Data Processing Agreement (Article 28 GDPR)

"GDPR" means Regulation (EU) 2016/679. "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach" and "processing" have the meanings given in the GDPR. "Customer Personal Data" means personal data processed by Kerna on the Controller's behalf under the Agreement. "Agreement" means the terms of service or contract for Kerna, of which this DPA forms part. "Order Form" means a document executed by both parties recording bespoke terms for a custom account; most subscriptions are purchased through the website and have no Order Form. "Sub-processor" means another processor engaged by Kerna within the meaning of Article 28(2) and (4) GDPR. Notices, confirmations and agreements "in writing" or "written" under this DPA may be given by email.

Order of precedence. On data protection matters this DPA prevails over the Agreement. Where an Order Form is executed, it prevails over this DPA to the extent that it expressly varies it; a term of an Order Form that does not expressly address a matter covered here leaves this DPA to govern that matter.

This DPA forms part of the Agreement and takes effect when the Controller accepts the Agreement: for the free plan, on installing the Services or creating an account; for a subscription purchased through the website, on completing the purchase; for a custom account, on execution of the Order Form.

No separate signature is required for an account or subscription obtained without an Order Form: Article 28(9) GDPR requires the contract to be in writing, including in electronic form, and acceptance of the Agreement satisfies that requirement. Kerna records the account and the date of acceptance and keeps every published version of this DPA, so that the version accepted can always be established; for a purchase through the website it also records the version accepted.

The person accepting the Agreement warrants that they are authorised to bind the business, organisation or professional identified as the account holder, and that business, organisation or professional is the Controller for the purposes of this DPA.

Versions. Kerna publishes the current version of this DPA at kerna.io/dpa and gives the administrative contact at least 30 days' prior notice of a material change. A change that is required by law or by a supervisory authority, or that neither reduces the Controller's protection or rights under this DPA nor changes the nature or purposes of the processing or the categories of personal data, may take effect after that notice; the Controller may terminate the affected Services before the effective date without penalty and receive a pro-rata refund of prepaid fees for the unused period. Any other material change requires the Controller's affirmative electronic acceptance; until the Controller accepts it, the version the Controller last accepted continues to apply. Non-material corrections take effect on publication.

Where an Order Form has been executed, the version of this DPA in force at execution applies for the term of that Order Form, and is amended only by agreement between the parties.

Execution on request. A Controller without an Order Form may request a countersigned copy of this DPA and Kerna will provide one on the published terms. For those Controllers the published version applies equally and is not negotiated. Bespoke data protection terms are available only on a custom account under an Order Form.

The Controller is the controller and Kerna is the processor of Customer Personal Data. Kerna processes Customer Personal Data only to provide the Services and only on the Controller's documented instructions. The Agreement, the Controller's subscription, any Order Form and its configuration and use of the Services constitute the Controller's documented instructions; further instructions must be agreed in writing. Kerna informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions (without obligation to give legal advice). The subject matter, duration, nature, purpose, data types and data subjects are set out in Annex I.

• (a) process Customer Personal Data only on the Controller's documented instructions, including as regards transfers, unless required by EU or Member State law - in which case Kerna informs the Controller before processing, unless the law prohibits it;
• (b) ensure that persons authorised to process the data are bound by confidentiality;
• (c) take all security measures required under Article 32 (Annex II);
• (d) engage Sub-processors only under the conditions in clause 5;
• (e) taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures to respond to Data Subject requests (Chapter III);
• (f) assist the Controller in ensuring compliance with Articles 32-36 (security, breach notification, data protection impact assessment, prior consultation);
• (g) at the Controller's choice, delete or return all Customer Personal Data after the end of the Services, and delete existing copies unless storage is required by law;
• (h) make available all information necessary to demonstrate compliance with this clause and allow for and contribute to audits (clause 11).

