Data Processing Addendum

Template for review — have qualified counsel review before relying on this.

Last updated: 26 July 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between CC Conceptualise GmbH, Kolonnenstraße 8, 10827 Berlin, Germany (“kanros”, “Processor”) and the customer (“Customer”, “Controller”) for use of the kanros Service (the “Agreement”). It reflects the parties’ obligations under Article 28 of the EU General Data Protection Regulation (GDPR) where kanros processes personal data on the Customer’s behalf. If there is a conflict, this DPA prevails over the Agreement with respect to data protection.

1. Roles of the parties

For personal data contained in traces, telemetry, memory content, and other Customer Data that the Customer submits to the hosted platform, the Customer is the Controller and kanros is the Processor. kanros processes such personal data only on the Customer’s documented instructions, including as set out in the Agreement and this DPA, unless required to do otherwise by EU or Member State law (in which case kanros will inform the Customer unless legally prohibited). For account, billing, and website data, kanros acts as an independent controller as described in our Privacy Policy.

2. Subject matter and details of processing

  • Subject matter: provision of the kanros LLM evaluation and red-teaming platform.
  • Duration: for the term of the Agreement plus any deletion period described below.
  • Nature and purpose: hosting, storage, processing, and transmission of Customer Data to deliver and support the Service.
  • Types of personal data: any personal data the Customer chooses to include in prompts, test data, traces, telemetry, or memory content, plus authorised-user account identifiers.
  • Categories of data subjects: the Customer’s authorised users and any individuals referenced in the Customer Data.

3. Processor obligations

kanros will:

  • process personal data only on the Controller’s documented instructions;
  • ensure that persons authorised to process the data are bound by confidentiality;
  • implement appropriate technical and organisational measures under Art. 32 GDPR (Section 5);
  • assist the Controller, taking into account the nature of processing, in responding to data-subject requests and in meeting its obligations under Art. 32–36 GDPR;
  • make available information necessary to demonstrate compliance and allow for and contribute to audits (Section 7);
  • promptly inform the Controller if, in its opinion, an instruction infringes the GDPR or other data-protection law.

4. Sub-processors

The Controller grants a general authorisation for kanros to engage sub-processors to support the Service. A current list is maintained on our Sub-processors page. kanros imposes data-protection obligations on each sub-processor substantially equivalent to those in this DPA and remains liable for their performance. kanros will give the Controller reasonable notice of intended additions or replacements (via the mechanism described on the Sub-processors page), and the Controller may object on reasonable data-protection grounds.

5. Security measures

kanros maintains technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS) and at rest; logical tenant isolation between customers; role-based access controls and least-privilege administration; audit logging; regular backups; vulnerability management; and secure software development practices. Further detail is on our Security overview. Measures may be updated provided the level of protection is not materially reduced.

6. Personal data breach notification

kanros will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s personal data, and will provide information reasonably available to help the Controller meet its own notification obligations under Art. 33–34 GDPR, including the nature of the breach, likely consequences, and measures taken or proposed.

7. Audits

kanros will make available information necessary to demonstrate compliance with Art. 28 GDPR and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits, and to protection of other customers’ data. Where available, kanros may satisfy audit requests by providing relevant certifications or third-party reports.

8. International transfers and SCCs

kanros processes Customer personal data in the European Union. Where any transfer of personal data to a third country outside the EU/EEA occurs (for example through a sub-processor), it takes place on the basis of an adequacy decision or the European Commission’s Standard Contractual Clauses (SCCs, Commission Implementing Decision (EU) 2021/914), which are incorporated into this DPA by reference, together with any supplementary measures required following a transfer impact assessment. The relevant SCC modules and roles apply according to the parties’ positions described in Section 1.

9. Return and deletion on termination

On termination or expiry of the Agreement, kanros will, at the Controller’s choice, delete or return the Customer Data containing personal data, and delete existing copies within a reasonable period, unless EU or Member State law requires further storage. Backups are deleted in the ordinary course of the backup rotation cycle.

10. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. Except as amended here, the Agreement remains in full force.

11. Contact

Data-protection enquiries and DPA execution: mbrahim@conceptualise.de
CC Conceptualise GmbH, Kolonnenstraße 8, 10827 Berlin, Germany