This agreement applies whenever KolchiInOne (“KIO”, the processor) processes personal data of a Client’s contacts on behalf of that Client (the controller) through KIO CRM. It forms part of the Terms of Service.
1. Subject and duration
KIO hosts and processes the Client’s lead, customer and conversation data to provide KIO CRM, for as long as the Client uses the Service and for up to 30 days after it ends.
2. Data and people concerned
Identity and contact details, messages, form answers, notes, documents, statuses and payment records of the Client’s prospects, customers and website visitors; accounts of the Client’s team members.
3. KIO’s commitments
- Process the data only on the Client’s documented instructions — the way the Client configures and uses the CRM — unless the law requires otherwise.
- Ensure that people with access are bound by confidentiality.
- Apply the security measures described in the Privacy Policy (encryption in transit and at rest for secrets, access control, backups, rate limiting, private-network blocking).
- Use only the sub-processors listed in the Privacy Policy, and inform the Client before adding a new one so it can object.
- Help the Client answer data-subject requests and meet its security and breach-notification obligations; notify the Client without undue delay (and within 48 hours where possible) after becoming aware of a personal-data breach.
- At the end of the Service, return the data on request and then delete it, except where the law requires keeping it.
- Make available the information needed to demonstrate compliance and allow reasonable audits, on 30 days’ notice.
4. The Client’s commitments
The Client guarantees that it has a lawful basis for the data it brings into the CRM and for contacting its leads, that it informs them (for example through its own privacy notice and forms), and that it declares its processing to the CNDP where Moroccan Law 09-08 requires it.
5. Transfers
Data is hosted in the European Union (Paris). Transfers to AI or platform providers outside it happen only when the Client enables those features, under the providers’ safeguards.