Kerna implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex II. Key measures include encryption in transit and at rest, transient in-memory processing of email content with no persistence on Kerna's servers, input limits and redaction of payment-card and bank account numbers and certain national identification numbers before transmission to the AI sub-processor, zero-data-retention and contractual no-training terms with that sub-processor, output screening, access controls and pseudonymised analytics. Annex II also sets out where email-derived data is held temporarily, including on the user's own device.

The Controller gives a general written authorisation for Kerna to engage the Sub-processors listed in Annex III, which Kerna keeps current where this DPA is published. Kerna imposes on each Sub-processor, by contract, the same data protection obligations as are set out in this DPA, as required by Article 28(4) GDPR, in particular as regards providing sufficient guarantees to implement appropriate technical and organisational measures. Where a Sub-processor's standard terms do not reproduce an obligation in the same form, Kerna records how the obligation is met in substance. Kerna will give the Controller at least 30 days' prior written notice of any intended addition or replacement of a Sub-processor. The Controller may object on reasonable data-protection grounds within 15 days of receiving that notice. If the parties cannot resolve the objection within a further 30 days, the Controller may terminate the affected Services without penalty and with a pro-rata refund of prepaid fees for the unused period. Until an objection is resolved, Kerna does not use the new Sub-processor to process that Controller's Customer Personal Data; where that is not technically possible, Kerna says so before the change takes effect, and the Controller may terminate the affected Services before that date on the same terms. Kerna remains fully liable to the Controller for each Sub-processor's performance of its obligations.

Where a Sub-processor notifies Kerna of a personal data breach, of a data subject request it has received, of an addition or replacement of its own sub-processors, or of any matter concerning the Standard Contractual Clauses, Kerna forwards that notice to the affected Controller promptly and without undue delay on receipt.

Forwarding is not conditional on Kerna concluding that the matter affects the Controller's data or presents a risk: that assessment belongs to the Controller. Notices are forwarded on receipt rather than after assessment, so that the Controller retains the full time available to it to raise concerns and the full period available to it under Articles 33 and 34. Where a Sub-processor allows objection to its own sub-processors only on terms whose sole remedy is termination, Kerna states that when forwarding.

Taking into account the nature of the processing, Kerna assists the Controller by appropriate technical and organisational measures, insofar as possible, to fulfil the Controller's obligation to respond to Data Subject requests. If Kerna receives a request directly from a Data Subject relating to Customer Personal Data, it will not respond except on the Controller's documented instruction and will promptly forward the request to the Controller.

The account deletion facility described in clause 10 is not an exception to this. Where a user deletes their own account through the Services, Kerna acts on the Controller's documented instruction within the meaning of clause 2, the Controller having authorised that facility by its configuration and use of the Services. Kerna does not act on a Data Subject request received outside the Services without the Controller's instruction.

Kerna notifies the Controller without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provides the information reasonably available to help the Controller meet its obligations under Articles 33 and 34. A breach notified to Kerna by a Sub-processor is additionally forwarded under clause 5a on receipt, without waiting for Kerna's own assessment.

Taking into account the nature of the processing and the information available, Kerna provides reasonable assistance to the Controller with data protection impact assessments and prior consultation with the supervisory authority under Articles 35 and 36.

Kerna's direct disclosures under this DPA are made to the EEA contracting entities listed in Annex III, with one exception: error and performance data sent to Sentry, whose contracting entity, Functional Software, Inc., is established in the United States. The processing chain also includes onward international transfers by certain Sub-processors, including processing of AI content in the United States by OpenAI following disclosure to OpenAI Ireland Limited.

Where a Sub-processor makes an onward transfer, it must apply a valid Chapter V mechanism. Kerna documents the transfer structure, verifies the contractual mechanism and supplementary measures as part of Article 28 due diligence, and makes relevant information available to the Controller. This allocation does not reduce Kerna's obligations as Processor under this DPA.

Email content sent for an AI action is processed in the United States by the AI sub-processor under that arrangement, subject to zero data retention and contractual no-training terms: content sent for an AI action is neither retained nor used to train models. The analysis of that processing, including the assessment of the destination and the supplementary measures applied, is set out in Kerna's Transfer Impact Assessment, which is made available to the Controller on request.

