Kanbrio Data Processing Agreement

Version 1.0 · Effective 29 September 2026

Published at: https://kanbrio.com/dpaProvider: [to be confirmed] (ABN [to be confirmed]), trading as Kanbrio, of [to be confirmed]Contacts: [email protected] (data protection) · [email protected] (contract notices)

1. About this agreement

1.1 Parties. This Data Processing Agreement ("DPA") is between [to be confirmed] (ABN [to be confirmed]), trading as Kanbrio ("Kanbrio", "we", "us"), and the customer that has agreed to the Kanbrio Terms of Service ("Customer", "you").

1.2 How it applies. This DPA forms part of, and is incorporated into, the Kanbrio Terms of Service or any other written agreement between you and Kanbrio for the Service (the "Agreement"). It applies automatically whenever Kanbrio processes Customer Personal Data in providing the Service. You do not need to sign anything for it to apply. If you need a signed copy for your records, email [email protected] and we will send a countersigned copy of this version.

1.3 Why it exists. This DPA sets out the terms required by Article 28 of the GDPR and the UK GDPR, the service-provider terms required by the California Consumer Privacy Act and similar US state laws, and the commitments Kanbrio makes about handling personal information under the Australian Privacy Principles.

1.4 Order of precedence. If there is a conflict, the following order applies, highest first: (a) the Standard Contractual Clauses and the UK Addendum, where they apply (section 9); (b) this DPA; (c) the rest of the Agreement. Nothing in the Agreement limits the Standard Contractual Clauses or your rights under them.

2. Definitions

In this DPA, the following words have these meanings. Other capitalised words have the meaning given in the Agreement.

• Agent means an automated software agent (for example, an AI coding assistant) that the Customer connects to its Kanbrio organisation as a member with the "agent" role, and that acts through the Kanbrio API or MCP server using credentials Kanbrio issues to the Customer.
• Applicable Data Protection Law means every law on privacy and data protection that applies to the processing of Customer Personal Data under the Agreement, including, where applicable: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"); and the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws.
• Customer Data means all data, content and files that the Customer, its Users or its Agents submit to, or create in, the Customer's Kanbrio organisation.
• Customer Personal Data means the personal data (or personal information) within Customer Data that Kanbrio processes on behalf of the Customer.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data held by Kanbrio or a Sub-processor.
• Restricted Transfer means a transfer of Customer Personal Data that would be prohibited under the GDPR, UK GDPR or FADP without a transfer safeguard.
• Service means the hosted Kanbrio service at app.kanbrio.com, api.kanbrio.com (including the MCP server at api.kanbrio.com/mcp) and auth.kanbrio.com, and its related features, as described in the Agreement.
• Standard Contractual Clauses or SCCs means the standard contractual clauses for transfers of personal data to third countries set out in the Annex to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• Sub-processor means a third party that Kanbrio engages to process Customer Personal Data on the Customer's behalf.
• UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.
• User means a person the Customer allows to use its Kanbrio organisation, including owners, administrators, members and guests.
• controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR. Where another law uses an equivalent term (for example "business", "service provider" or "personal information"), the equivalent term applies.

3. Roles and scope

3.1 Customer as controller, Kanbrio as processor. For Customer Personal Data, the Customer is the controller and Kanbrio is the processor. Under the CCPA, the Customer is the "business" and Kanbrio is the "service provider".

3.2 Customer as processor. If the Customer is itself processing Customer Personal Data on behalf of another controller (for example, an agency managing client projects in Kanbrio), the Customer is a processor and Kanbrio is its sub-processor. The Customer confirms that its controller has authorised Kanbrio's appointment and the instructions in this DPA. The Customer remains the single point of contact for Kanbrio; Kanbrio will not deal directly with the Customer's controller unless the law requires it.

3.3 Kanbrio's own data. Kanbrio is an independent controller, not a processor, for the personal data it needs to run its own business. Section 16 describes this data. The Kanbrio Privacy Policy at kanbrio.com/privacy covers it, not this DPA.

