Data processing agreement

1. Roles

For every hosted workspace, the customer is the controller of the personal data inside it and Keanan is the processor. This agreement implements Art. 28 GDPR and forms part of the terms of service.

2. Subject and duration

Processing covers the operation of the Keanan platform for the customer: storing, displaying and transmitting the workspace data described in the privacy policy, for the duration of the subscription.

3. Categories of data and data subjects

Data subjects are the customer’s employees and contractors. Data categories include identification and contact data, contract and compensation data, absence records, expense receipts, uploaded documents and usage records such as the audit trail.

4. Our obligations

• We process workspace data only on the customer’s documented instructions, which the customer gives through the platform itself.
• Everyone with access is bound to confidentiality.
• We maintain technical and organizational measures appropriate to the risk: encryption in transit, role based access control, two factor authentication, audit logging, rate limiting and EU hosting. The security page describes them.
• We assist the customer with data subject requests and with the obligations under Art. 32 to 36 GDPR.
• We notify the customer without undue delay after becoming aware of a personal data breach affecting their workspace.
• At termination, the customer exports the workspace with the built in export; afterwards we delete it within 30 days.
• We provide the information necessary to demonstrate compliance and allow audits within reasonable bounds.

5. Subprocessors

The customer authorizes the following subprocessors. We will announce any change at least 30 days in advance, giving the customer the right to object for good reason.

Subprocessor	Purpose	Location
Amazon Web Services EMEA SARL	Infrastructure hosting of workspaces	EU, Frankfurt region
Resend, Inc.	Delivery of transactional email	USA, safeguarded by EU standard contractual clauses

Payment processing runs through Whop as merchant of record and independent controller. No workspace data is shared with Whop.

6. International transfers

Workspace data is stored in the European Union. Keanan operates from Uganda; administrative access from outside the EU is limited to what operating the Service requires and is protected by the measures described above. For customers subject to the GDPR, the EU standard contractual clauses (module two, controller to processor) are incorporated into this agreement. Where a subprocessor processes data outside the EU, we rely on an adequacy decision or the standard contractual clauses.

7. Liability and final provisions

Liability follows the terms of service, and this agreement follows the governing law chosen there. If this agreement conflicts with the terms, this agreement prevails for data protection matters. Where the EU standard contractual clauses apply, they prevail over both.