Legal

Data processing agreement

Last updated 22 October 2026

This agreement forms part of our terms of service. It applies when KLYRO processes personal data on behalf of a business that uses our products ("you", the data fiduciary or controller). We are your data processor.

1. What we process

  • Purpose: to provide the Service you subscribe to: reading reviews and enquiries, drafting and sending replies under your rules, booking calls and viewings, keeping your records, and the support you ask for.
  • People concerned: your customers and prospects (reviewers, buyers, renters, tenants, landlords, sellers), your staff and users, and people named in documents you upload.
  • Types of data: names, contact details, review and message text, property preferences and budgets, booking details, document contents you choose to upload (which may include identity documents and bank details), and records of what the agent and your users did.
  • Duration: for as long as you use the Service, and then until the data is deleted under section 9.

2. Your instructions

We process your personal data only on your documented instructions, which are these terms, your order and the settings you choose in the Service, unless the law requires otherwise; in that case we will tell you first if the law allows. We will tell you if we think an instruction breaks data protection law.

3. Confidentiality

Everyone at KLYRO who can access your personal data is bound to keep it confidential.

4. Security

We keep appropriate technical and organisational measures in place, including:

  • encryption of data in transit, and of access tokens and secrets at rest (AES-256-GCM), with storage encryption by our database provider;
  • each customer's data kept separate and every query scoped to that customer;
  • role-based access within your account, and access by our staff only when needed to run or support the Service;
  • an activity log of the actions taken in your account;
  • regular backups by our database provider; and
  • review of these measures as the Service and the risks change.

5. Sub-processors

You authorise us to use sub-processors for hosting, database storage, AI model processing, email delivery and support tools. We bind each of them to data protection terms at least as protective as these, and give you the current list on request, under confidentiality. We will tell you by email at least 15 days before adding or replacing one that processes your personal data; if you object on reasonable data protection grounds and we cannot resolve it, you may end the affected subscription and receive a refund of any prepaid fees for the unused period. We remain responsible for our sub-processors' work.

6. International transfers

Our sub-processors process data in Australia, the United States and the European Union. Where the law of your country restricts transfers, including India's DPDP Act, the UAE's PDPL and the EU and UK GDPR, we rely on our sub-processors' contractual safeguards (such as standard contractual clauses) and on any additional measures the law requires, and we will not transfer data to a country the law of your country prohibits.

7. Helping you

We will help you, taking into account what we can reasonably do, to answer requests from people exercising their rights, to keep your data secure, and with data protection impact assessments and questions from regulators. If a person contacts us directly about your data, we will pass the request to you.

8. Personal data breaches

We will tell you without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting your personal data, with the information we have and then what we learn, so that you can meet your own duties to notify regulators and the people affected.

9. Return and deletion

When your subscription ends, you can ask for a copy of your data within 30 days. After that we delete it, including from our sub-processors, except where the law requires us to keep it. Backups are overwritten in their normal cycle.

10. Audits

We will give you the information you reasonably need to show that we meet this agreement. If that is not enough, you may audit us, once a year, with at least 30 days' notice, at your cost and under a confidentiality agreement.

11. Contact

Data protection questions and breach notifications: privacy@klyro.tech. If you need this agreement signed, ask us and we will send a signed copy.