Kerna's transfer to Sentry relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which Sentry is certified, with the Standard Contractual Clauses in Sentry's data processing addendum as the alternative mechanism. Sentry stores this data in its European Union data region (Frankfurt) but may access it from the United States. Onward transfers by other Sub-processors rely on the mechanism each Sub-processor applies, as described in the Transfer Impact Assessment.

Hosting and storage are in the EU: compute on Google Cloud Run in europe-west1 (Belgium) and storage in Firestore in europe-central2 (Warsaw).

The position in clause 9 rests on the establishment of each Sub-processor's contracting entity, which is recorded in Annex III and reviewed on any change. Where a Sub-processor's contracting entity changes, or where Kerna engages another Sub-processor established outside the EEA, an appropriate Chapter V mechanism is put in place before the change takes effect and the Controller is notified under clause 5.

The module used in that event follows Kerna's role: Module Two, controller to processor, where Kerna transfers as controller of its own data; Module Three, processor to processor, where Kerna transfers as processor on the Controller's behalf. The module, version and date of any clauses relied on are recorded in the Transfer Impact Assessment.

This DPA governs only Kerna's processing as processor on the Controller's behalf. Kerna also processes personal data as controller in its own right: account administration (sign-in identity, subscription status and Kerna's communications with account holders), billing, security monitoring, product analytics and its website. Those activities are outside this DPA, are governed by Kerna's privacy policy, and the Controller is not the controller of them. Nothing in this DPA makes Kerna a processor in respect of that processing, and nothing in it makes the Controller responsible for it.

The Controller's switching rights and Kerna's corresponding obligations - notice, transitional period, retrieval period, exportable data categories and formats, assistance and the treatment of switching charges - are set out in Annex IV, which applies as stated there and forms part of the Agreement. Email content is not stored on Kerna's servers and therefore requires no migration; it remains in the Controller's own mail environment throughout.

On expiry or termination of the Services, Kerna deletes or returns Customer Personal Data at the Controller's choice, and deletes existing copies unless retention is required by law. Email content is in any event not stored on Kerna's servers during the Services (transient processing), so this obligation concerns the user settings, configuration and team data described in Annex I. Email-derived data that the Outlook add-in keeps in browser storage on a user's own device expires on the schedule in Annex II; the user's own deletion clears it on the device where it is used.

Two routes

Article 28(3)(g) requires deletion or return at the Controller's choice. It does not prescribe the mechanism, and Kerna performs team deletion on request rather than through a self-service control.

What is retained, and why

Invoices and accounting records. Kerna retains invoices and the accounting records associated with a subscription for the period required by Polish accounting and tax law, irrespective of any deletion. That retention is a legal obligation on Kerna as controller of its own billing records and is outside the scope of this DPA; it is stated here because it is the most common question a deletion prompts.

Backups. Copies held in Firestore point-in-time recovery (7 days) and daily backups (90 days) are not selectively purged and expire on that schedule. A backup may be restored for disaster-recovery purposes. The reconciliation process required by the Data Retention and Deletion Policy is applied after every restore and before the database returns to service, so completed deletions within the restored backup window are re-applied.

Kerna makes available to the Controller the information necessary to demonstrate compliance, including relevant certifications and validations (e.g. CASA Tier 2 for the Gmail add-on), this DPA and its sub-processor list (Annex III), the Transfer Impact Assessment and an extract of the records of processing. Kerna allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates, on reasonable prior notice of not less than 30 days and no more than once per year, during business hours, subject to confidentiality. Where a supervisory authority requires it, after a Personal Data Breach affecting the Controller's data, or where the Controller has credible evidence that Kerna is not complying with this DPA, the Controller may carry out an additional audit, on shorter notice that is reasonable in the circumstances.

