1. Parties And Scope

This Data Processing Agreement (the “DPA”) is between Endai Marketing Growth Inc., a Delaware corporation that provides Kyōsey AI ("we", “us”, “our”), and the customer that has accepted our Terms & Conditions or signed an order form for Kyōsey AI ("Customer", “you”). It forms part of that agreement (the “Agreement”) and applies whenever we process Customer Personal Data in providing Kyōsey.

Where the DPA and the Agreement conflict about the processing of personal data, the DPA wins. Where the DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses win.

2. Definitions

Terms used here and not defined have the meaning given in the Agreement or in Data Protection Laws.

“Data Protection Laws” means the laws that apply to the processing of Customer Personal Data under the Agreement, including, where they apply, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and US state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
“Customer Personal Data” means personal data in Customer Data that we process on your behalf in providing Kyōsey.
“Subprocessor” means a third party that we engage to process Customer Personal Data.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
“Standard Contractual Clauses” means the clauses approved by the European Commission in Decision (EU) 2021/914.
“Controller”, “processor”, “data subject”, “personal data”, “processing”, “service provider” and “supervisory authority” have the meanings given in Data Protection Laws.

3. Roles

For Customer Personal Data, you are the controller, or a processor acting for your own clients, and we are your processor, or subprocessor. For the personal data we handle for our own purposes (for example your account, billing and contact details, and how we run, secure and improve Kyōsey as described in our Privacy Policy), we are a controller and this DPA does not apply.

You confirm that you have a lawful basis, and any notices and consents needed, for the processing you ask of us, including for the data of your clients and of the people in the accounts you connect.

4. Our Duties as Your Processor

We will:

Follow your instructions. Process Customer Personal Data only on your documented instructions. The Agreement, this DPA and your use and configuration of Kyōsey (for example, the accounts you connect and the tasks you ask Kyōsey to do) are your instructions. We will tell you if we believe an instruction breaks Data Protection Laws, unless the law forbids it.
Keep it confidential. Make sure the people authorized to process Customer Personal Data are bound by confidentiality.
Keep it secure. Apply the technical and organizational measures in Annex II, and keep them appropriate to the risk. We may update them, as long as the overall level of protection does not go down.
Use subprocessors only as section 5 allows.
Help with data subjects’ requests. Taking into account the nature of the processing, help you, by appropriate measures and as far as possible, to respond to requests from people exercising their rights (access, correction, deletion, restriction, portability, objection). If a request reaches us directly, we will pass it to you and not answer it ourselves, unless you ask us to or the law requires it.
Help with compliance. Taking into account the information available to us, help you meet your duties on security, Security Incident notification, data protection impact assessments and prior consultation with a supervisory authority.
Not use it for anything else. Not sell or share Customer Personal Data, not use it for advertising, not combine it with data from other sources except as needed to provide Kyōsey, and not use it to train AI models, as section 6 of the Terms describes.

5. Subprocessors

You give us a general authorization to engage Subprocessors. The current list is on our Subprocessors page, with what each does and where.

We impose on each Subprocessor, by written contract, data protection obligations that protect Customer Personal Data at least as well as this DPA does, and we remain responsible for its performance.
We will tell you about a new Subprocessor, or a replacement, at least 30 days before it starts processing Customer Personal Data, by email to your account’s owner and by updating the page. In an emergency, for example to keep Kyōsey secure or running, the notice may be shorter, and we will explain why.
You may object on reasonable data protection grounds within those 30 days by writing to privacy@kyosey.com. We will work with you in good faith to resolve the objection. If we cannot, you may stop using the part of Kyōsey the change affects, or end the Agreement, and we will refund any fees you prepaid for the time after it ends, together with the unused money you added to your wallet.

6. Security Incidents

If we become aware of a Security Incident affecting Customer Personal Data, we will notify you without undue delay, and where feasible within 72 hours of becoming aware of it. We will give you the information you reasonably need to meet your own notification duties, as it becomes available: what happened, the categories and approximate number of people and records concerned, the likely consequences, and what we have done or propose to do. We will take reasonable steps to contain the incident and limit its effects. Our notice is not an admission of fault.

7. International Transfers

We are based in the United States, and Customer Personal Data may be processed in the United States and in the other countries named on the Subprocessors page.

From the European Economic Area. Where Customer Personal Data is transferred to a country without an adequacy decision, the Standard Contractual Clauses apply and are incorporated by reference: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. Clause 7 (docking) applies; under Clause 9, option 2 (general authorization) applies, with the notice in section 5; the optional wording in Clause 11 does not apply; under Clauses 17 and 18, the law and courts of Ireland apply; the annexes are filled in by Annexes I and II of this DPA, and the competent supervisory authority is the one that applies under Clause 13.
From the United Kingdom. The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner applies, with the Standard Contractual Clauses completed as above, and either party may end it as its section 19 allows.
From Switzerland. The Standard Contractual Clauses apply as above, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, references to the GDPR read as references to the FADP, and Swiss law and courts applying where the FADP requires.

Where we are certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) for a transfer, we may rely on that certification instead.

8. US State Privacy Laws

Where the CCPA or a similar US state law applies, we are your service provider (or processor) for Customer Personal Data. We will not sell or share it, as those laws define the terms; not retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship between us; not combine it with personal information from other sources except as those laws allow; comply with those laws and give the same level of privacy protection they require; and tell you if we can no longer meet them. You may take reasonable steps to stop and fix unauthorized use.

