Data Processing Agreement (DPA)

Annex to the public offer. Version 1.0.0 of {{EFFECTIVE_DATE}}.

Operator (controller): the Customer (organisation or sole proprietor that accepted the offer). Processor: {{COMPANY_NAME}}, OGRN {{OGRN}}, INN {{INN}}, address {{LEGAL_ADDRESS}}.

1. When it applies#

This DPA applies where data entered by the Operator or its Users into the Service, or AI answers collected by the Service for the Operator, contain personal data (e.g. the name of a brand owner or a person mentioned in an answer; names and emails of Operator's employees entered into the workspace). The Operator must not enter personal data into questions and facts (see the AUP); if it happens, this DPA covers that data.

User account data is processed by the Processor as an independent operator under the Policy; this DPA does not cover it, except where the Operator enters its employees' personal data into the workspace beyond what is needed for access.

2. Subject, purpose, duration#

2.1. Subject and purpose: processing personal data solely to provide the Operator with the services under the agreement (storing, analysing and displaying brand-visibility measurement data, support, security).

2.2. Duration: from acceptance of the offer until termination plus the retention period under clause 15.3 of the offer and until deletion under section 10.

2.3. Legal basis of the instruction: Art. 6(3) 152-FZ.

3. Nature of processing, categories of data and subjects#

4. Processor's obligations#

4.1. Process personal data only on the Operator's documented instructions (agreement, offer, dashboard settings, written requests), not for its own purposes, and not disclose it except under section 7.

4.2. Keep personal data confidential; ensure only persons who need access to provide the service, and who are bound by confidentiality, have it.

4.3. Apply legal, organisational and technical measures under Art. 19 152-FZ (section 6).

4.4. Store personal data of Russian citizens in databases in the Russian Federation (Art. 18(5) 152-FZ). No cross-border transfer under this DPA, except where expressly chosen by the Operator, subject to the Operator's compliance with Art. 12 152-FZ {{CROSS_BORDER_DPA_NOTE}}.

4.5. On the Operator's request, provide documents and information confirming the measures taken and reasonably assist audits (no more than once a year unless prompted by an incident; at the Operator's cost; without disclosing other customers' data).

4.6. The Processor need not obtain data subjects' consent; the Operator is liable to the subject and the Processor to the Operator (Art. 6(5) 152-FZ — verify).

5. Operator's obligations#

5.1. Have a legal basis for passing personal data to the Processor and for processing; obtain data subjects' consent and notify Roskomnadzor where needed.

5.2. Not enter personal data beyond what is necessary, nor special categories or biometrics.

5.3. Handle data subjects' requests itself and tell the Processor what action is needed.

5.4. Keep a valid contact email for incident notices.

6. Security measures#

Measures at the date of this version (more in section 10 of the Policy):

• TLS encryption at the external perimeter;
• passwords stored as argon2id hashes; sign-in attempt limits; time-limited sessions revoked on password change;
• role-based access within the Operator's workspace;
• customer data isolation: tenant ID in every record and key, server-side filtering;
• an audit log of actions (sign-in, roles, invitations, projects, runs, deletion, billing) available to the Operator's owner/admin;
• least privilege for service components {{LEAST_PRIVILEGE_STATUS}};
• deletion of project and workspace data, including object storage, analytics DB and search index;
• backups with limited retention;
• organisational measures: a designated responsible person, limited staff access, an incident procedure {{ORG_MEASURES_STATUS}}.

The Processor may update measures without lowering the level of protection.

7. Subprocessors#

7.1. The Operator gives general authorisation to engage subprocessors from the list (hosting, third-party AI services, payment provider, email service). The Processor binds them by obligations no less strict than this DPA and is liable to the Operator for their acts.

7.2. The Processor notifies the Operator of list changes at least {{SUBPROCESSOR_NOTICE_DAYS}} days (default 30) in advance by email and on the page. The Operator may object; failing agreement it may terminate the agreement with a refund for the unused period.

7.3. AI services: they receive only texts of questions and brand facts (not account data). The Operator does not include personal data in them. The "ChatGPT" point runs through a third-party LLM aggregator outside Russia (cross-border transfer of question texts).