3.4 Details of processing. Annex I describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

3.5 Transfers the Customer chooses. Some features send data to destinations that the Customer chooses and controls, not Kanbrio. These include:

• automation webhooks the Customer configures;
• external MCP servers the Customer connects through Kanbrio's outbound MCP client;
• the Customer's own git host, when the Customer points the coding executor at a repository;
• AI agents and AI providers that the Customer connects to Kanbrio; and
• the Customer's own AI provider account, when the Customer supplies its own API key (section 17.3).

Those recipients are not Kanbrio Sub-processors. When Kanbrio sends data to them, it does so on the Customer's documented instruction under section 4. The Customer is responsible for having a lawful basis and any transfer safeguard needed for that recipient.

4. Processing only on the Customer's instructions

4.1 Documented instructions. Kanbrio will process Customer Personal Data only on the Customer's documented instructions, including for transfers to a third country. The Customer's complete instructions at the effective date are:

(a) the Agreement and this DPA; (b) the Customer's use and configuration of the Service, including the settings chosen by its Users and the actions of its Agents acting within the permissions the Customer grants them; and (c) any other reasonable written instruction the Customer gives and Kanbrio accepts in writing.

4.2 Exception for legal requirements. Kanbrio may process Customer Personal Data other than on the Customer's instructions only where a law that applies to Kanbrio requires it. In that case Kanbrio will tell the Customer about the legal requirement before processing, unless that law prohibits telling the Customer on important grounds of public interest.

4.3 Unlawful instructions. Kanbrio will tell the Customer promptly if, in its opinion, an instruction infringes Applicable Data Protection Law. Kanbrio may suspend the processing affected by that instruction until the Customer confirms or changes it. Kanbrio is not required to check every instruction for legal compliance.

4.4 No other use. Kanbrio will not:

(a) sell or share Customer Personal Data (as "sell" and "share" are defined in the CCPA); (b) use Customer Personal Data for advertising, profiling for marketing, or building profiles of people; (c) use Customer Data or Customer Personal Data to train, fine-tune or improve any AI model; or (d) combine Customer Personal Data with personal data Kanbrio receives from other sources, except as needed to provide the Service (for example, linking a User's workspace activity to their sign-in account) or as the CCPA otherwise permits.

5. The Customer's responsibilities

5.1 Lawful basis and notices. The Customer is responsible for having a lawful basis for the processing it instructs, for giving any notices required by law to the people whose data it puts into Kanbrio, and for obtaining any consent that is required.

5.2 Accuracy and minimisation. The Customer decides what data goes into Kanbrio and is responsible for its accuracy and for not putting in more personal data than it needs.

5.3 Sensitive data. Kanbrio is a work-management tool and is not designed to hold special-category data (such as health, biometric or genetic data, or data about racial or ethnic origin, political opinions, religious beliefs, trade union membership or sex life), criminal records, government identifiers or payment card numbers. The Customer must not put this kind of data into Kanbrio unless Kanbrio has agreed in writing.

5.4 Credentials and Agents. The Customer is responsible for:

(a) the credentials of its Users and Agents, including the agent API keys Kanbrio issues to it, keeping them secret and revoking them promptly if they may have been exposed; (b) the instructions it gives its Agents and the permissions it grants them; and (c) reviewing AI-generated output, including code produced by the coding executor, before relying on it.

5.5 Customer security settings. The Customer is responsible for the security measures that are within its control, such as choosing who has access to its organisation and at what role, and removing Users who no longer need access.

6. Confidentiality

6.1 Kanbrio will ensure that every person it authorises to process Customer Personal Data (including its staff and contractors) is bound by a duty of confidentiality, whether under a written agreement or by law.

6.2 Kanbrio limits access to Customer Personal Data to the people who need it to provide, support or secure the Service. As at the effective date, the only person with administrative access to the production systems is Kanbrio's founder. [to be confirmed]

7. Security

7.1 Measures. Kanbrio will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risk to people's rights and freedoms, as required by Article 32 of the GDPR. The measures are described in Annex II.

