Data processing agreement
This data processing agreement (DPA) forms part of the terms of service between Echo Thirteen Capital Ltd, trading as KENAEZ (the processor), and the customer organisation (the controller). It applies whenever we process personal data on your behalf in providing the Service, and is intended to meet Article 28 of the UK GDPR. If you need a signed copy, email [email protected].
1. Roles and instructions
- You are the controller of the personal data you process through the Service and decide its purposes. We are your processor.
- We process that data only on your documented instructions, which are these terms, this DPA and your configuration and use of the Service, unless the law requires otherwise; if it does, we will tell you first unless the law prevents us.
- We will tell you if we believe an instruction infringes data protection law.
2. Our obligations
- Confidentiality. Everyone we authorise to process the data is bound by confidentiality.
- Security. We maintain appropriate technical and organisational measures, described in our trust centre, including encryption in transit and at rest, mandatory second-factor sign-in, server-side access control by site, and audit logging.
- Assistance. Taking into account the nature of the processing, we help you respond to requests from data subjects, carry out data protection impact assessments and prior consultations, and meet your security obligations. The Service includes tools for this, such as redacted export profiles and a DPIA template for Retrace.
- Breaches. We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations, and keep you updated as we learn more.
- No other use. We do not sell your data, use it for advertising, or use your footage, events or cases to train AI models.
3. Sub-processors
- You authorise us to use the sub-processors listed on our sub-processors page.
- We will give at least 30 days' notice of a new sub-processor by updating that page and emailing your organisation's owners. You may object on reasonable data protection grounds; if we cannot address the objection, you may terminate the affected part of the Service.
- We impose data protection obligations on each sub-processor equivalent to this DPA, and remain responsible for their performance.
- Where you connect your own providers, such as your own AI provider or WhatsApp Business account, those providers act under your own contract with them and are not our sub-processors.
4. International transfers
The Service stores your data in the UK. Where a sub-processor processes it outside the UK, we ensure the transfer is covered by UK adequacy regulations or appropriate safeguards, such as the International Data Transfer Agreement or the Addendum to the EU standard contractual clauses.
5. Deletion and return
Data is deleted on the schedules described in the trust centre and configured by you. When your organisation closes its account, we delete your data 30 days later, giving you time to export it, unless the law requires us to keep it.
6. Audits
We make available the information reasonably needed to demonstrate compliance with this DPA, including written answers to security questionnaires, and allow for audits by you or an auditor you appoint, on reasonable notice, at your cost, no more than once a year unless required by a regulator or following a breach.
Annex 1: Details of the processing
| Subject matter | Provision of the KENAEZ platform and edge node software |
|---|---|
| Duration | The term of your subscription, plus the deletion period above |
| Nature and purpose | Hosting, analysis by AI, storage, search, alerting, reporting and transmission of data, to provide video analytics, Retrace, GPS tracker monitoring, the assistant and remote access as you configure them |
| Data subjects | People and vehicles seen by your cameras; people who carry your GPS trackers, and their emergency contacts; your staff and guests who use the Service; people whose images your operators upload |
| Personal data | Event stills and short clips; live video while being viewed; text descriptions of clothing, carried items and vehicles; number plate reads; GPS positions, alarms and device status; Retrace cases and evidence; assistant conversations; remote access session records; user account and audit data |
| Special category data | None by default. If you switch on apparent demographic attributes after recording a lawful basis, apparent ethnic origin is inferred from images and processed as special category data |
| Not processed | Biometric data for identification: no facial recognition, face or body templates, or image embeddings. Health, disability, gait and religion are never recorded |
Annex 2: Security measures
As described in our trust centre, which we keep up to date.