Data Processing Addendum

This Addendum sets out how we process personal data on your behalf, with you as controller and us as processor, as required by Article 28 of the UK GDPR and, where it applies, the EU GDPR. Liability under this Addendum is governed by clause 9 of the Terms of Service. If you need a countersigned copy, email privacy@cyan.kiwi.

1. Definitions and roles

Content Data means the prompts, messages, files and other content you send to the shared inference API or to your Deployments, the responses returned to you, and your conversations with the workspace agent.

Account Data means the data we hold to run your account, such as account identifiers, email address, API key records, usage records, Deployment records, payment and tax records and logs.

Data Protection Law means the UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies.

  • Content Data. You are the controller, or a processor acting for another controller, and we are your processor or sub-processor.
  • Account Data. We are the controller. The Privacy Notice describes that processing, and this Addendum does not apply to it.
  • Abuse checks on conversations. Checking conversations to prevent abuse of the workspace agent is a purpose we decide, so we act as controller for it. It uses conversations only while they are stored.

You confirm that you have the lawful basis, notices and rights needed for us to process the Content Data you send us.

2. Our obligations as processor

Instructions. We process Content Data only on your documented instructions: this Addendum, the Terms, your API requests and your instructions to the workspace agent. If the law requires other processing, we will tell you first unless the law prohibits it. We will tell you if we believe an instruction breaks Data Protection Law.

No retention of API content. We do not store Content Data sent to the shared inference API or to your Deployments, or the responses, in any database, log store, analytics system or backup we operate, with two exceptions: error messages in our logs, which can contain limited request data and are deleted after 180 days; and prompts held briefly in memory to process repeated input faster.

Conversations are stored so that you can return to them, until you delete them or your account is closed. Deleted conversations leave our database backups within the 7-day backup cycle.

No training. We do not use Content Data to train or improve any model or service, and no sub-processor may do so.

Confidentiality. Everyone who processes Content Data for us is bound by a duty of confidentiality, and access is limited to those who need it.

Security. We maintain the measures in Annex II. We may change them provided we do not reduce the level of protection.

Sub-processors. You give us general authorisation to engage sub-processors, including those listed in the Content Data table of the sub-processor register. We impose data protection obligations on each sub-processor and remain liable to you for its performance.

Assistance. We will give you reasonable help, taking into account the nature of the processing, with requests from data subjects, security, breach notification, impact assessments and prior consultation. If a data subject contacts us about data we process for you, we will refer them to you.

Breaches. We will notify you without undue delay after becoming aware of a personal data breach affecting Content Data, with the information we have, and provide further information as it becomes available.

Deletion. When the Service ends, we delete or return Content Data, as you choose, on request and without undue delay. Copies in backups are deleted when the backup cycle ends, and we keep data we are required to keep by law.

Audits. We will make available the information needed to demonstrate compliance with Article 28 and allow for audits by you or an auditor you mandate. Please ask us in writing first. An audit requires 30 days’ notice, may take place no more than once a year unless a breach or a regulator requires it, must be conducted under confidentiality, and does not extend to other customers’ data or to sub-processors’ premises. Each party bears its own costs.

3. International transfers

Transfers of Content Data from the UK, or from the EEA under the European Commission’s adequacy decision for the UK, to us need no further safeguard. If no adequacy decision covers a transfer from the EEA, the EU Standard Contractual Clauses (Module Two where you are a controller, Module Three where you are a processor) apply between you and us, governed by the law and courts of Ireland, with the Annexes of this Addendum completing them; the UK International Data Transfer Addendum applies in the same way to UK transfers.

Our transfers to sub-processors are made under our agreements with them, using the mechanism recorded for each on the sub-processor register.

Annex I: description of the processing

Subject matter and purpose. Providing the shared inference API, Deployments and the workspace agent: receiving requests, generating and returning responses, storing conversations and carrying out the actions you instruct the workspace agent to take.

Duration. For API and Deployment requests, the duration of each request. For conversations, until you delete them or your account is closed.

Data subjects. Your users and personnel, and anyone whose personal data you include in Content Data.

Personal data. Whatever you choose to include in Content Data, which may include special category data.

Frequency. Continuous, while you use the Service.

Annex II: security measures

  • Encryption. Traffic to the Service is encrypted with TLS, and data we store is encrypted at rest.
  • Credentials. API keys are stored only as hashes, and service credentials are kept in a managed secret store.
  • Access. Access to production systems is limited to personnel who need it and are bound by confidentiality.
  • Change control. Changes reach production through a controlled release process.
  • Logs and backups. Logs and per-request usage metadata are kept for 180 days, contain no request or response bodies, and database backups are kept for 7 days.
  • Incidents. Security incidents are investigated, contained and notified as this Addendum requires.