7.2 Honest status. Annex II marks each measure as either in place or being implemented. For each measure being implemented, Annex II states what Kanbrio does in the meantime. Kanbrio will not describe a measure as in place unless it is.

7.3 Changes. Kanbrio may update its security measures as technology and threats change, provided the update does not reduce the overall level of protection for Customer Personal Data. Kanbrio will keep Annex II (and the security page at kanbrio.com/security) up to date.

8. Sub-processors

8.1 General authorisation. The Customer gives Kanbrio general written authorisation to engage Sub-processors. The Sub-processors in use at the effective date are listed in Annex III. The current list is always published at https://kanbrio.com/subprocessors.

8.2 Sub-processor terms. Before a Sub-processor processes Customer Personal Data, Kanbrio will put in place a written contract with it that imposes data protection obligations no less protective than those in this DPA, to the extent they apply to the services that Sub-processor provides. Kanbrio remains fully liable to the Customer for the performance of each Sub-processor's obligations.

8.3 Notice of changes. Kanbrio will give at least 30 days' notice before it adds or replaces a Sub-processor. Notice is given by email to the owners and administrators of each Customer organisation, and by updating the list at kanbrio.com/subprocessors. Anyone else the Customer names (for example its privacy or procurement team) can ask to receive these notices by emailing [email protected]. This notice applies to a future move of Kanbrio's hosting to a hosting provider: that provider will be added as a Sub-processor under this section before any Customer Personal Data is moved to it.

8.4 Emergency replacement. If Kanbrio must replace a Sub-processor urgently for reasons outside its control (for example, because the Sub-processor stops providing its service or a security risk requires it), Kanbrio will give notice as soon as it reasonably can. The Customer's right to object under section 8.5 still applies, and runs from the date of that notice.

8.5 Right to object. The Customer may object to a new or replacement Sub-processor on reasonable data-protection grounds by emailing [email protected] within the notice period. Kanbrio will then work with the Customer in good faith to address the objection, for example by explaining the safeguards in place or by offering a way to use the Service without that Sub-processor. If the parties cannot resolve the objection within 30 days of it being made, the Customer may terminate the affected part of the Service by written notice. Kanbrio will then refund any fees the Customer has prepaid for the period after termination, on a pro-rata basis.

9. International transfers

9.1 Where data is held. Kanbrio stores Customer Personal Data on servers it operates in Australia and keeps backups in Australia. Annex III shows where each Sub-processor processes data, including in the United States and on Cloudflare's worldwide network.

9.2 Transfers under this DPA. Kanbrio will make, and allow its Sub-processors to make, a Restricted Transfer only where a safeguard recognised by Applicable Data Protection Law is in place. Where the Customer is in the EU or EEA, or is otherwise subject to the GDPR for the relevant processing, and transfers Customer Personal Data to Kanbrio, the SCCs are incorporated into this DPA by reference and apply as follows:

(a) Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor. (b) The Customer is the data exporter and Kanbrio is the data importer. (c) Clause 7 (docking clause) is included. (d) Clause 9(a): Option 2 (general written authorisation) applies, with the notice period set out in section 8.3 of this DPA. (e) Clause 11(a): the optional language is not included. (f) Clause 13: the competent supervisory authority is the one determined under Clause 13(a) of the SCCs. Where the Customer is not established in the EU but is subject to the GDPR under Article 3(2), it is the supervisory authority of the member state where the Customer's EU representative is established or, if the Customer has none, the Irish Data Protection Commission. (g) Clause 17: the SCCs are governed by the law of Ireland. (h) Clause 18(b): disputes are resolved before the courts of Ireland. (i) Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA. (j) Where Module Three applies, Kanbrio may send any notice it must give to the controller under the SCCs to the Customer, and the Customer will pass it on.

9.3 Transfers from the United Kingdom. Where UK GDPR applies to a transfer to Kanbrio, the SCCs as set out in section 9.2 apply as varied by the UK Addendum, and the UK Addendum is incorporated into this DPA by reference. For the UK Addendum: Table 1 is completed by Annex I of this DPA; Table 2 uses the modules and options selected in section 9.2; Table 3 is completed by Annexes I, II and III of this DPA; and for Table 4, neither party may end the UK Addendum under its Section 19.

