfer, KahuLogic will, on the Customer's request, enter into the European Commission's standard contractual clauses or the UK addendum to them.
7. Requests from individuals and regulators
The Services let the Customer access, correct, export and delete Customer Data itself. If KahuLogic receives a request from an individual about Customer Data, it will refer the individual to the Customer, and will not respond directly except to do that or where the law requires. Taking into account the nature of the processing, KahuLogic will give the Customer reasonable assistance to respond to individuals' requests, to carry out privacy impact assessments, and to deal with regulators, where the Customer cannot do so using the Services. KahuLogic may charge reasonable costs for assistance beyond what the Services provide.
8. Privacy breaches
KahuLogic will notify the Customer without undue delay, and where practicable within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful loss of, or unauthorised access to or disclosure of, Customer Data. The notice will describe what is known of the breach, the Customer Data and individuals likely to be affected, the likely consequences, and the steps taken or proposed, and KahuLogic will update it as more becomes known. KahuLogic will take reasonable steps to contain the breach and will cooperate with the Customer to meet its obligations to notify the Office of the Privacy Commissioner, the Office of the Australian Information Commissioner, other regulators and affected individuals. Notice of a breach is not an admission of fault.
9. Return and deletion
The Customer can export Customer Data through the Services at any time during its subscription and for 30 days after it ends. KahuLogic will then delete or de-identify Customer Data within a further 60 days, and copies in backups will be overwritten in the normal rotation within 90 days after that, except where the law requires KahuLogic to keep it. Until deletion, this DPA continues to protect it.
10. Information and audits
KahuLogic will make available to the Customer, on reasonable request and subject to confidentiality, the information reasonably necessary to demonstrate its compliance with this DPA, including written answers to reasonable security questionnaires no more than once in any 12 months. Where that information is not sufficient and the law requires it, the Customer may carry out, or appoint an independent auditor bound by confidentiality to carry out, an audit on at least 30 days' notice, during business hours, without access to other customers' data, and at the Customer's cost.
11. Liability and precedence
Each party's liability under this DPA is subject to the exclusions and limits in the Terms of Service. If this DPA conflicts with the Terms of Service in relation to Customer Data, this DPA prevails. This DPA ends when KahuLogic no longer holds any Customer Data.
12. Details of the processing
- Subject matter and duration. Providing the Services to the Customer for the term of its subscription and until Customer Data is deleted as described above.
- Nature and purpose. Hosting, storing, organising, analysing, transmitting and displaying Customer Data; preparing drafts and outputs with automated systems; sending the Customer's email and SMS and carrying its calls; publishing its websites and receiving their form submissions; and providing support.
- Individuals. The Customer's customers, prospective customers, contacts, subscribers, website visitors, callers, staff and authorised users.
- Types of personal information. Names, contact details, business details, communications and message content, booking and transaction details, marketing preferences and consent records, engagement data (such as opens, clicks and replies), call audio and transcripts, images, video and voice recordings, and any other information the Customer chooses to submit. Sensitive information is not intended to be processed.