Data Processing Agreement

1. Purpose and Scope

This Data Processing Agreement (DPA) governs the processing of personal data by The kAIzen ("Data Processor") on behalf of the Client ("Data Controller") when providing AI automation and web software services.

2. Roles and Responsibilities

The Client determines the purposes and means of processing personal data. The kAIzen will process personal data solely on documented instructions from the Client and in compliance with applicable data protection laws (including GDPR and CPRA).

3. AI Processing Specifics

Where personal data is passed through Artificial Intelligence models:

• The kAIzen ensures that zero-retention API agreements are utilized where third-party LLMs process sensitive user data.
• Personal data will not be used to train baseline foundation models without explicit, written consent from the Data Controller.

4. Sub-processors

The kAIzen engages third-party infrastructure providers (e.g., Vercel, AWS) and AI inference providers. A full list of sub-processors is available upon request. We ensure all sub-processors are bound by contractual obligations at least as protective as this DPA.

5. Security Measures

We implement robust technical and organizational measures, including encryption in transit and at rest, secure API key management, and environment isolation, to ensure a level of security appropriate to the risk.

6. Execution

For enterprise clients requiring a counter-signed DPA tailored to specific project scopes, please request a formalized document at contact@thekaizen.tech.