9.4 Transfers from Switzerland. Where the FADP applies, the SCCs apply with these changes: references to the GDPR include the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; references to "member state" do not prevent data subjects in Switzerland from bringing claims where they usually live; and Swiss law governs to the extent the FADP requires.

9.5 Onward transfers. Where a Sub-processor processes Customer Personal Data in a country without an adequacy decision, Kanbrio relies on a recognised safeguard with that Sub-processor: its participation in the EU-US Data Privacy Framework (and UK Extension and Swiss framework) where it is certified, or the SCCs (Module Three) and UK Addendum in its data processing terms.

9.6 New transfer tools. If the European Commission or the UK authorities adopt new or replacement transfer clauses (including clauses designed for importers that are themselves subject to the GDPR), Kanbrio may adopt them by notice to the Customer, and they will replace the clauses in this section 9 to the extent they apply.

9.7 Transfer impact assessment. Annex IV summarises Kanbrio's assessment of the laws of the countries data is transferred to. Kanbrio will update it if those laws or its practices change in a way that affects it.

9.8 Requests from public authorities. If a public authority asks Kanbrio for Customer Personal Data, Kanbrio will:

(a) refer the authority to the Customer where it can; (b) tell the Customer about the request promptly, unless the law prohibits it, and if it is prohibited, use reasonable efforts to get the prohibition lifted; (c) review whether the request is lawful and challenge it where there are reasonable grounds to do so; (d) disclose only the minimum data needed to comply with the request; and (e) keep a record of the request and its response.

9.9 Australian privacy law. Kanbrio will handle Customer Personal Data in a way consistent with the APPs, whether or not it is legally bound by them. This includes APP 8 on overseas disclosures and APP 11 on security.

10. Helping the Customer respond to people's requests

10.1 Tools in the Service. Taking into account the nature of the processing, Kanbrio will help the Customer, by appropriate technical and organisational measures and as far as possible, to respond to requests from people exercising their rights under Applicable Data Protection Law (such as access, correction, erasure, restriction, portability and objection). The Service lets the Customer:

(a) view, edit and delete cards, comments, attachments, time entries and other content; (b) change Users' roles and remove Users and Agents from its organisation; and (c) as an organisation owner or administrator, request erasure of a person's personal data from the organisation through the Kanbrio API (erasure.request). Erasure through the API is being implemented; meanwhile Kanbrio completes erasure manually within 30 days of a request to [email protected]. Agents cannot request erasure.

10.2 What the tools do not yet cover. Some Customer requests cannot yet be completed with the tools alone. At the effective date these are: exporting the whole organisation's data; permanently removing items that were deleted in the product (see section 13.1); and erasing personal data from some fields that the erasure function does not yet reach. Until the tools cover them, Kanbrio will complete these steps manually within 30 days of the Customer's request to [email protected], at no extra charge.

10.3 Requests received by Kanbrio. If Kanbrio receives a request from a person about Customer Personal Data, Kanbrio will not respond to it directly, except to tell the person to contact the Customer. Where Kanbrio can identify the Customer, it will pass the request to the Customer promptly, and in any case within 5 business days.

10.4 Audit records. The Customer acknowledges that Kanbrio's security audit log is append-only and tamper-evident, and cannot be edited or erased in part (Annex II, item 5). Before free text is written to the audit log, it is automatically removed and replaced with "[redacted]". The audit log therefore holds identifiers, action names, outcomes and timestamps, but no names, email addresses or content. When a person's data is erased, their identifier in the audit log is kept, but once their sign-in account is deleted it can no longer be linked to them from Kanbrio's records. Audit records are kept for the period in Annex I for security, accountability and legal-claim purposes (see GDPR Article 17(3)(b) and (e)). The Customer is responsible for explaining this in its own notices where needed.

