Status, parties and roles — Link to section
This Addendum becomes binding only when incorporated into an agreement between the identified business customer and the confirmed Kasai Cloud operator. For Customer Personal Data, the customer acts as controller, or as processor acting on its controller’s authority, and Kasai Cloud acts as processor or subprocessor respectively. Kasai Cloud acts separately for processing for which it determines its own purposes, such as its own account administration and legal obligations, as explained in the Privacy Policy. Mandatory law and applicable transfer clauses prevail over conflicting terms.
Service operator
Kasai Cloud is the service name. The operator’s verified legal identity and contact details will be published here before public launch.
Processing particulars — Link to section
The parties must complete and approve the following particulars, including any restrictions, before processing starts under this Addendum. They are not completed contractual schedules merely because this template is published.
Subject matter and duration
Provision of the agreed cloud-storage service for the agreement’s duration, followed by the agreed return or deletion process and any lawful retention. Record the customer, operator, start date, service scope and termination arrangements.
Nature and purpose
Hosting, organisation, synchronisation, transmission, retrieval, preview, sharing, recovery and deletion of data as instructed through supported features, plus necessary security and support. Document the specific features and processing locations approved for the customer.
Data and people concerned
Customer-uploaded files and metadata may contain personal data about the customer’s staff, clients, suppliers or other people. The customer must identify the actual data categories and data subjects. Special-category or criminal-offence data requires explicit assessment and suitable agreed safeguards; this template does not automatically authorise every sensitive use case.
Documented instructions — Link to section
Kasai Cloud shall process Customer Personal Data only on documented instructions, including instructions on transfers, unless applicable law requires otherwise. In that case, it shall inform the customer before processing unless the law prohibits that notice. The agreement, agreed settings and authorised use of service controls may constitute instructions. Kasai Cloud shall promptly inform the customer if it believes an instruction infringes applicable data-protection law and seek clarification before proceeding with the disputed instruction.
Confidentiality and access — Link to section
People authorised to process Customer Personal Data shall be bound by appropriate confidentiality obligations and receive access only as necessary for their assigned duties. Access shall be restricted and reviewed under the agreed security arrangements. Support access shall be limited to the scope authorised by the customer, without requesting passwords or device credentials.
Technical and organisational measures — Link to section
Kasai Cloud shall implement measures appropriate to the risks of the agreed processing. Before execution, the parties must confirm a security schedule covering access control, secure transmission, credential handling, incident handling, resilience, backup and restoration arrangements, deletion, personnel confidentiality and periodic assessment. The Security & Data Access page describes currently evidenced product controls; it is not a completed audit or certification and does not replace this schedule. Material changes must not reduce the agreed level of protection.
Subprocessors — Link to section
Subprocessors require the customer’s prior specific or general written authorisation. For general authorisation, the agreed schedule must provide advance notice of additions or replacements and sufficient opportunity to object on reasonable data-protection grounds before use. The parties shall address a substantiated objection, including an alternative or termination of affected processing where needed. Kasai Cloud shall impose equivalent data-protection obligations on subprocessors and remain responsible for their performance as required by applicable law. The provider register must be completed before authorisation; its empty state grants no approval.
Assistance with rights and compliance — Link to section
Taking account of the nature of processing and available information, Kasai Cloud shall assist the customer with data-subject requests and obligations relating to security, impact assessments and prior consultation. Requests concerning customer-controlled data shall be referred to the customer without an independent substantive response unless authorised or legally required. The customer remains responsible for lawful instructions, notices and its own decisions as controller.
Personal-data breaches — Link to section
Kasai Cloud shall notify the customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. It shall provide available information on the nature, affected data and people, likely consequences, relevant contact and mitigation measures, with updates as information becomes available. It shall cooperate reasonably with the customer’s response and notification duties. The customer determines its controller notifications, subject to law; this clause does not replace legally applicable deadlines.
Return and deletion — Link to section
At the end of the agreed processing, Kasai Cloud shall, at the customer’s choice, return or delete Customer Personal Data and delete existing copies, unless applicable law requires retention. The parties must agree the export format and retrieval arrangements, active-storage deletion procedure, backup-expiry schedule and any lawful retention before execution. Retained data shall remain protected and used only for the permitted purpose; inaccessible residual backups shall expire under the agreed schedule and any restoration must reapply deletion instructions. Completion information shall be made available on request.
Information and audit rights — Link to section
Kasai Cloud shall make available information necessary to demonstrate compliance with these processing obligations and allow and contribute to audits, including inspections, by the customer or an authorised independent auditor. The parties may agree reasonable notice, confidentiality and security arrangements to protect other customers and operations, without defeating statutory audit rights. No certification or third-party audit report is implied by publication of this template.
International transfers — Link to section
Processing locations and any onward transfers must be identified in the agreed schedules. Transfers requiring safeguards may use applicable adequacy decisions or suitable Standard Contractual Clauses with the correct module, completed annexes and supplementary measures where needed. The parties must assess the actual transfer and applicable law before relying on a mechanism. This template does not itself execute SCCs, choose their governing law or certify that all data remains in the EEA.
Finalising a business agreement — Link to section
Before relying on this Addendum, confirm the legal parties and contacts, processing particulars, security measures, provider authorisations, transfer instruments, retention and return arrangements, and agreement acceptance. Contact legal to discuss a completed agreement. A public version number records this template’s revision, not an executed customer contract.
Contact legal
This contact channel is awaiting confirmation. Verified contact details will be published here before public launch.
Describe your request and the account concerned. Never send your password, device credentials or private files unless a secure, necessary exchange has been agreed.