This Data Processing Agreement ("DPA") forms part of the agreement between Keenfunnel LLC ("Keenfunnel") and the client named in the order or statement of work ("Client"), together the "Agreement". It applies whenever Keenfunnel processes personal data on the Client's behalf while delivering services such as CRM setup, marketing automation, chatbots, AI voice agents and content production.
"Data Protection Laws" means every law that applies to the processing of Client Personal Data, including the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Brazil's General Data Protection Law (LGPD) and US state privacy laws such as the California Consumer Privacy Act ("CCPA").
"Client Personal Data" means personal data that Keenfunnel processes for the Client under the Agreement.
"Controller", "processor", "personal data breach", "data subject" and "supervisory authority" have the meanings given in the GDPR.
2.1 The Client is the controller, or a processor acting for its own controller, and Keenfunnel is its processor.
2.2 Keenfunnel processes Client Personal Data only on the Client's documented instructions. Those instructions are the Agreement, this DPA and any written instruction the Client gives during the services. If the law requires other processing, Keenfunnel tells the Client first, unless the law forbids it.
2.3 Keenfunnel tells the Client at once if it believes an instruction breaks Data Protection Laws.
2.4 The Client is responsible for the lawfulness of the data it provides and of its instructions, including any consent needed for emails, calls, texts or AI voice agents.
Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.
Keenfunnel ensures that everyone it authorizes to process Client Personal Data is bound by a duty of confidentiality.
Keenfunnel applies the technical and organizational measures in Annex 2, which are appropriate to the risk, and keeps them up to date.
6.1 The Client gives Keenfunnel general authorization to use sub-processors. Keenfunnel gives the Client its current list of sub-processors on request.
6.2 Keenfunnel gives at least 30 days' notice before adding or replacing a sub-processor, by email to the Client. The Client may object on reasonable data protection grounds within that period. If the parties cannot agree on a solution, the Client may end the affected services.
6.3 Keenfunnel imposes on each sub-processor data protection obligations that are at least as protective as this DPA, and remains responsible to the Client for each sub-processor's performance.
Keenfunnel does not use Client Personal Data to train or improve any AI model, its own or a vendor's, unless the Client agrees in writing.
Taking into account the nature of the processing, Keenfunnel helps the Client to:
Keenfunnel notifies the Client without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. The notice includes the information the Client needs to meet its own notification duties, as far as it is available.
10.1 Keenfunnel is located in the United States and may process Client Personal Data there and wherever its sub-processors operate.
10.2 For transfers of personal data subject to the GDPR to a country without an adequacy decision, the parties incorporate the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, with these choices: clause 7 (docking clause) applies; under clause 9, option 2 (general written authorization) applies with the notice period in section 6.2; the optional wording in clause 11 does not apply; under clauses 17 and 18, the law and courts of Spain apply. Annexes 1 and 2 of this DPA complete the annexes of the clauses.
10.3 For transfers from the United Kingdom, the UK International Data Transfer Addendum applies. For transfers from Switzerland, the clauses apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner.
10.4 Where Brazil's LGPD requires it, the parties incorporate the standard contractual clauses approved by Brazil's data protection authority (Resolution CD/ANPD No. 19/2024), without changes.
Where the CCPA or a similar US state law applies, Keenfunnel acts as a service provider or processor and does not:
Keenfunnel tells the Client if it can no longer meet these obligations.
Keenfunnel makes available the information needed to show compliance with this DPA. It allows audits by the Client or an independent auditor the Client appoints, on 30 days' notice and no more than once a year unless a breach or a supervisory authority requires it. The Client bears its own audit costs.
When the services end, Keenfunnel deletes or returns all Client Personal Data, as the Client chooses, within 30 days, unless the law requires it to keep a copy.
Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws do not allow them. If this DPA conflicts with the rest of the Agreement, this DPA prevails. If it conflicts with the standard contractual clauses, the clauses prevail.
Keenfunnel applies technical and organizational measures appropriate to the risk, as Article 32 of the GDPR requires, and describes them to the Client on request.