11. Helping the Customer with security, impact assessments and regulators

Taking into account the nature of the processing and the information available to Kanbrio, Kanbrio will give the Customer reasonable help to meet its obligations under Articles 32 to 36 of the GDPR (and the equivalent provisions of other Applicable Data Protection Law), including:

(a) security of processing, by maintaining the measures in Annex II; (b) notifying and communicating Personal Data Breaches, under section 12; (c) data protection impact assessments, by providing the information in this DPA, its Annexes and the security page, and by answering reasonable questions about the Service; and (d) consultations with supervisory authorities, by providing information Kanbrio holds that the Customer reasonably needs.

If the Customer's request needs significant work beyond providing existing documentation, Kanbrio may charge a reasonable fee, which it will agree with the Customer in advance.

12. Personal Data Breaches

12.1 Notice. Kanbrio will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer's Customer Personal Data. Kanbrio will send the notice by email to the owners of the Customer's organisation.

12.2 Contents. The notice will include, as far as Kanbrio knows at the time:

(a) the nature of the breach, including the categories and approximate number of people and records affected; (b) the likely consequences; (c) the measures Kanbrio has taken or proposes to take to deal with the breach and reduce its effects; and (d) a contact point for more information.

Where Kanbrio cannot give all of this information at once, it will give it in stages without further undue delay.

12.3 Action. Kanbrio will take reasonable steps to contain, investigate and reduce the effects of the breach, and will keep the Customer informed of material developments.

12.4 Customer notifications. The Customer is responsible for notifying supervisory authorities and affected people where the law requires it of the controller, unless the law places that duty on Kanbrio. Kanbrio will give the Customer reasonable help to do so, including for an assessment under Australia's Notifiable Data Breaches scheme.

12.5 Unsuccessful attempts. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as blocked login attempts, port scans or denial-of-service attempts that do not lead to unauthorised access) are not Personal Data Breaches.

12.6 No admission. Notifying or responding to a Personal Data Breach is not an admission of fault or liability by Kanbrio.

13. Deletion and return of data

13.1 During the Agreement. The Customer can delete its data in the Service at any time. When an item is deleted in the product, Kanbrio first marks it as deleted so it disappears from the Service and can be restored if deleted by mistake. At the effective date the Service does not automatically purge these deleted items during the Agreement. If the Customer wants specific deleted items permanently removed before the Agreement ends, it can ask at [email protected] and Kanbrio will remove them within 30 days.

13.2 Export window after the Agreement ends. For 30 days after the Agreement ends, the Customer may ask for a copy of its Customer Data by emailing [email protected]. Kanbrio will provide it in a commonly used, machine-readable format (such as JSON or CSV, with attachments as the original files) within 30 days of the request. Until a self-service export is available in the Service, Kanbrio will prepare the export manually at no extra charge.

13.3 Deletion. Within 30 days after the export window ends, Kanbrio will delete the Customer's Customer Personal Data from its production systems, including sign-in accounts that exist only for that Customer's organisation. The Customer may ask Kanbrio to delete its data sooner. Deleted data will remain in Kanbrio's encrypted or access-restricted backups until those backups are overwritten, which happens within 90 days after deletion from production. Kanbrio will not restore data from backups for any purpose other than recovering the Service from an incident, and if it must restore a backup, it will delete the Customer's data again.

13.4 What is kept. Kanbrio may keep:

(a) security audit records, as described in section 10.4 and Annex I; (b) records Kanbrio keeps as a controller for its own business, such as billing records (section 16); (c) data that a law requires Kanbrio to keep, or that is subject to a legal hold, for as long as that law or hold requires.

Kanbrio will keep any retained data confidential, protect it under this DPA, and process it only for the purpose that requires it to be kept.

13.5 Confirmation. On request, Kanbrio will confirm in writing that it has deleted the Customer's data as described in this section.

14. Information and audits

14.1 Information. Kanbrio will make available to the Customer the information reasonably necessary to show that it is meeting its obligations under this DPA and Article 28 of the GDPR. This includes this DPA and its Annexes, the security page at kanbrio.com/security, and written answers to a reasonable security questionnaire (once every 12 months, or more often after a Personal Data Breach).