Kerna may withhold access where doing so is necessary to protect: the security or personal data of other customers; information subject to legal privilege or a confidentiality obligation owed to a third party; or Kerna's trade secrets, save that trade-secret protection may not be used to defeat the Controller's ability to verify compliance. Where access is withheld, Kerna provides the information needed to verify compliance by other means. An auditor mandated by the Controller must not be a competitor of Kerna and must sign a confidentiality undertaking. The Controller bears the cost of any audit it initiates, other than one following a Personal Data Breach caused by Kerna.

This DPA takes effect with the Agreement and continues for as long as Kerna processes Customer Personal Data. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, save that nothing in the Agreement or this DPA limits or excludes: liability that cannot be limited or excluded by law; liability under Article 82 GDPR towards data subjects; liability for fraud, wilful misconduct or gross negligence; or either party's obligations under applicable data protection law.

This DPA is governed by Polish law and, where applicable, the GDPR. Disputes are subject to the courts competent for Kerna's registered seat, unless the Agreement provides otherwise.

Language. This DPA is executed in Polish and English. Both language versions form part of the executed agreement and may be signed together; the parties are not required to execute the Polish text alone, and a Controller signing the English text is signing the agreement.

If an irreconcilable discrepancy remains, the Polish version prevails for a Controller established (having its registered office or place of business) in Poland and the English version prevails for a Controller established elsewhere. An Order Form may expressly designate the Polish or the English version as prevailing. This rule applies only to resolving discrepancies and does not exclude either version from the Agreement.

This is a rule of interpretation for the residual case, not a statement that either text is outside the agreement. Kerna maintains both versions from a single source and amends them together, so divergence should be rare; where it occurs it is an error to be corrected rather than a choice between two bargains. Translations of this DPA into other languages are provided for information only; they do not form part of the Agreement and do not prevail over either version.

• TLS encryption in transit throughout (TLS 1.3 client to backend; TLS 1.2 or above onward). HSTS enforced.
• AES-256 encryption at rest for all stored data, with Google-managed keys and automatic rotation.
• Email content is processed in memory and never written to Kerna's databases, logs or backups.
• Where email-derived data is held: in persistent storage on Kerna's servers, nothing except the workflow records described below, which contain no email content; in server memory, working copies kept so that a user can return to a result, for about 30 minutes in the Gmail add-on and a few minutes for shared mailboxes, then discarded, or sooner if the server restarts; on the user's own device, in the Outlook add-in's browser storage, results for an email for an hour, reply and compose drafts and triage results for 24 hours, and, for 30 days, unanswered triage items (subject, sender, date and Kerna's short summary) and the identifiers of messages marked done, each removed once it has expired, the next time Kerna opens on that device, and cleared by the user's own deletion on that device; in stored workflow records, such as shared-mailbox status records and the Send to… log, identifiers, status and times only, never the subject or text; in backups, only what the database holds, so no email content.
• Input limits: each action sends only the text it needs, up to a fixed length. Redaction before transmission: payment-card numbers, IBANs and Polish bank account numbers, Polish PESEL numbers and US Social Security numbers, in the formats Kerna recognises, are replaced with placeholders in the email content an action sends, including Inbox Triage subjects and previews and attachments used by Send to… or Reply with attachments. Other personal data, such as names, email addresses, phone numbers and postal addresses, is sent as it appears. Files read with the Attachments feature, so that details such as account numbers can be extracted from them, and text the user writes, such as instructions and drafts, are not redacted.
• Zero data retention and contractual no-training terms at the AI sub-processor: content sent for an AI action is neither retained nor used for training. Verified in the sub-processor platform, which records that logs cannot be saved on a zero-data-retention project.
• Output screening for leaked secrets.
• Authentication by verified Google and Microsoft identity tokens with audience, issuer, expiry and algorithm pinning enforced, and per-user document path isolation scoped to the verified account identifier.
• Per-user rate limiting on AI actions. Helmet security headers; restrictive CSP and CORS; input injection screening.
• Pseudonymised analytics (HMAC-SHA256 with a server-side pepper); 90-day analytics retention.
• Administrative endpoints are protected by an allow-list and a constant-time API key in addition to a valid user token and fail closed in production. Least-privilege permissions for service accounts are under review; the current position is recorded in Kerna's Information Security Policy, available to the Controller on request.
• Cloud Audit Logs for all administrative actions; immutable, attributable Cloud Run revisions.
• EU-region hosting and storage: Cloud Run europe-west1 (Belgium); Firestore europe-central2 (Warsaw).
• Firestore point-in-time recovery (7 days) and daily backups (90-day retention).
• CASA Tier 2 validation for the Gmail add-on.

