This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer", the controller) and Keply, operated by Keply Ltd (the processor). It governs Keply's processing of personal data on your behalf and applies where the EU/UK GDPR, the Israeli Privacy Protection Law, or comparable laws apply.
1. Roles & subject matter
You are the controller (or a processor acting for another controller) of the Customer Data you connect. Keply is your processor. We process personal data only to provide the Service and on your documented instructions, which include these Terms and your configuration of the Service.
2. Nature & purpose of processing
Ingesting connected data; normalizing it; computing health scores and risk signals; drafting outreach; and operating Keply under your control. Processing continues for the duration of your subscription.
3. Categories of data & data subjects
Data subjects: your personnel and your customers' representatives and end-users. Personal data: names, business contact details, communications content (email/calendar), account and billing identifiers, product-usage and survey signals, and derived scores. You must not connect special-category data unless agreed in writing; the Service is not designed to process it.
4. Our obligations
We will: (a) process personal data only on your instructions; (b) ensure persons authorized to process it are bound by confidentiality; (c) implement appropriate technical and organizational measures (Annex below); (d) assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification, and DPIA obligations; (e) make available information needed to demonstrate compliance; and (f) at your choice, delete or return personal data at the end of the Service, subject to legal retention.
5. Sub-processors
You authorize Keply to engage the sub-processors listed at keply.ai/trust, under written terms imposing data-protection obligations no less protective than this DPA. We will give notice of intended changes and you may object on reasonable data-protection grounds. Keply remains liable for its sub-processors' performance.
5a. Aggregated statistics (optional, at your instruction)
Where an authorized administrator of your workspace enables “Help Keply improve”, you instruct Keply to derive aggregated, de-identified statistics from the personal data it processes for you, and to combine them with statistics derived for other controllers. Those statistics contain no identifiers of any account, individual or workspace, no free text, and no content of any communication, and Keply does not attempt, and will not permit any third party to attempt, to re-identify them.
Keply applies a minimum aggregation threshold before any such statistic is created or disclosed: at least five contributing controllers within a sector, at least twenty underlying events, and no single controller contributing more than 40% of them. Personal data originating from Google Workspace sources is excluded from this processing entirely. You may withdraw this instruction at any time by disabling the setting, on which Keply will exclude your data from the next recomputation and delete any statistic that no longer meets the threshold. Withdrawal does not affect the lawfulness of processing carried out beforehand, and Keply may continue to use statistics that remain above the threshold without your data.
Ownership of aggregated de-identified insights is addressed in the Terms, section 8; this clause governs how they may be created, not who owns them.
6. International transfers
Where personal data is transferred outside the EEA, UK, or Israel without an adequacy decision, the transfer is governed by the EU Standard Contractual Clauses (and the UK Addendum / IDTA where applicable), which are incorporated by reference, with Keply as data importer where relevant.
7. Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting your personal data, with the information reasonably available to help you meet your notification obligations, and will take reasonable steps to mitigate and remediate. See our security overview.
8. Data-subject requests
Taking into account the nature of processing, we will assist you in responding to data-subject requests, including providing tools to access, correct, export, or delete data. Requests we receive directly from data subjects are routed to you as controller. See our DSAR process referenced in the Privacy Policy.
9. Deletion & return
On termination, we will delete or return Customer Data within a defined window (target: 30–90 days) and delete existing copies unless retention is required by law. Backups expire on their normal cycle.
10. Audit
We will make available our security documentation and complete security questionnaires on request, without requiring a non-disclosure agreement, to demonstrate compliance. Should an independent SOC 2 report be issued in future, we may make it available under a non-disclosure agreement. We will respond to reasonable written audit requests consistent with protecting the confidentiality and security of other customers.
Annex, Technical & organizational measures
Encryption in transit (TLS 1.2+) and at rest (AES-256); multi-tenant isolation enforced by deny-by-default database row-level security and application-layer scoping; least-privilege access to administrative systems; encrypted storage of integration tokens, and issued API keys stored only as hashes; logging and an audit trail of Keply's actions; a secure development lifecycle in which a change reaches production only through a pull request whose required check suite passed, that suite including static analysis with secret detection, and versioned database changes; daily database backups; and a documented incident-response process including the GDPR 72-hour breach-notification clock. Current details are summarized at keply.ai/trust and keply.ai/legal/security.
Contact
To execute a countersigned copy of this DPA or with questions: ori@keply.ai.