14.2 Audits. If the Customer reasonably believes the information in section 14.1 is not enough to show compliance, or a supervisory authority requires it, the Customer (or an independent auditor it appoints that is bound by confidentiality and is not a competitor of Kanbrio) may audit Kanbrio's compliance with this DPA, on these terms:

(a) the Customer gives at least 30 days' written notice to [email protected], with a proposed scope; (b) audits take place no more than once in any 12 months, unless there has been a Personal Data Breach affecting the Customer or a supervisory authority requires another audit; (c) audits are done remotely by default (document review, interviews and demonstrations), during business hours in Queensland, Australia, and in a way that does not unreasonably disrupt the Service; (d) because Kanbrio's servers hold the data of other customers, an audit will not include access to other customers' data, and any site visit will be limited to what is needed and agreed in advance; (e) each party bears its own costs, except that the Customer pays Kanbrio's reasonable costs for time spent supporting an audit beyond two business days per year; and (f) the Customer gives Kanbrio a copy of any audit report, and treats the findings as Kanbrio's confidential information.

14.3 SCCs. Nothing in this section 14 limits the audit rights of the Customer or a supervisory authority under the SCCs. Where the SCCs apply, this section describes how those rights will be exercised.

15. US state privacy law terms

Where the CCPA or another US state privacy law applies to Customer Personal Data, Kanbrio, as a service provider:

(a) processes Customer Personal Data only for the limited and specified business purpose of providing the Service under the Agreement, as described in Annex I; (b) will not sell or share Customer Personal Data; (c) will not retain, use or disclose Customer Personal Data for any purpose (including a commercial purpose) other than the business purpose in paragraph (a), or outside the direct business relationship between Kanbrio and the Customer, except as the CCPA permits; (d) will not combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with a consumer, except as the CCPA permits; (e) will comply with the obligations that apply to it under the CCPA and give Customer Personal Data the same level of privacy protection the CCPA requires of the Customer; (f) grants the Customer the right to take reasonable and appropriate steps to ensure that Kanbrio uses Customer Personal Data in a way consistent with the Customer's obligations under the CCPA, through the information and audit rights in section 14; (g) will notify the Customer if it decides it can no longer meet its obligations under the CCPA, and grants the Customer the right, on notice, to take reasonable and appropriate steps to stop and remedy unauthorised use of Customer Personal Data; and (h) will pass the Customer's CCPA obligations on to its Sub-processors through the contracts described in section 8.2.

Kanbrio certifies that it understands and will comply with the restrictions in this section.

16. Kanbrio as an independent controller

16.1 Kanbrio processes some personal data as a controller for its own purposes, not on the Customer's behalf. This is:

(a) account and sign-in data (the User's name, email address, password hash and sign-in sessions, held in Kanbrio's sign-in service at auth.kanbrio.com); (b) billing and subscription data, including the details PayPal sends Kanbrio about the payer (PayPal is itself an independent controller of the payment data it collects); (c) support and other correspondence with Kanbrio; (d) security, abuse-prevention and operational data, including service logs, request metrics and the security audit records described in section 10.4; and (e) aggregated usage data that does not identify any person or reveal Customer Data content, used to run, secure and improve the Service.

16.2 Kanbrio handles this data as described in its Privacy Policy at kanbrio.com/privacy. Kanbrio will not use Customer Data content (such as card text, comments or files) for these purposes, except as needed to investigate a security incident, abuse or a support request the Customer has raised.

17. AI features and Agents

17.1 Optional. The Service's AI features are optional. A Customer that does not connect Agents or use the coding executor does not send Customer Data to any AI provider through Kanbrio.

17.2 The coding executor. When the Customer dispatches a coding task, Kanbrio's executor (hosted by DigitalOcean in Sydney) clones the repository the Customer names. It sends the task title and instructions and relevant file contents (at most 24,000 characters in total and 8,000 characters per file) to Anthropic to generate a proposed change. It then checks that change in an isolated sandbox with no network access and no credentials, and returns it for a human to review. A proposed change is not merged until a human accepts it.

