Data Processing Addendum

Who this DPA is for

This Data Processing Addendum (“DPA”) applies when a business customer (“Customer”) uses Kiavic such that Kiavic processes personal data on Customer’s behalf (for example lead capture from Customer’s Instagram audience).

Controller contact for Kiavic: admin@kiavic.com.

Roles

Customer is the controller (or processor instructing Kiavic) for end-user/lead data Customer collects through automations. Kiavic acts as processor for that Customer content. For Kiavic account administration data (Customer’s own login phone, billing contact), Kiavic acts as independent controller as described in the Privacy Policy.

Processing details

Subject matter: hosting and processing of social automation, lead, and related product data. Duration: while the Customer account remains active and for a limited period after deletion as described in the Privacy Policy / backup schedule. Nature: storage, transmission, display, and automated workflows Customer configures. Purpose: provide the Kiavic service. Types of data: identifiers, contact details Customer’s audience submits, message content, and technical logs. Data subjects: Customer’s end users / leads / followers interacting with Customer’s connected accounts.

Subprocessors

Customer authorizes Kiavic to use subprocessors necessary to deliver the service. Current categories:

• Cloud hosting & storage — Amazon Web Services (ap-south-1, Mumbai)
• Social platform APIs — Meta / Instagram (when Customer connects)
• AI model provider — OpenAI (for AI-assisted features Customer uses)
• Payments — Razorpay (when billing/payouts are enabled)
• SMS OTP — provider as configured when SMS delivery is enabled

Security & assistance

Kiavic implements appropriate technical and organizational measures (encryption in transit, encryption of tokens/OTP/KYC fields at rest, access controls, admin audit logging). Kiavic will assist Customer with data subject requests relating to Customer content where feasible through product tools (export/delete) and support.

International transfers

Primary hosting is in India. Some subprocessors may process data in other countries. Where required for Customer’s compliance program, parties will execute appropriate transfer mechanisms (such as SCCs) upon request.

Accepting this DPA

By creating a Kiavic business account or continuing to use processor features after this DPA is published, Customer agrees to this DPA. For a signed countersigned copy, email admin@kiavic.com with subject “DPA request”.