Data processing addendum
Roles
For the content of your workspace (briefs, assets, deliverables, run records) you are the controller and KIT ENGINE is the processor, acting only on your instructions as expressed through the product. For account and billing data we are a controller in our own right.
Instructions and confidentiality
We process only to provide the service, comply with law, or on your documented instruction. Our staff are bound by confidentiality obligations that survive their employment, and access is limited as described in the security overview.
Transfers
Where personal data leaves the EEA or UK we rely on the European Commission's standard contractual clauses with the UK addendum, supported by a transfer impact assessment available on request.
Assistance
We help you answer data subject requests, complete impact assessments, and respond to regulators. We tell you without undue delay if we receive a request that concerns your data, unless legally prohibited.
Audit
Once a year, on 30 days' notice, you may audit our compliance through a written questionnaire, our penetration test summary, and, where genuinely necessary, an on-site visit at your cost.
Deletion
On termination we delete workspace content within 30 days of your export window closing. Audit records of refusals, approvals and spend survive, because they exist to prove what happened rather than to hold your work.