17.3 The Customer's own AI key. If the Customer stores its own Anthropic API key in Kanbrio, the executor uses that key. The key is encrypted at rest and only its last four characters are shown. When the Customer's own key is used, Anthropic processes the request under the Customer's own agreement with Anthropic, and the transfer is a customer-directed transfer under section 3.5.

17.4 Agents. Agents that the Customer connects act only with the role and permissions the Customer grants. Kanbrio labels every Agent as an agent in the Service and records actor_kind=agent on every audit record an Agent creates. Destructive actions requested by an Agent are held as suggestions until a human approves them; Agents cannot approve their own suggestions. Owners and administrators can pause and cancel an Agent's work; an Agent stops at its next safe point rather than instantly. Pause and cancel are being implemented; meanwhile an Agent is stopped by revoking its credentials.

17.5 Search and usage records. Semantic search in the Service computes its embeddings on Kanbrio's own servers; no text is sent to a third party for search. Kanbrio's AI usage ledger records the model used, token counts, cost and timing of each AI call, but not the prompts or responses. The ledger is being implemented; meanwhile no hosted AI call is charged in Credits.

17.6 No training. Kanbrio does not use Customer Data to train AI models. Kanbrio's contract with Anthropic does not allow Anthropic to train its models on data sent through Kanbrio's API account, and Anthropic deletes that data within 30 days, except where it must keep it longer to enforce its usage policies or meet legal obligations.

18. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement. Those limitations do not apply to the extent Applicable Data Protection Law or the SCCs do not allow them, including a party's liability to data subjects under Clause 12 of the SCCs.

19. Term, changes and general terms

19.1 Term. This DPA applies for as long as Kanbrio processes Customer Personal Data, including after the Agreement ends until the data is deleted under section 13.

19.2 Changes. Kanbrio may update this DPA by publishing a new version at kanbrio.com/dpa. For a material change, Kanbrio will give the owners of each Customer organisation at least 30 days' notice by email and in the Service. A change will not reduce the protection this DPA gives Customer Personal Data unless the law requires it. If a material change adversely affects the Customer, the Customer may terminate the Agreement before the change takes effect by written notice, and Kanbrio will refund any fees prepaid for the period after termination, on a pro-rata basis. Each version shows its number, effective date and a change log.

19.3 Governing law. This DPA is governed by the law of Queensland, Australia, and the parties submit to the non-exclusive jurisdiction of the courts of Queensland, except that the SCCs and the UK Addendum are governed by the law and courts set out in section 9, and mandatory data protection and consumer laws that apply to the Customer are not affected.

19.4 Notices. Notices to Kanbrio under this DPA go to [email protected] (for data protection matters) or [email protected] (for contract notices, including audit requests and objections that lead to termination). Notices to the Customer go to the email addresses of the owners of its Kanbrio organisation.

19.5 EU and UK representatives. At the effective date Kanbrio has not appointed a representative in the EU or the UK under Article 27 of the GDPR or UK GDPR. When it does, it will publish the representative's details at kanbrio.com/privacy.

19.6 Severability. If a provision of this DPA is invalid or unenforceable, the rest of the DPA continues in effect, and the invalid provision is replaced by a valid one that comes as close as possible to the parties' intent.

Annex I: Description of the processing

A. List of parties

B. Description of the transfer and processing

Categories of data subjects

• Users of the Customer's organisation: owners, administrators, members and guests.
• People who operate or are responsible for the Customer's Agents.
• People the Customer invites to its organisation.
• People named or described in Customer Data, such as the Customer's own clients, contacts and colleagues who are mentioned in cards, comments, files or imported data.

Categories of personal data

Sensitive data. None is intended. The Customer must not submit special-category data or other sensitive data without Kanbrio's written agreement (section 5.3). If sensitive data is submitted anyway, the measures in Annex II apply to it.

Frequency of transfer. Continuous, for as long as the Customer uses the Service.

