Data Processing Addendum

1. Roles of the parties

For personal data that the Customer submits to the service, the Customer is the Controller (or processor acting on behalf of its own controllers) and KlicForge is the Processor. KlicForge processes such data only on the Customer's documented instructions, including as set out in the agreement and this DPA.

2. Scope & nature of processing

KlicForge processes personal data to provide the agent runtime, dashboard, and related services — including operating AI agents, storing conversations and knowledge, and delivering notifications. The categories of data and data subjects are described in our internal data inventory and the Privacy Policy.

3. Subprocessors

The Customer authorizes KlicForge to engage the subprocessors listed on our Subprocessor List, including AI model providers. KlicForge imposes data-protection obligations on subprocessors and remains responsible for their performance. We will provide a mechanism to receive notice of new subprocessors.

4. AI & model training

KlicForge does not use Customer personal data to train its own AI models, and does not opt in to third-party AI provider training programmes. When an agent uses an AI model, content is processed by the selected model provider; that provider's handling depends on the chosen model and its terms. Where a Customer explicitly enables a feature that uses data differently, that use is governed by the relevant feature settings and the agreement.

5. Security

KlicForge maintains technical and organizational measures designed to protect personal data, including encryption in transit and at rest, tenant isolation, role-based access control, mandatory MFA for administrative access, audit logging, and PII redaction in logs.

6. Data subject requests & assistance

Taking into account the nature of the processing, KlicForge will provide reasonable assistance to help the Customer respond to data-subject requests and to meet its obligations regarding security, breach notification, and data protection impact assessments.

7. International transfers

Where personal data is transferred across borders, KlicForge relies on appropriate safeguards as required by applicable law.

8. Return & deletion

Upon termination, KlicForge will delete or return Customer personal data in accordance with the agreement and our Data Retention Policy, subject to legal retention obligations.

9. Contact

To request a signed DPA or for any data-protection question, contact privacy@klicforge.ai.