Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the agreement between Kaleos d.o.o. ("Processor", "we") and the customer using the Emio.ai service ("Controller", "you") (the "Main Agreement"). It governs the processing of personal data by us on your behalf and implements Article 28 GDPR (Regulation (EU) 2016/679).
By using the Emio.ai service to process personal data, you accept this DPA. In the event of a conflict between this DPA and the Terms of Service, this DPA prevails as to the processing of personal data.
1. Subject matter, nature, purpose, duration
We process Customer Data containing personal data ("Personal Data") on your behalf in order to provide the Emio.ai service (the "Service"): AI-based extraction of structured data from documents you submit, and storage of inputs/outputs to the extent you configure. Processing lasts for the term of the Main Agreement and any agreed return/deletion period thereafter.
2. Categories of data and data subjects
Determined by you. By default, Personal Data may include identification and contact data, business data, and any other personal data contained in the documents you submit. Data subjects may include your staff, customers, suppliers and any individuals referenced in your documents. You must not submit special-category data (GDPR Art. 9), criminal-conviction data (Art. 10), or children's data unless we have agreed in writing in advance.
3. Our obligations
- Documented instructions. We process Personal Data only on your documented instructions, including those embedded in the Main Agreement, this DPA, the Service configuration you select, and any further written instructions. If we believe an instruction infringes GDPR or other applicable data-protection law, we will tell you (we are not obliged to verify legality of your instructions).
- Confidentiality. Personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.
- Security. We implement appropriate technical and organisational measures (Art. 32) as described in Annex 2.
- No other use. We do not use Personal Data for our own purposes, do not sell it, and do not use it to train AI models for any other customer.
4. Sub-processors
You grant general written authorisation for us to engage sub-processors. Current sub-processors are listed in Annex 3. We will inform you of intended additions or replacements at least 30 days in advance (by email to your designated contact or by updating Annex 3 with notice), giving you the opportunity to object on reasonable data-protection grounds. If you object and we cannot reasonably accommodate the objection, you may terminate the affected part of the Service. We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remain fully liable to you for their performance.
5. International transfers
Personal Data is stored and primarily processed within the EU/EEA. We will not transfer Personal Data to a third country or international organisation outside the EU/EEA without a valid Article 46 GDPR transfer mechanism (typically the European Commission's Standard Contractual Clauses), together with any supplementary measures required by applicable case law.
6. Assistance to you
Taking into account the nature of the processing and the information available to us, we will assist you, by appropriate technical and organisational measures, in fulfilling your obligations to:
- respond to data subject requests (Arts. 12–22);
- ensure security of processing, notify breaches and conduct DPIAs and prior consultations (Arts. 32–36).
For data subject requests sent directly to us, we will forward them to you and will not respond unless instructed. Assistance beyond standard product features may be charged at our reasonable rates.
7. Personal data breach
We will notify you without undue delay (and, where feasible, within 72 hours of becoming aware) of any Personal Data breach affecting your data, and will provide the information needed for you to meet your obligations under Arts. 33–34 to the extent it is in our control.
8. Return and deletion
On termination of the Main Agreement, at your choice we will delete or return all Personal Data and delete existing copies, unless EU or Member-State law requires storage. Unless you instruct otherwise within 30 days of termination, we will delete Personal Data. Backups are overwritten on rotation and deleted within 90 days.
9. Audit
We will make available to you the information necessary to demonstrate compliance with Art. 28, and will allow for and contribute to audits — including inspections — conducted by you or a mutually agreed independent auditor bound by confidentiality. Audits take place no more than once per 12 months (except after a confirmed breach or where required by a supervisory authority), on at least 30 days' written notice, during normal business hours, in a manner that does not unreasonably disrupt the Service. You bear your own costs and ours where the audit exceeds reasonable scope. We may satisfy audit requests by providing recent third-party audit reports or certifications where reasonably equivalent.
10. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Main Agreement / Terms of Service. Nothing in this DPA limits liability that cannot be limited under mandatory law.
11. Term, changes, law
This DPA takes effect when you start using the Service for personal data and continues until all Personal Data has been returned or deleted. We may update this DPA to reflect changes in law or the Service; if a change materially reduces your protection we will give you 30 days' notice. This DPA is governed by Slovenian law; jurisdiction lies with the competent courts in Ljubljana, Slovenia.
Annex 1 — Details of processing
| Subject matter | AI-based extraction of structured data from documents submitted by the Controller, and storage of inputs/outputs as configured. |
|---|---|
| Duration | Term of the Main Agreement plus any agreed return/deletion period. |
| Nature & purpose | Receiving, parsing, transforming, returning and (optionally) storing documents and extracted data; security, support and service operation. |
| Types of Personal Data | Any personal data contained in the documents submitted by the Controller (e.g., names, contact details, business data, identifiers). |
| Categories of data subjects | Any individuals referenced in those documents, including the Controller's staff, customers, suppliers and counterparties. |
| Special categories | Not permitted unless separately agreed in writing. |
Annex 2 — Technical and organisational measures (Art. 32)
- TLS encryption in transit; encryption at rest for stored Personal Data.
- Role-based access control on a least-privilege basis; individual accounts; MFA for administrative access.
- Audit logging of access to systems holding Personal Data; log review.
- Network segmentation and firewalling; restricted administrative access.
- Hardened, patched infrastructure; vulnerability management.
- Backups with defined retention and tested restore.
- Personnel under written confidentiality obligations and trained on data protection.
- Documented incident response and breach notification process.
- Logical separation of Customer Data between tenants; no use of Customer Data to train cross-customer models.
- Vendor due diligence and contractual data-protection obligations for sub-processors.
Annex 3 — Sub-processors
Current sub-processors used to provide the Service:
- EU-based cloud/hosting infrastructure provider (EU/EEA region).
A current, specific list (including legal names and locations) is available on request to web@kaleos.ai. Changes are notified under section 4.