8. Incidents#

8.1. The Processor notifies the Operator of an incident affecting the Operator's personal data (unlawful or accidental transfer, disclosure, access) without undue delay and within 24 hours of detection, to the Operator's contact email, describing: what happened, suspected causes, categories and approximate number of subjects, measures taken, contact.

8.2. The Operator itself notifies Roskomnadzor: initial notice within 24 hours of detecting the incident, additional notice (investigation results) within 72 hours (Art. 21(3.1) 152-FZ; deadlines per secondary sources, verify). The Processor supplies information needed for the notice within 24 hours of request and then as the investigation proceeds.

8.3. The Processor performs its own notification duties to Roskomnadzor and GosSOPKA where they arise for it as operator of users' personal data.

9. Assistance with data subject requests#

The Processor forwards a data subject's request concerning data processed on instruction to the Operator within 3 business days and does not answer on the merits without the Operator's instruction. It assists with the Operator's requests (search, export, correction, deletion) via dashboard functions or on request to support@kleogeo.ru within {{DSR_ASSIST_DAYS}} business days (default 5).

10. Return and deletion#

10.1. The Operator may itself delete a project or workspace in the dashboard (data in working databases, S3, ClickHouse, OpenSearch is deleted; backups clear on rotation within {{BACKUP_DAYS}} days).

10.2. After the agreement ends and the retention period (clause 15.3 of the offer) expires, the Processor deletes the Operator's personal data unless the Operator earlier requested return (JSON/Parquet export) or deletion.

10.3. Data whose retention is required by law (payment and accounting documents, consent log) is not deleted; it is kept separately and not used for other purposes.

11. Liability#

Per section 14 of the offer. The Processor is liable to the Operator for breach of this DPA.

12. Annex for customers in the EU/EEA and UK (SCC-compatible structure)#

12.1. If the Operator is subject to GDPR/UK GDPR, the parties additionally conclude the EU Standard Contractual Clauses (Decision (EU) 2021/914) — {{SCC_MODULE}} (Module 2: controller → processor; Module 3 if the Operator is itself a processor) — and/or the UK mechanism {{UK_TRANSFER_MECHANISM}}; this DPA and Annexes I–III serve as their content. In a conflict, the SCC prevail. [The SCC reference and their suitability for data import into Russia are for counsel; not verified.]

12.2. Governing law and court for the SCC: {{SCC_GOVERNING_LAW}}, {{SCC_COURT}}. Supervisory authority: {{SCC_SUPERVISORY_AUTHORITY}}.

Annex I. Description of the transfer#

A. Parties. Data exporter: the Customer (controller) — {{CUSTOMER_NAME}}, address and contact from the account. Data importer: {{COMPANY_NAME}}, {{LEGAL_ADDRESS}}, contact privacy@kleogeo.ru, {{DPO_NAME}}; EU/UK representative: {{EU_REPRESENTATIVE}} / {{UK_REPRESENTATIVE}}.

B. Description of transfer.

C. Competent supervisory authority: {{SCC_SUPERVISORY_AUTHORITY}}.

Annex II. Technical and organisational measures#

Measures per section 6 of this DPA; in SCC format: encryption in transit (TLS); pseudonymisation not applied; access control and customer isolation; logging and audit; vulnerability management and security reviews (internal audits) {{ORG_MEASURES_STATUS}}; backups and limited retention; deletion on request; incident response and notification procedures; staff training and confidentiality undertakings; subprocessor requirements per section 7; assistance with data subject requests (section 9). Physical security of data centres is provided by the hosting provider {{HOSTING_PROVIDER}}.

Annex III. List of subprocessors#

Current list: /legal/subprocessors; at this version: hosting {{HOSTING_PROVIDER}} (Russia); AI providers (Yandex AI Studio, Sber GigaChat — Russia; LLM aggregator {{LLM_AGGREGATOR_NAME}} — {{LLM_AGGREGATOR_COUNTRY}}); payment provider {{PAYMENT_PROVIDER}} (Russia); email service {{EMAIL_PROVIDER}} (Russia). General authorisation — section 7.

Notes for the lawyer (remove before publication)#

Verify mandatory instruction content (Art. 6(3), Art. 19 152-FZ; Government Decree 1119, FSTEC Order 21); the 24-hour notice to the Operator is an audit recommendation, not law; GDPR Art. 28 is not implemented; consider a separate signed DPA for large customers.