Data Processing Terms

These terms form part of the Terms of Service between KAIROS-K LTD (company number 14481271, registered office 48 Railway Street, Llanhilleth, Abertillery, Wales, NP13 2JB; ICO registration ZB564813) ("Processor") and the organisation using Kairos-K Sign ("Controller"). They meet Article 28 of the UK GDPR.

1. Details of the processing

2. Processor obligations (Article 28(3))

• Process personal data only on the Controller's documented instructions, unless the law requires otherwise; the use of the Service and its settings are such instructions. We tell the Controller if an instruction appears to break data protection law.
• Ensure that people authorised to process the data are bound by confidentiality.
• Apply appropriate technical and organisational measures (Article 32), including:
  • encryption at rest (AES-256-GCM) and in transit (TLS);
  • signing links and codes stored only as keyed hashes;
  • one-time code verification of recipients;
  • role-based access within organisations;
  • an append-only, hash-chained audit trail anchored daily in separate storage;
  • rate limits;
  • restricted administrative access (platform administrators see usage, not document contents);
  • encrypted database backups kept for 35 days.
• Immutable evidence copies. The Controller instructs the Processor to keep an immutable encrypted evidence copy until the retention date chosen in the Service. Where deletion is required earlier, the Processor will destroy the encryption key so that the copy is beyond use, and the copy will expire at its lock date. The same applies to the encrypted backups of the service database, which are kept for 35 days and then expire.
• Assist the Controller, taking into account the nature of the processing, with:
  • data subject requests: requests we receive from signers or other people about envelope data are passed to the Controller without delay;
  • security;
  • breach notification;
  • data protection impact assessments and prior consultation.
• At the end of the Service, delete or return the personal data at the Controller's choice, unless the law requires storage. Locked evidence copies are put beyond use as described above.
• Information and audits (Article 28(3)(h)). We make available all information needed to show compliance with Article 28. We allow for and contribute to audits, including inspections, by the Controller or an auditor it mandates:
  • with at least [30] days' written notice;
  • during business hours;
  • no more than once a year, unless a personal data breach or a regulator requires it;
  • under confidentiality;
  • at the Controller's cost.
  We may first offer our current security documentation and audit-trail evidence.

3. Personal data breaches

• We notify the Controller within 48 hours after becoming aware of a personal data breach affecting the Controller's data. The notice includes what we know about the nature of the breach, the data and people concerned, the likely consequences and the measures taken. We add further information as it becomes available.
• As a provider of trust services (electronic seals and timestamps), we also notify the ICO within 24 hours of becoming aware of a breach of security or loss of integrity with a significant impact on the trust service or the personal data in it, as UK eIDAS Article 19(2) requires.

4. Sub-processors (Article 28(2) and 28(4))

The Controller gives general authorisation for the sub-processors below. We give [30] days' notice of a new or replacement sub-processor, and the Controller may object on reasonable data protection grounds; if we cannot resolve the objection, the Controller may end the affected Service. Each sub-processor is bound by a written contract with the same data protection obligations as these terms (Article 28(4)). We remain liable to the Controller for its performance.

The time-stamping authority (if used) receives only a SHA-256 fingerprint of the seal. It receives no personal data or document content, so it is not a sub-processor.

5. Controller's rights and responsibilities

• The Controller decides the purposes and means of processing envelope data. It is responsible for having a lawful basis to send each document and the personal data in it to recipients, for giving recipients the information Articles 13 and 14 require, and for its settings (including retention).
• The Controller may give further reasonable documented instructions. It may require deletion, subject to the evidence copies described above. It may receive the information and exercise the audit rights in section 2.

6. Where KAIROS-K LTD acts as an independent controller

For the following purposes we decide how the data is used and are a controller in our own right (see the Privacy Notice):

• security, fraud and abuse prevention (including abuse reports, rate limits and sign-in records);
• account management, usage measurement, limits and billing;
• platform administration;
• giving a parent organisation of a franchise unit the unit's usage figures (never document contents);
• the platform audit trail and its daily anchors.

7. International transfers

We do not transfer envelope data outside the UK except to the sub-processors listed above, under an appropriate safeguard under UK GDPR Chapter V.

8. Liability

Each party's liability under these terms is as set out in the Terms of Service, except where the UK GDPR does not allow it to be limited.

Version: draft-2026-10-24