Control operation. Reissuable secrets follow the rotation schedule in the Information Security Policy, with immediate rotation on suspected compromise. Per-user rate limiting is enforced through a shared store across service instances. Control evidence is retained under the Documentation Register.

This list is kept current where this DPA is published, at kerna.io/dpa, and changes are notified under clause 5. As at the date of this version:

Google Analytics, Brevo and Stripe, also named in Kerna's privacy policy, serve Kerna's website, the emails Kerna sends to its users and Kerna's own billing, which Kerna carries out as controller (clause 9b). They are not Sub-processors under this DPA.

This Annex applies to the Services whether or not Regulation (EU) 2023/2854 (the Data Act) applies to them. Kerna applies Chapter VI of the Data Act to the Services as a contractual baseline: if a competent authority finds that the Services fall outside it, the Controller keeps the rights in this Annex unless the parties expressly agree otherwise.

Starting a switch. The Controller may at any time ask to switch to another provider or to its own infrastructure, or to have its exportable data erased, by writing to privacy@kerna.io. The switch or erasure starts on the date Kerna receives the request or on a later date, no more than two months after receipt, that the Controller names (in either case, the start date). The deadline for an erasure-only request is set under "Erasure".

Transitional period. Kerna completes the switch within a transitional period of 30 calendar days from the start date. The Agreement stays in force during that period: Kerna keeps providing the Services, gives reasonable assistance to the Controller and to any provider it has chosen, points out known risks to continuity, and maintains a high level of security throughout the switch, including while data are transferred and during the retrieval period. If 30 days is technically unfeasible, Kerna tells the Controller within 14 working days of the request, explains why, and sets an alternative period of no more than seven months, during which the same obligations apply. The Controller may extend the transitional period once, for a period it considers more appropriate.

Retrieval period. The Controller has at least 30 calendar days after the transitional period ends to retrieve its exportable data.

Exportable data and digital assets. The table below is the exhaustive list of the data and digital assets that can be exported. Kerna provides the export on request, by secure download link, in the formats shown; the Services have no self-service export. Kerna updates this list before the Services begin to hold a new category of the Controller's data. Kerna claims no trade-secret exemption over any category.

Erasure. Once the switch has been completed, Kerna erases the exportable data within 30 days after the end of the retrieval period or a later date agreed with the Controller, subject only to retention required by law (clause 10). Where the Controller has asked only for erasure, Kerna erases the exportable data within 30 days of the start date, the same deadline as for team account deletion under clause 10, and confirms the erasure in writing. The Agreement is deemed terminated, and Kerna notifies the Controller of the termination, on successful completion of the switch or, for an erasure-only request, on the start date. Termination on completion of a switch does not end the retrieval period: the Controller can still retrieve its exportable data until that period ends, the security obligations under "Transitional period" continue until then, and the 30-day erasure deadline runs only from the end of that period or any later date agreed with the Controller. Copies in backups expire as set out in clause 10.

Charges. Kerna charges nothing for switching or for exporting data.

No obstacles. Kerna puts no pre-commercial, commercial, technical, contractual or organisational obstacle in the way of a switch.

Infrastructure and governmental access. Kerna's hosting and storage infrastructure is located in the European Union; AI processing by OpenAI and access by Sentry take place in the United States (clause 9 and Annex III). The measures in Annex II protect non-personal data in the Services against unlawful access, including international governmental access that would conflict with Union or Member State law, in the same way as personal data.