Kuuba Data Processing Agreement

1.1This DPA is between Kuuba Ltd (company number 17555395, registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ) ("Kuuba", the "Processor") and the customer that has accepted the Kuuba Terms of Service (the "Customer", the "Controller"). It is incorporated into the Terms by reference and takes effect when the Customer accepts the Terms.

1.2This DPA applies to Customer Personal Data (defined below). It does not apply to personal data that Kuuba processes as an independent controller (such as Authorised Users' account details and billing information), which is covered by Kuuba's Privacy Notice.

1.3If there is a conflict between this DPA and the Terms about the processing of Customer Personal Data, this DPA prevails. If there is a conflict between this DPA and any Transfer Mechanism (clause 12), the Transfer Mechanism prevails.

"Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, to the extent it applies, the EU GDPR, each as amended or replaced (including by the Data (Use and Access) Act 2025).

"Customer Personal Data" means personal data processed by Kuuba on behalf of the Customer in providing the Service, as described in Annex 1, including Visitor Data and personal data contained in Customer Content.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

"Subprocessor" means a third party engaged by Kuuba to process Customer Personal Data.

"Transfer Mechanism" means a lawful basis for a restricted transfer under Chapter V of the UK GDPR, including UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework), the ICO's International Data Transfer Agreement (IDTA), or the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses (the "UK Addendum").

2.1Terms such as "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the UK GDPR. Capitalised terms not defined here have the meanings given in the Terms.

In short: You decide why visitor data is processed. We follow your documented instructions and tell you if we think an instruction is unlawful.

3.1The Customer is the controller and Kuuba is the processor of Customer Personal Data.

3.2Documented instructions (Article 28(3)(a)). Kuuba will process Customer Personal Data only on the Customer's documented instructions, including about international transfers, unless required to do otherwise by UK law, in which case Kuuba will inform the Customer of that requirement before processing unless the law prohibits this on important grounds of public interest. The Customer's instructions are: the Terms and this DPA; the Customer's configuration of the Service (including enabling handoffs, Slack or Microsoft Teams notifications); and other reasonable written instructions consistent with the Terms.

3.3Kuuba will immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the relevant processing until the instruction is confirmed or changed.

3.4Kuuba will not: sell Customer Personal Data; use it for its own purposes; combine it with data from other customers except as needed to run the shared Service infrastructure securely; or use it to train AI models.

4.1The Customer will: (a) ensure it has a lawful basis for the processing and for its instructions; (b) provide Visitors with a privacy notice that explains the use of the Assistant, the role of Kuuba and its Subprocessors, and international transfers; (c) keep the Widget's AI notice visible to Visitors; (d) not configure the Assistant to collect special category or criminal offence data unless agreed in writing under the Terms; and (e) ensure Customer Content does not contain more personal data than necessary for its purpose.

4.2The Customer is responsible for handling Visitor enquiries and personal data once Kuuba has delivered them to the Customer's email, Slack or Microsoft Teams accounts.

5.1Article 28(3)(b). Kuuba will ensure that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality (contractual or statutory) and only accesses Customer Personal Data as needed to provide, secure or support the Service.

6.1Article 28(3)(c) and Article 32. Kuuba will implement and maintain the technical and organisational measures described in Annex 2, which are designed to provide a level of security appropriate to the risk. Kuuba may update these measures provided it does not materially reduce the overall level of protection.

In short: You give us general permission to use the subprocessors listed in Annex 3. We will tell you before adding new ones, and you can object.

7.1General authorisation (Article 28(2)). The Customer gives Kuuba general written authorisation to engage Subprocessors. The Subprocessors in place at the date of this DPA are listed in Annex 3, which the Customer approves.

7.2Subprocessor terms (Article 28(4)). Kuuba will put a written contract in place with each Subprocessor imposing data protection obligations that offer at least the same level of protection as this DPA, to the extent applicable to the services provided. Kuuba remains fully liable to the Customer for the performance of each Subprocessor's obligations.

7.3Notice of changes. Kuuba will give the Customer at least [30] days' notice by email (and by updating the list at [SUBPROCESSOR LIST URL: to be confirmed]) before a new Subprocessor processes Customer Personal Data.

7.4Objection. The Customer may object on reasonable data protection grounds by emailing [privacy@ CONTACT EMAIL: to be confirmed] within [14] days of the notice. The parties will discuss the objection in good faith. If Kuuba cannot reasonably offer an alternative, the Customer may terminate the affected Service by written notice before the change takes effect and receive a refund of prepaid Fees for the period after termination.

7.5Emergency replacement. If Kuuba must replace a Subprocessor urgently for reasons outside its control (for example a provider ceasing to operate or a security issue), it may do so immediately and will notify the Customer as soon as possible, and clause 7.4 will then apply.

7.6Customer-chosen services. Slack and Microsoft Teams webhooks, Google sign-in and the Customer's own email systems are services the Customer chooses to connect. Delivery of data to the Customer's own Slack or Microsoft Teams workspace is a transfer to the Customer on its instruction, and those providers are not Kuuba's Subprocessors for that data. [SOLICITOR TO CONFIRM CHARACTERISATION.]

8.1Article 28(3)(e). Taking into account the nature of the processing, Kuuba will help the Customer, by appropriate technical and organisational measures where possible, to respond to requests from data subjects to exercise their rights. If Kuuba receives a request directly, it will not respond (other than to acknowledge it and refer the person to the Customer) and will forward it to the Customer within [5] business days.