Nature of the processing. Hosting, storing, organising, displaying, searching, indexing, backing up, transmitting (including by email notification), recording in the audit log, and deleting Customer Personal Data; and sending it to Sub-processors and to customer-chosen destinations as the Customer instructs.

Purpose of the processing. To provide, secure and support the Service for the Customer under the Agreement, including running the Customer's Agents, automations, integrations and coding tasks.

Retention

Transfers to Sub-processors. See Annex III for the subject matter, nature and duration of processing by each Sub-processor. Each processes Customer Personal Data only for the duration of the Agreement and the deletion period in section 13, and only for the purpose shown.

C. Competent supervisory authority

As set out in section 9.2(f).

Annex II: Technical and organisational security measures

Each measure is marked In place or Being implemented. For a measure being implemented, the "Meanwhile" note says what Kanbrio does until it is finished.

Annex III: Sub-processors

This is the list at the effective date. The current list, which governs, is at https://kanbrio.com/subprocessors.

Not Sub-processors, listed for transparency:

• PayPal processes payments as an independent controller under its own privacy statement. It receives billing details, not Customer Data.
• Destinations chosen by the Customer (webhooks, external MCP servers, git hosts, the Customer's own AI providers and Agents) are described in section 3.5.
• Kanbrio's own servers and backup device in Australia are operated by Kanbrio itself.

If Kanbrio adds a crypto payment option or a hosting provider, it will add any that process Customer Personal Data to this list with 30 days' notice under section 8.3.

Annex IV: Transfer impact assessment (summary)

This summary supports the SCCs and UK Addendum in section 9. It reflects Kanbrio's assessment at the effective date.

1. What is transferred and where. Customer Personal Data described in Annex I is transferred from the Customer to Kanbrio in Australia, and onward to Cloudflare (worldwide), DigitalOcean (Australia), Twilio SendGrid (United States), Anthropic (United States) and, for email sent to Kanbrio, [to be confirmed] ([to be confirmed]). The transfers are continuous. Most of the data is ordinary business data about Users at work. Special-category data is not intended (section 5.3).

2. Australia. Australian law allows government agencies to require access to data in some circumstances. The main powers are warrants and notices under the Telecommunications (Interception and Access) Act 1979, the technical assistance regime added to the Telecommunications Act 1997 in 2018, and data disruption and account takeover warrants added in 2021. These powers generally need a warrant or a formal notice, are limited to serious offences or national security, and are overseen by bodies such as the Commonwealth Ombudsman and the Inspector-General of Intelligence and Security. Individuals have enforceable rights under the Privacy Act 1988, including complaint to the Office of the Australian Information Commissioner. Kanbrio is a small business providing work-management software. It is not a telecommunications carrier and does not expect to be a target of these powers.

3. United States. Twilio SendGrid and Anthropic process data in the United States, where US intelligence laws (such as FISA section 702 and Executive Order 12333) may apply to some providers. Executive Order 14086 added limits and a redress mechanism for EU, UK and Swiss individuals. Kanbrio relies on each provider's EU-US Data Privacy Framework certification where it has one, and otherwise on the SCCs in its data processing terms. The data these providers receive is limited: email addresses and notification text for SendGrid, and code and task titles and instructions for Anthropic, which Anthropic deletes within 30 days.

4. Cloudflare. Cloudflare processes traffic at the data centre nearest the User. Cloudflare's data processing terms include the SCCs and UK Addendum.

5. Supplementary measures. Encryption in transit (Annex II, item 2); tenant isolation (item 1); limiting what each Sub-processor receives (items 2 and 14); the executor sandbox with no network access (item 7); the public-authority request process in section 9.8; and Customer control over whether AI features are used at all (section 17.1).

6. Requests received. As at the effective date, Kanbrio has not received any request from a public authority for Customer Personal Data. [to be confirmed]

7. Conclusion. Taking into account the nature of the data, the limited data sent to each Sub-processor, the legal protections and oversight in each country, and the measures above, Kanbrio considers that the SCCs and UK Addendum give an essentially equivalent level of protection for these transfers. Kanbrio will review this assessment if the law or its Sub-processors change.

Change log