Data Processing Agreement

Processor

Kuro Studio, Lukas Wirth

Address

Hirschberger Str. 24, 90559 Burgthann, Germany

Contact

legal@kurostudio.io

Controller

The customer operating the workspace

The subject matter is the processing of personal data that occurs when we provide Kuro Engage to you: running your automation campaigns on your connected social accounts, delivering the resulting messages and assets, and capturing the leads those campaigns produce. The duration of the processing matches the term of the main contract.

We collect, store, organize, match, transmit, retrieve and erase data to operate the customer’s configured social automation, asset delivery, lead capture and associated delivery/interaction records. Processing lasts for the service relationship and the agreed return/deletion period.

Data subjects

• People interacting with the customer’s connected accounts and campaigns, including commenters, message recipients and leads.
• People whose information the customer includes in campaign contents or uploaded assets.

Data categories

• Platform account, audience and interaction identifiers, usernames, comments, message content/status and opt-out instructions.
• Lead contact details, the lead's Instagram display name and whether the lead follows the connected account, and campaign/source attribution supplied through the campaign.
• Campaign settings, uploaded files, connected-account credentials and necessary processing/delivery metadata.

Account-holder administration, our billing, security monitoring and optional product analytics are our separate controller-side processing as described in the Privacy Policy; they are not made customer instructions by this DPA. Special-category data under Art. 9 GDPR and criminal-offence data under Art. 10 GDPR are not intended and must not be supplied without a separate express arrangement.

We process personal data only on your documented instructions, including with regard to transfers to a third country, unless we are required to process by Union or Member State law. In that case we inform you of that legal requirement before processing, unless the law prohibits it.

Your configuration in the product is your primary instruction: the campaigns, keywords, message copy, assets, and connected accounts you set up, together with this agreement and the main contract. Instructions beyond that must be given in text form to legal@kurostudio.io.

We inform you immediately if we consider an instruction unlawful and suspend it pending clarification. Repeating an unlawful instruction does not require us to carry it out. We notify you if legal requirements prevent compliance or require processing, unless law prohibits that notice.

We ensure that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. That commitment survives the end of their engagement. Access is granted strictly on a need-to-know basis.

We implement appropriate technical and organisational measures under Art. 32 GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to the rights and freedoms of natural persons. In particular:

• Transport encryption; infrastructure encryption at rest and protected credentials in a dedicated secret store.
• Workspace isolation through database Row Level Security, role-based permissions, restricted service-role access and authorized support access.
• Magic-link and passkey authentication, bot protection, secure credential handling and confidentiality obligations for authorized personnel.
• Sanitized operational/security records, vulnerability remediation and a process for assessing and responding to incidents.
• Separated production and development, encrypted backups, documented restore and reapplication of later erasures, plus scoped deletion of files and database records.
• Data minimization, documented retention/deletion classes, and verification of access, isolation and critical processing paths.

We may change these measures over time provided that the level of protection is not reduced. The measures in force are documented in this agreement as amended from time to time.

You grant general written authorization for the subprocessors identified in the incorporated list at /subprocessors. It identifies entity, purpose and processing locations. We impose substantially the same applicable data-protection obligations on them and remain responsible to you for their performance of those obligations. Infrastructure providers’ own subprocessor lists form the onward chain, subject to those safeguards.

We notify workspace admins in text form of an intended addition or replacement at least 30 days before customer data is processed by the new subprocessor. You may object on substantiated data-protection grounds within that period. We work to resolve a justified objection, including an alternative where reasonably available. If no reasonable resolution is possible, either party may end the affected service before the change applies; prepaid fees for the unused affected period are returned. A notice is not optional tracking consent and does not replace it.

Taking account of the processing, we assist you through appropriate technical and organisational measures with requests under Chapter III GDPR. If a person contacts us about your campaign data, we promptly forward the request to you, may acknowledge receipt and clarify our role, and act on your documented instructions. We do not independently decide the merits or erase your data solely because a third party asks, unless law requires action.

We assist you in ensuring compliance with your obligations under Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available to us. This includes assistance with security of processing, data protection impact assessments, and prior consultation with a supervisory authority.

We notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and provide the information you need to meet your own notification duties under Art. 33 and Art. 34 GDPR.

At your choice, after provision of the service ends we return or erase customer personal data and delete copies unless applicable law requires retention. Return uses the export and switching procedure in section 19 of the Terms of Service, including stored asset files and the applicable retrieval period. Routine deletion after a paid subscription ends is scheduled for 30 days, but must respect a timely agreed switching/return timetable and mandatory rights. We do not retain customer campaign data for our own advertising.

Protected backups expire through their rotation and are not used for further ordinary processing. After restore, later erasures must be reapplied. We provide available deletion confirmation on request. Separately required controller records such as invoices are not customer campaign copies and are restricted to their lawful retention purpose.

We make available to you all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or another auditor you mandate.

Audits are announced with reasonable notice, take place during normal business hours, must not disproportionately disrupt our operations, and must respect the confidentiality and the data of our other customers. We may first provide current certifications, reports, or documentation from us or our subprocessors where these are suitable to demonstrate compliance.

Personal data may be processed outside the EU or EEA, in particular where a subprocessor operates there. Where that happens, we ensure an adequate level of protection through an adequacy decision including the EU-US Data Privacy Framework, through Standard Contractual Clauses, or through other appropriate safeguards under Chapter V GDPR, together with any supplementary measures required.

Data transmitted to Meta in order to deliver your campaign messages is transferred to Meta on the basis of your instruction and Meta's own platform terms, which you accept as the operator of the connected account.

In the event of contradictions between this agreement and the Terms of Service, this agreement prevails for the processing of personal data on your behalf. Where this agreement is silent, the Terms of Service apply, including their provisions on liability and governing law.

Should individual provisions of this agreement be or become invalid, the validity of the remaining provisions is unaffected. Questions about this agreement: legal@kurostudio.io.