8.2Where the Customer cannot itself retrieve, correct or delete the relevant Visitor Data through the Service, Kuuba will do so on the Customer's written request within a reasonable time.

9.1Article 28(3)(f). Taking into account the nature of the processing and the information available to Kuuba, Kuuba will provide reasonable assistance to the Customer in meeting its obligations under Articles 32 to 36 of the UK GDPR, including security, breach notification, data protection impact assessments and prior consultation with the ICO. Kuuba may charge reasonable costs for assistance that goes beyond providing its standard documentation, except where the assistance is needed because of Kuuba's breach.

In short: If something goes wrong, we will tell you without undue delay, and we aim to do so within [48] hours, so that you can meet the 72-hour deadline to tell the ICO.

10.1Kuuba will notify the Customer without undue delay after becoming aware of a Personal Data Breach, and will aim to do so within [48] hours.

10.2The notice will include, as far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for more information. Where information is not available at first, Kuuba will provide it in phases without undue further delay.

10.3Kuuba will take reasonable steps to contain, investigate and remedy the breach and will cooperate with the Customer. Kuuba will not notify the ICO or data subjects about a breach of Customer Personal Data on the Customer's behalf without the Customer's instruction, unless required by law.

10.4Notification of a breach is not an admission of fault or liability.

11.1Article 28(3)(h). Kuuba will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 and this DPA, including by responding to a reasonable security questionnaire no more than once a year (unless there has been a Personal Data Breach or a regulator requires more).

11.2If that information is not reasonably sufficient, the Customer (or an independent auditor it appoints who is bound by confidentiality and is not a competitor of Kuuba) may carry out an audit, on at least [30] days' written notice, during business hours, no more than once in any 12 months (except after a Personal Data Breach or where a supervisory authority requires it), in a way that minimises disruption and does not compromise the security or confidentiality of other customers. The Customer will bear its own costs [and reimburse Kuuba's reasonable costs for time spent beyond [1] business day].

11.3Kuuba will inform the Customer if, in its opinion, an audit instruction infringes Data Protection Laws.

In short: Our main hosting is in London. Some subprocessors process data outside the UK. We will only transfer data where a lawful transfer mechanism applies.

12.1Customer Personal Data is stored primarily in the UK (London). Encrypted backups are stored in the UK or EEA. Some Subprocessors process Customer Personal Data outside the UK, as described in Annex 4. The Customer authorises these transfers.

12.2Kuuba will not make, or permit a Subprocessor to make, a restricted transfer of Customer Personal Data unless a valid Transfer Mechanism is in place and, where required, a transfer risk assessment has been carried out. Kuuba will provide a copy of the relevant Transfer Mechanism (which may be redacted for commercial confidentiality) on request.

12.3If a Transfer Mechanism ceases to be valid (for example if a provider's Data Privacy Framework certification lapses or UK adequacy regulations are revoked), Kuuba will promptly put an alternative Transfer Mechanism in place or, if it cannot, will tell the Customer and the Customer may terminate the affected Service under clause 7.4.

12.4Where the EU GDPR applies to the Customer's processing, the parties will agree any additional Transfer Mechanism required (such as the EU Standard Contractual Clauses).

13.1Article 28(3)(g). When the Terms end, the Customer may request an export of Customer Personal Data within [30] days, as set out in the Terms. After that period, Kuuba will delete Customer Personal Data from live systems within [30] days, and it will be removed from backups as they expire within a further [35] days, unless UK law requires Kuuba to keep it. Kuuba will confirm deletion in writing on request.

13.2During the term, Visitor Data is kept for the period set by the Customer in the Service, or if none is set, for [12 months] from the end of the conversation [CONFIRM PRODUCT CAPABILITY AND DEFAULT].

13.3Any Customer Personal Data retained by law remains subject to this DPA and will be processed only for the purpose for which it is retained.

14.1Kuuba will keep a record of processing activities carried out on behalf of the Customer as required by Article 30(2) of the UK GDPR and will cooperate with the ICO on request.

14.2If Kuuba receives a request from a public authority for Customer Personal Data, it will (unless legally prohibited) notify the Customer, challenge the request where there are reasonable grounds, and disclose only the minimum data required.

15.1Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms (including any separate data protection cap in clause 20.4 of the Terms), which apply as if set out in this DPA. Nothing in this DPA limits either party's liability to data subjects under Article 82 of the UK GDPR or any liability that cannot be limited by law.

16.1This DPA continues for as long as Kuuba processes Customer Personal Data, even after the Terms end.

16.2Kuuba may update this DPA on notice under the Terms where needed to reflect changes in Data Protection Laws, regulatory guidance or Subprocessors, provided the update does not reduce the protection given to Customer Personal Data.

16.3This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Drafting note: Items marked [to be confirmed] must be checked against the live system before publication. Do not publish a measure that is not in place.

Drafting note: Transfer mechanisms below reflect the providers' own published documents as checked on 24 October 2026. They must be re-checked before publication and on any change.

Not Subprocessors for Customer Personal Data: Stripe (billing, processes Kuuba's own customer billing data), Google (optional sign-in for Authorised Users), Vercel (hosts Kuuba's marketing website only [CONFIRM that no Widget or API traffic passes through Vercel]), and Slack or Microsoft Teams (Customer-chosen destinations, see clause 7.6).