Legal

Data Processing Agreement

Effective date: [EFFECTIVE DATE]

This Data Processing Agreement ("DPA") forms part of the Keyrail Terms of Service (the "Terms") between MKYCAPITAL LTD, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom ("Keyrail", the "Processor"), and the customer that has accepted the Terms (the "Customer", the "Controller"). It applies automatically when the Customer accepts the Terms; no signature is required. A countersigned copy is available on request at legal@keyrail.tech.

It sets out the terms required by Article 28 of Regulation (EU) 2016/679 (the "GDPR") [and, where applicable, the UK GDPR and the Data Protection Act 2018] for the processing of personal data by Keyrail on behalf of the Customer.

1. Definitions#

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the GDPR. "Customer Personal Data" means personal data processed by Keyrail on behalf of the Customer in providing the Service. Capitalised terms not defined here have the meaning given in the Terms.

2. Roles#

2.1. The Customer is the controller (or, where it acts for another controller, a processor) of Customer Personal Data. Keyrail is a processor (or sub-processor).

2.2. Keyrail acts as an independent controller, outside the scope of this DPA, for personal data it processes for its own purposes, as described in its Privacy Policy: account and user data of the Customer, billing, security logs and the waitlist.

2.3. Keyrail's paid plans are sold to the Customer by Paddle as reseller and merchant of record (Terms, section 5.3). Paddle processes the Customer's billing data as an independent controller under its own terms; it is not a sub-processor of Customer Personal Data and receives none of it. If the Customer also uses Paddle Billing to sell its own applications, that is a separate relationship between the Customer and Paddle (see the sub-processors page).

3. Details of the processing#

4. Customer instructions#

4.1. Keyrail processes Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law [or the law of the United Kingdom] to which Keyrail is subject; in that case Keyrail informs the Customer of that legal requirement before processing, unless that law prohibits it.

4.2. The Terms, this DPA, the Customer's configuration of the Service (dashboard, API calls, integrations) and the Customer's other written instructions accepted by Keyrail constitute the Customer's complete instructions.

4.3. Keyrail informs the Customer immediately if, in its opinion, an instruction infringes data protection law.

5. Confidentiality#

Keyrail ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. At the date of this DPA, the only person with access to production data is the operator of the Service.

6. Security#

Keyrail implements the technical and organisational measures described in Annex 1, appropriate to the risk. Keyrail may update these measures provided that the overall level of security is not reduced.

7. Sub-processors#

7.1. The Customer gives Keyrail general authorisation to engage the sub-processors listed at https://keyrail.tech/legal/subprocessors/ at the date of this DPA.

7.2. Keyrail will inform the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance by email to the account owner and by updating the list. The Customer may object on reasonable data protection grounds within that period. The parties will then discuss in good faith; if no solution is found, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees, paid through Paddle as described in section 5.8 of the Terms.

7.3. Keyrail imposes on each sub-processor, by contract, data protection obligations providing at least the same level of protection as this DPA, and remains liable to the Customer for the performance of its sub-processors' obligations.

8. International transfers#

8.1. Customer Personal Data is stored in the European Union (Cloudflare D1 database with EU jurisdiction).

8.2. Keyrail's hosting provider, Cloudflare, Inc., is established in the United States and operates a global network. Requests from Customer Applications may be received and processed in Cloudflare data centres outside the EEA, and Cloudflare may access data for support and security purposes. Such transfers are governed by Cloudflare's data processing addendum incorporating the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and by Cloudflare's certification under the EU-US Data Privacy Framework [TO VERIFY ON PUBLICATION DATE].

8.3. [IF KEYRAIL IS A UK ENTITY: Keyrail is established in the United Kingdom, which benefits from an adequacy decision of the European Commission. Should that decision cease to apply, the parties agree that the Standard Contractual Clauses, Module 2 (controller to processor) or Module 3 (processor to processor) as appropriate, are incorporated by reference into this DPA.]

8.4. [WHERE THE UK GDPR APPLIES: the International Data Transfer Addendum issued by the UK Information Commissioner applies to restricted transfers from the UK.]

9. Assistance#

9.1. Data subject requests. Taking into account the nature of the processing, Keyrail assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects. The Customer can access, export, correct and delete End Customer data through the dashboard and the vendor API. If Keyrail receives a request directly, it forwards it to the Customer without undue delay and does not respond itself except to direct the data subject to the Customer.

9.2. Other assistance. Keyrail assists the Customer, taking into account the nature of processing and the information available to it, in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation). Assistance going beyond the information in this DPA and the documentation may be charged at reasonable cost.

10. Personal data breaches#

10.1. Keyrail notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

10.2. The notification describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at first may be provided in phases.

10.3. Notification of a breach is not an acknowledgement of fault or liability.

11. Return and deletion#

11.1. During the term, the Customer can export Customer Personal Data through the vendor API.

11.2. The Customer can export its data from the dashboard at any time before closing its account. After closure, for 30 days, the dashboard is no longer accessible, End-Customer licenses keep validating and payment events keep being processed, and the Customer can reopen its account (and then export) through the link emailed at closure (Terms §14.5). Keyrail then deletes Customer Personal Data from the production database within 30 days, and from backups within the backup retention period of [30] days, unless Union or Member State law requires storage. Keyrail confirms deletion in writing on request.

12. Audits#

12.1. Keyrail makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, the security measures in Annex 1, and the certifications and audit reports of its main sub-processors where available.

12.2. If this information is not sufficient, or where required by a supervisory authority, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, at most once every 12 months, with at least 30 days' notice, during business hours and without disrupting the Service. Each party bears its own costs, unless the audit reveals a material breach by Keyrail.

13. Liability#

Each party's liability under this DPA is subject to the limitations of liability in the Terms, to the extent permitted by data protection law.

14. Order of precedence#

In case of conflict between this DPA and the Terms on data protection matters, this DPA prevails. If the Standard Contractual Clauses apply, they prevail over this DPA.

15. Governing law#

This DPA is governed by the law that governs the Terms[, unless data protection law requires the law of an EU Member State, in which case the law of [France / Ireland] applies].

Annex 1. Technical and organisational measures#