9. Audits

We will make available to you the information reasonably necessary to show that we meet this DPA, including answers to reasonable security questionnaires and summaries of independent assessments where we have them. If that is not enough, or a supervisory authority requires it, you may audit our compliance, by yourself or through an independent auditor bound by confidentiality, at most once a year (more often after a Security Incident or when the authority requires it), with at least 30 days’ written notice, during business hours and without disrupting our operations or other customers’ data. You bear the cost of the audit unless it shows a material breach of this DPA.

10. Deletion And Return

When the Agreement ends, or when you delete your account, we will delete Customer Personal Data within 90 days, unless the law requires us to keep it. Before then you can export your Customer Data, or ask us to return it, by writing to privacy@kyosey.com. Copies in backups are deleted on the backups’ regular cycle and are protected as this DPA requires until then. Records we keep for legal, tax or accounting reasons, such as invoices, are not Customer Personal Data under this DPA.

11. Liability, Term And Changes

Each party’s liability under this DPA is subject to the limits and exclusions of liability in the Agreement, except where Data Protection Laws do not allow them. This DPA lasts as long as we process Customer Personal Data. We may update it to reflect changes in Data Protection Laws or in Kyōsey, as long as the update does not reduce the protection of Customer Personal Data. We will post the new version here and tell account holders about material changes before they take effect.

Annex I. Details of The Processing

Parties. Data exporter: the Customer, as identified in its Kyōsey account or order form; activities: using Kyōsey to manage its online marketing, or its clients’ marketing. Data importer: Endai Marketing Growth Inc., provider of Kyōsey AI, 223 Wall Street, Ste 300, Huntington, New York 11743, United States, privacy@kyosey.com; activities: providing Kyōsey. Role of the importer: processor.

Categories of data subjects. The Customer’s users and team members; the Customer’s clients and their staff; people whose data is in the accounts the Customer connects, such as advertisers’ customers and leads, people in emails, meetings, calls and documents, and a store’s customers.

Categories of personal data. Contact details (name, email address, phone number, company, role); account identifiers and sign-in records; content of chats, files, notes, tasks and reports; advertising, analytics and search data from connected platforms, which can include identifiers and audience data; store and order data, which can include customers’ names, contact details and purchase history; call and form data, which can include callers’ numbers and messages; email, calendar and document content where the Customer connects Google Workspace; and the events in a user’s own calendar (Google Calendar or Outlook calendar), and the email and files in their own mailbox and drive (Gmail and Google Drive, or Outlook mail and OneDrive) where that user allows them, read only as our Privacy Policy describes (section 2).

Special categories of data. None are intended. The Customer should not connect accounts or upload content containing special categories of data (for example health data) unless it is needed and the Customer has a lawful basis; any such data is protected by the measures in Annex II.

Frequency. Continuous, for as long as the Customer uses Kyōsey.

Nature and purpose. Collection from connected platforms, storage, organization, analysis and AI processing to provide Kyōsey: answering questions, preparing reports, KPIs and drafts, planning campaigns, showing a user’s calendar beside the Customer’s priorities, reading a user’s own calendar, email and files when that user asks Kyō, finding work for the Customer’s Projects & Priorities in its email and meetings with its agency and in its chats with Kyō, and the actions the Customer approves in its connected platforms.

Duration and retention. For the term of the Agreement and the deletion period in section 10, as our Privacy Policy describes.

Transfers to Subprocessors. For the purposes and in the places listed on the Subprocessors page, for as long as each provides its service.

Annex II. Technical And Organizational Measures

Encryption. All traffic to and from Kyōsey is encrypted in transit (TLS). The access tokens and keys for connected platforms are encrypted at rest, each bound to the connection it belongs to, and the encryption keys are kept apart from the data.
Separation of customers. Each customer’s data, files and credentials are kept apart: every call to a connected platform is bound to the accounts on that customer’s own record, and files are stored per customer.
Least privilege on connected platforms. Kyōsey reads advertising, analytics and store data with read-only access by default. A change in an account, such as creating a campaign, needs a person’s explicit approval, and campaigns are created paused. A user’s own workspace (their calendar, email and files) is connected by that user alone, kept apart from the Customer’s connections, with only the permissions that user allows: reading their calendar and adding, moving and cancelling events on it (Google’s calendar.readonly and calendar.events, Microsoft Graph’s Calendars.ReadWrite, or Calendars.Read alone when they connect only their calendar), reading their email and saving drafts (Google’s gmail.readonly and gmail.compose, Graph’s Mail.ReadWrite), reading their files (Google’s drive.readonly, Graph’s Files.Read.All), and saving the presentations and documents Kyōsey makes to their Google Drive, keeping them up to date there and moving them to the trash (Google’s drive.file, which reaches only the files Kyōsey made). Their email and files are read, an event is added to their calendar or one they organize is moved or cancelled, a draft is saved in their mailbox and a document is saved, updated or moved to the trash in their Drive only when that user asks Kyō in their chat or opens a document in Google: never on a schedule, and no email is ever sent.
Access control. Our staff access Customer Personal Data only when needed to provide or support Kyōsey, through roles and per-client permissions, and their access is logged. Credentials are never shown to the AI or written to logs.
Logging and monitoring. Important actions are kept in audit logs; the service is monitored, and alerts go to administrators.
Backups and recovery. Data is backed up regularly, and restoring from backup is tested.
Vulnerability management. Dependencies are checked for known vulnerabilities, and fixes are applied according to their severity.
Secure development. Changes are reviewed and tested before release, and test environments do not use customer data unless the customer agrees.
Incident response. A documented process for handling Security Incidents and notifying customers as section 6 requires.
Subprocessor management. Subprocessors are chosen for their security, bound by written data protection terms, and reviewed.
Physical security. Servers are hosted in secured data centers with controlled access.
Assistance with requests. Customers can disconnect platforms and delete their account in Kyōsey; exports and other requests are handled through privacy@kyosey.com.