Legal · UK GDPR & EU GDPR Art. 28
Data Processing Agreement
How it works
- You (the merchant) are the controller of your customers' data. Kosmly is your processor.
- You accept this DPA in one click when you install a Kosmly app. Universe customers can sign a custom version.
- Data stays in the EU, is never used to train AI, and is deleted 30 days after you leave.
1. Parties and scope
This agreement is between the merchant using Kosmly ("Controller") and Kosmly Ltd, a company registered in England and Wales (company no. [number]), registered office [address], VAT [GB number] ("Processor"). It meets Article 28 of the UK GDPR and of the EU GDPR, whichever applies to the Controller. It applies to all personal data the Processor handles for the Controller through the Kosmly service, and it forms part of the Terms of Service. If this DPA and the Terms conflict, this DPA prevails for data protection matters.
2. Processing details
Subject, duration, nature and purpose of the processing, and the categories of data and data subjects, are described in Annex I.
3. Processor obligations
- Instructions. The Processor processes personal data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's settings in Kosmly. It tells the Controller if it believes an instruction breaks the law.
- Confidentiality. Everyone with access is bound by confidentiality and trained in data protection and AI literacy.
- Security. The Processor applies the measures in Annex II (GDPR Art. 32).
- Minimisation. Agents receive only the data they need. Names, emails and phone numbers are replaced with placeholders before text is sent to an AI model, where the task allows it.
- No training. Personal data is never used to train or improve AI models, by the Processor or its sub-processors.
- Data subject requests. The Processor helps the Controller answer requests to access, correct, delete or export data, including through the platforms' mandatory privacy webhooks.
- Breaches. The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach, with the information the Controller needs for its own notification under Art. 33.
- Assistance. The Processor helps the Controller with impact assessments (Art. 35) and prior consultations where they relate to Kosmly.
- End of service. Within 30 days of the end of the service, the Processor deletes all personal data, or returns it on request, unless the law requires it to be kept.
- Audits. The Processor makes available the information needed to show compliance, and allows audits once a year with 30 days' notice, or after a breach.
4. Sub-processors
The Controller gives general authorisation to use the sub-processors in Annex III. The Processor imposes the same data protection obligations on each of them by contract. It announces any new sub-processor at least 30 days in advance by email and on this page. The Controller may object on reasonable grounds; if no solution is found, the Controller may terminate the affected service with a pro-rata refund.
5. International transfers
Personal data is stored and processed in the EU/EEA. The Processor is established in the United Kingdom, which benefits from an EU adequacy decision; remote access by its UK staff relies on that decision. Any other transfer happens only under an adequacy decision, the Standard Contractual Clauses (Commission Decision 2021/914) or, for UK data, the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment and additional safeguards where needed.
6. Liability
Each party's liability under this DPA is subject to the limits in the Terms of Service, except where Article 82 of the UK GDPR or EU GDPR provides otherwise.
Annex I · Description of processing
| Item | Description |
|---|---|
| Purpose | Running the AI agents the Controller activates: content (Vega), SEO (Sirius), translation (Lyra), pricing (Orion), and later images, social, email, carts, support, reviews, inventory, analytics and ads. |
| Data subjects | The Controller's customers and prospects, store visitors who use the support chat, and the Controller's staff. |
| Categories of data | Name, email, phone, shipping and billing address, order history, review and chat content, consent status. No special categories (Art. 9) are intended. |
| Nature | Storage, retrieval, analysis and text or image generation by AI models, under the autonomy level the Controller chooses. |
| Duration | For the term of the subscription plus 30 days. |
| Retention of AI logs | Prompts and outputs are kept for 30 days for audit and quality, then deleted. The action history in Mission Control is kept for the life of the account. |
Annex II · Technical and organisational measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Strict separation of each merchant's data, enforced at database level.
- Role-based access, two-factor authentication and least-privilege for staff; access is logged.
- Pseudonymisation of personal data before it reaches AI models, where the task allows it.
- Daily encrypted backups in the EU, with tested restores.
- Vulnerability management, dependency scanning and a public security contact (security@kosmly.com), in line with the Cyber Resilience Act.
- Written incident and breach response procedure, tested at least once a year.
- Staff training on data protection and AI literacy (AI Act Art. 4).
Annex III · Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Scaleway SAS | Application hosting, managed database, encrypted backups | Paris, France |
| Amazon Web Services EMEA SARL (Amazon Bedrock) | AI models (Anthropic Claude) for text generation, SEO and translation; no training, no storage of prompts by the provider | Frankfurt, Germany (EU) |
| Mistral AI SAS | Backup AI models when the primary is unavailable; no training | France (EU) |
| Sendinblue SAS (Brevo) | Emails to the Controller's staff; later, emails sent by Comet and Halley on the Controller's behalf | France (EU) |
Support tickets are handled inside Kosmly itself, on the infrastructure above. An image model provider will be added here, with 30 days' notice, before Nova launches.
Contact for this agreement: privacy@kosmly.com.