Data Processing Agreement

A Data Processing Agreement applies whenever Kriyos processes personal data on your instructions — typically when your employees, contractors, or any individuals whose data you manage in the workspace are EU/EEA, Indian, or California residents.

In the absence of a separately signed DPA, the following standard terms apply:

• Kriyos processes personal data only on documented instructions from you (the Data Fiduciary / Business).
• Kriyos does not sub-process personal data to any sub-processor not listed in our Privacy Policy without prior written notice.
• Kriyos implements the technical and organisational measures described in our Security page.
• Kriyos assists you in responding to data subject rights requests to the extent technically possible.
• Kriyos notifies you of a personal data breach within 72 hours of becoming aware.
• Kriyos deletes or returns all personal data upon termination within 30 days of written request.

Enterprise customers who require a countersigned DPA can request one at support@kriyos.co with the subject line "DPA Request". Include your company name, jurisdiction, and any specific requirements. We will respond within 5 business days.

Our current sub-processor list is maintained in the Privacy Policy. We will provide 30 days' prior written notice of any new sub-processors. If you object and we cannot accommodate the concern, you may terminate with a pro-rata refund.

All data is processed in the United States (AWS us-east-1). Transfers from India are lawful under the DPDPA 2023. For EU customers, transfers are governed by Standard Contractual Clauses (SCCs, Module 2) incorporated into the signed enterprise DPA.

For any DPA-related question, contact support@kriyos.co with the subject line "DPA". We respond within 5 business days.