Data processing addendum

The data processing addendum (DPA) forms part of a service agreement or order between KolaOS and the customer when that agreement or order incorporates the DPA. It takes effect on the date of incorporation and applies while KolaOS processes personal data on the customer's behalf.

The service agreement identifies the contracting parties, their addresses and their contacts. The DPA governs conflicting terms about processing customer personal data, subject to mandatory law and any applicable international transfer clauses. A separately signed DPA takes priority over the terms on this page. Later website edits do not amend an existing agreement.

To arrange an agreement and its deployment details, email hello@usekolaos.com.

Personal data is information about an identified or identifiable person. Customer personal data is personal data KolaOS handles on the customer's behalf through the service. Processing includes collecting, storing, using, transmitting and deleting that information.

A controller determines why and how personal data is processed, and a processor handles it on the controller's behalf. The customer acts as controller or as a processor authorized by its controller. KolaOS acts as processor or subprocessor accordingly. A subprocessor is another provider KolaOS engages to process customer personal data.

Applicable data protection law means the privacy and data protection laws that govern the processing, including the EU GDPR and UK GDPR where they apply. KolaOS's own account, billing and business processing is described in the privacy policy and falls outside the DPA where KolaOS acts as an independent controller.

KolaOS will use customer personal data to deliver the agreed service and follow the customer's documented instructions. The agreement, enabled features, deployment settings and authorized support requests form those instructions. KolaOS will not use customer personal data for its own advertising or to train its own general purpose AI models.

KolaOS will notify the customer if an instruction appears to breach applicable data protection law and suspend the affected processing until the parties resolve it. If law requires processing outside the customer's instructions, KolaOS will inform the customer before processing unless the law prohibits notice.

The customer determines the lawful basis for its processing and provides required notices to the people whose information it supplies. The customer must have authority to give its instructions, including instructions to record prompts and send content to configured AI providers. It manages its members, connected accounts and infrastructure under its control. Special category personal data and criminal offence data require prior written agreement on appropriate safeguards.

KolaOS will limit personnel access to the customer personal data needed for authorized work. People authorized to process it must be bound by contractual or statutory confidentiality duties. Those duties continue after their access ends.

The customer authorizes the subprocessors identified in the deployment schedule agreed with KolaOS. The schedule must name each provider's legal entity, purpose and processing countries before processing begins. The provider disclosures describe services used across KolaOS and do not replace that deployment schedule.

KolaOS will give written notice before adding or replacing a subprocessor, with enough time for the customer to raise a reasonable data protection objection before the provider receives its data. The parties will seek an alternative or agree to end the affected service if they cannot resolve the objection.

KolaOS will bind each subprocessor to written data protection duties equivalent to the duties relevant to its work under the DPA. KolaOS remains responsible to the customer for those duties. A provider the customer contracts with directly remains subject to that separate agreement. The deployment schedule must distinguish those providers from KolaOS's subprocessors, including for AI requests.

KolaOS will maintain technical and organizational measures appropriate to the processing risk, as required by applicable data protection law. Schedule 2 describes current technical measures and their limits. Changes must not materially reduce the agreed protection.

A personal data breach is a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to customer personal data. KolaOS will notify the customer's designated contact without undue delay after becoming aware of a breach.

KolaOS will share available information about the affected data and people, likely consequences and containment measures. It will provide a contact for follow-up and further information as the investigation progresses. KolaOS will take reasonable steps to contain and remedy the breach and assist the customer with its notification obligations.

KolaOS will assist the customer with requests to access, correct, export, restrict or delete customer personal data, taking account of the processing and available information. If KolaOS receives a request about data the customer controls, it will refer the request to the customer and respond only on the customer's instructions unless law requires otherwise.

KolaOS will also assist with security obligations, data protection impact assessments and required consultations with regulators. The parties may agree a scope and reasonable costs for additional work without limiting assistance required by law.

KolaOS will provide information needed to demonstrate compliance with the DPA and allow and contribute to customer audits, including inspections by an auditor the customer appoints. The parties will coordinate scope, timing and confidentiality to protect other customers and service security. No certification or independent audit report is promised by the DPA, and required audit rights are not replaced by a security questionnaire.

After the relevant service ends, KolaOS will return or delete customer personal data at the customer's choice and delete remaining copies unless law requires retention. The parties will record the export method, deletion timetable and backup expiry for the deployment in the agreement. Retained data remains protected and is used only for the purpose requiring retention.

During service, prompt records follow the organization's retention settings as described in Schedule 1. Turning off telemetry stops new sharing and does not erase earlier records. Requests involving outside providers or customer-operated servers may require coordinated deletion. KolaOS will report completion and any remaining legal retention or operational delay.

The deployment schedule must identify the processing countries for the control plane, content, support and subprocessors. A workstation region does not establish that all personal data stays in that region. Schedule 1 describes the current prompt and telemetry paths.

Before a transfer requiring additional legal safeguards takes place, the parties must put the applicable transfer mechanism in place. Where required, they will execute the EU Standard Contractual Clauses with the relevant modules and completed annexes, the UK transfer addendum or another legally valid safeguard. Publication of the DPA alone does not execute those instruments or establish an adequacy decision. KolaOS will not carry out the affected transfer until the required safeguard is in place.

Subject and purpose

Operating development workstations, team tools and the features the customer enables.

Activities

Receiving, hosting, retrieving, transmitting and deleting content, running coding agents and recording AI gateway requests.

People

The customer's members, contractors, collaborators and people whose information the customer includes in content.

Personal data

Names, email addresses, user identifiers and personal data in repositories, files, agent sessions, prompts, responses and support material supplied for the customer's instructions.

Frequency and duration

Ongoing during service and for the agreed return, deletion or legally required retention period afterward.

AI requests routed through the gateway record prompts and responses, and recording cannot currently be disabled. Admins can read and delete those records. Retention choices are 7, 30, 90 or 365 days, with 30 days as the default. Expiry deletion runs in batches and retries failures, so a backlog or unavailable server can delay removal.

For KolaOS Cloud and customer AWS deployments, prompt records currently pass through the hosted API into regional storage in KolaOS's AWS account. On the customer's own servers, prompt text remains in the AI gateway's local store, and the API can retrieve it when an admin opens a record. The control plane stores the record index. Workstation files and session content depend on the deployment, and enabled integrations can pass content through hosted services.

Configured AI providers receive the request content needed to generate responses. Customer telemetry excludes source code, prompts and transcripts from its standard operational events. Product telemetry uses the US PostHog project unless the EU project is configured. The telemetry page describes the settings and fields.

Before processing begins, the parties will confirm the deployment, data categories, processing countries, authorized providers and incident contacts in the agreement. The agreement must also record any required transfer instruments and the return, deletion and backup arrangements.

• Members sign in with KolaOS or the customer's identity provider. The KolaOS API checks organization roles and workspace membership, and workstation connections are authorized outside the workstation.
• Each member's workstation is a dedicated virtual machine with hardware isolation. Rules enforced on the host keep workstations from reaching each other and cloud metadata services.
• Organization AI provider keys stay outside workstations. Control plane and gateway connections use HTTPS with certificate verification.
• Admin access to prompt records is checked by the API and recorded in the audit log. Admins control prompt retention, and an expiry job removes stored records and their index entries.

Developers control their own workstations, so only controls enforced outside the workstation count as security measures under this Schedule. The party that operates the hosts can access workstation data on them. Running in a customer's account does not remove the hosted prompt and administration paths described in Schedule 1.

The security page describes the current controls. Any additional measures required for a customer's processing must be agreed and verified for its deployment before that processing begins.