Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the agreement between KALO IQ and customers who use the platform to process personal data. It sets out how we handle that data on your behalf. Where you act as the data controller, KALO IQ acts as the processor, handling personal data only on your documented instructions.

Roles and scope

You decide why and how personal data is processed, which makes you the controller. KALO IQ processes that data to provide the platform, which makes us the processor. This DPA applies to any personal data we process for you while you use the service, for as long as that processing continues.

Details of processing

Subject matter: provision of the KALO IQ influencer marketing platform. Duration: for as long as your account is active, plus any legally required retention. Nature and purpose: hosting, storage, analysis and display of data so you can find creators, run outreach and track campaigns. Types of personal data: account and contact details of your team plus creator profile and performance data you access. Categories of data subjects: your staff and the creators whose public data appears in the platform.

Our obligations as processor

We process personal data only on your instructions and for the purpose of providing the platform. We keep the data confidential and make sure the people who handle it are bound by confidentiality. We help you respond to data subject requests and meet your own obligations, to the extent the platform allows.

Security measures

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls and regular review of our systems. We limit access to personal data to the staff who need it to provide the service. We work to keep these measures current as risks and technology change.

Sub-processors

We use trusted sub-processors to help run the platform, such as hosting, payment and analytics providers. We require them to meet data protection standards consistent with this DPA. We remain responsible for their handling of personal data. We will tell you about material changes to our sub-processors where required.

Data subject requests

If we receive a request from one of your data subjects, such as a request to access or delete data, we will pass it to you rather than respond directly, unless the law requires otherwise. We will give you reasonable help to respond to these requests using the tools the platform provides.

Data breaches

If we become aware of a personal data breach affecting your data, we will notify you without undue delay. We will give you the information you reasonably need to meet your own notification duties. We will also take steps to contain and address the breach.

International transfers

KALO IQ serves US customers and processes data accordingly. Where personal data is transferred across borders, we put appropriate safeguards in place as the law requires, including the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum where they apply. If you have specific transfer requirements, raise them with us before you rely on the platform for that data.

Return and deletion

When our agreement ends or you ask us to, we will delete or return the personal data we process for you, except where the law requires us to keep it. We will delete existing copies within a reasonable period unless retention is legally required.

Contact us

To request a signed DPA or ask questions about data processing, reach us through our contact page. For how we handle data generally, see our privacy policy.