Data Processing Addendum

The Customer is the controller and Keter Labs is the processor for personal data submitted to the Service (including Inputs, Outputs, and end-user account data if the Customer is a business).

Keter Labs will process personal data only on the Customer's documented instructions, including as set out in the Terms and this DPA, and as required by applicable law.

• TLS 1.2+ in transit; AES-256 at rest.
• Role-based access control with least privilege.
• Row-level security on all customer tables.
• Audit logging of privileged actions.
• Vulnerability management and dependency scanning.

Keter Labs uses the following sub-processors to deliver the Service:

We will notify Customers at least 30 days before adding or replacing a sub-processor. Customer may object on reasonable grounds.

For transfers of personal data from the EEA, UK, or Switzerland to third countries without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (2021/914) and the UK IDTA, as applicable.

Keter Labs will assist Customer in responding to data-subject requests and in complying with Articles 32–36 GDPR, taking into account the nature of processing.

Keter Labs will notify Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal-data breach affecting Customer data.

Upon termination, Keter Labs will delete or return all personal data within 30 days, unless storage is required by law.

Data Protection contact: dpo@keterlabs.ai.