Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the agreement between OSO DevOps Limited, trading as Keito, a company registered in England and Wales with company number 10889879 and registered office at The Landing 131 Tileman House, Upper Richmond Road, London, SW15 2TL (“Keito”), and the customer identified in the associated Keito workspace (“Customer”), together the “parties”. Keito is registered with the Information Commissioner’s Office under registration number ZB179031.
This DPA is supplemental to the Keito Terms of Service, or any other written agreement between the parties governing the Customer’s use of the Keito service (the “Agreement”), and applies where Keito processes Personal Data on behalf of the Customer in providing the Keito service (the “Service”).
1. Definitions
“Applicable Data Protection Law” means all data protection and privacy legislation in force in the United Kingdom from time to time, including: (i) the UK GDPR, as amended, including by the Data (Use and Access) Act 2025; (ii) the Data Protection Act 2018; (iii) where applicable to the processing, the EU General Data Protection Regulation 2016/679; and (iv) any laws that replace, extend, re-enact, consolidate or amend any of the foregoing.
“Customer Data” means the Personal Data that Keito processes on behalf of the Customer in providing the Service, as described in Annex A.
“Controller”, “Processor”, “Personal Data”, “processing” and “Personal Data Breach” have the meanings given to them in Applicable Data Protection Law.
“Sub-processor” means any third party appointed by or on behalf of Keito to process Customer Data.
“IDTA” means the international data transfer agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018; “UK Addendum” means the Information Commissioner’s international data transfer addendum to the European Commission’s 2021 standard contractual clauses; and “UK Extension” means the UK Extension to the EU-US Data Privacy Framework.
2. Relationship with the Agreement
This DPA replaces any data processing or data protection terms the parties may previously have agreed in connection with the Service. Except as amended by this DPA, the Agreement remains in full force and effect. If there is a conflict between this DPA and the Agreement in relation to the processing of Customer Data, this DPA prevails to the extent of that conflict. This DPA applies for as long as Keito processes Customer Data and survives termination or expiry of the Agreement until deletion of Customer Data in accordance with clause 10.
3. Roles, scope and instructions
3.1 Roles. As between the parties, the Customer is the Controller and Keito is the Processor of Customer Data. The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are set out in Annex A.
3.2 Instructions. Keito shall process Customer Data only on the Customer’s documented instructions, unless required to do otherwise by law to which Keito is subject, in which case Keito shall inform the Customer of that legal requirement before processing unless that law prohibits it from doing so. The Agreement, this DPA and the Customer’s use of the settings and features of the Service constitute the Customer’s complete documented instructions. Keito shall not process Customer Data for its own purposes or those of any third party.
3.3 Infringing instructions. Keito shall inform the Customer without undue delay if, in Keito’s opinion, an instruction from the Customer infringes Applicable Data Protection Law.
3.4 Customer responsibility. The Customer warrants that it has, and will maintain, a lawful basis for the processing of Customer Data under this DPA and that it has provided any notices and obtained any consents required under Applicable Data Protection Law.
4. Confidentiality
Keito shall ensure that every person it authorises to process Customer Data, including its staff and contractors, is subject to a contractual or statutory duty of confidentiality, and shall not permit any person who is not under such a duty to process Customer Data.
5. Security
Keito shall implement and maintain appropriate technical and organisational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. Those measures shall include, at a minimum, the measures described in Annex B. Keito may update Annex B from time to time provided the updates do not materially reduce the overall level of protection for Customer Data.
6. Sub-processors
6.1 Authorisation. The Customer provides a general written authorisation for Keito to appoint Sub-processors. The Sub-processors currently appointed are listed in Annex C, and the current list is published in section 5 of the Keito Privacy Policy at https://keito.ai/privacy/.
6.2 Notice of changes. Keito shall notify workspace owners by email at least 30 days before adding or replacing a Sub-processor, including details of the processing it will perform and the location of that processing.
6.3 Objection. If the Customer objects to a new Sub-processor within the notice period on reasonable grounds relating to the protection of Customer Data, the parties shall discuss the objection in good faith. If the parties cannot resolve the objection, the Customer may terminate the Agreement without penalty and Keito shall refund any fees prepaid for the period after termination.
6.4 Flow-down and liability. Keito shall impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains fully liable to the Customer for the performance of each Sub-processor’s obligations.
6.5 Customer integrations. Third party services that the Customer chooses to connect to its workspace, such as Xero, QuickBooks or Google Calendar, are engaged at the Customer’s direction and are not Sub-processors of Keito. The Customer’s relationship with those services is governed by the Customer’s own agreements with them.
7. International transfers
Customer Data is hosted and primarily processed in the United Kingdom, in the Amazon Web Services eu-west-2 (London) region. Keito shall not make a restricted transfer of Customer Data outside the United Kingdom unless the transfer is: (i) to a country or recipient approved under Applicable Data Protection Law, including regulations made under Article 45A of the UK GDPR; (ii) to a recipient in the United States whose certification under the EU-US Data Privacy Framework and the UK Extension is active and covers the relevant services; or (iii) subject to appropriate safeguards under Article 46 of the UK GDPR, including the UK Addendum or the IDTA. Keito shall carry out and document any transfer risk assessment required by Applicable Data Protection Law.
8. Assistance
8.1 Data subject rights. Taking into account the nature of the processing, Keito shall assist the Customer by appropriate technical and organisational measures, including the export and self-service tools built into the Service, in fulfilling the Customer’s obligation to respond to requests from data subjects exercising their rights under Applicable Data Protection Law. If Keito receives such a request directly, it shall forward the request to the Customer promptly and shall not respond to it except as required by law or as authorised by the Customer.
8.2 Impact assessments and regulators. Taking into account the nature of the processing and the information available to it, Keito shall provide reasonable assistance to the Customer with data protection impact assessments, with prior consultations with the Information Commissioner, and with the Customer’s obligations under Articles 32 to 36 of the UK GDPR. Keito shall promptly inform the Customer of any correspondence it receives from a regulator or public authority relating to Customer Data.
9. Personal Data Breach
Keito shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notification shall, so far as the information is available, describe the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its possible adverse effects. Where it is not possible to provide all of the information at once, Keito may provide it in phases without undue further delay. Keito shall provide reasonable cooperation to enable the Customer to meet its own breach reporting obligations, and shall not notify any third party of a Personal Data Breach on the Customer’s behalf unless the Customer has agreed or notification is required by law.
10. Deletion and return of Customer Data
During the term of the Agreement the Customer can export Customer Data at any time using the export tools and API provided in the Service. Following termination or expiry of the Agreement, Keito shall retain Customer Data for 30 days so that the Customer can complete its export, and shall then delete Customer Data. This clause does not apply to: (i) aggregated or anonymised data that no longer identifies any individual or the Customer’s workspace; and (ii) records that Keito is required by law to retain, such as billing and tax records, which Keito shall isolate, protect from further processing and delete when the legal retention period ends.
11. Audit and information
Keito shall make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, including responses to reasonable written security questionnaires and a summary of the most recent independent penetration test. If that information is not reasonably sufficient, Keito shall allow an audit by the Customer or an independent auditor mandated by the Customer, provided that: (i) audits take place no more than once in any 12 month period, except following a Personal Data Breach affecting Customer Data or where required by a regulator; (ii) the Customer gives at least 30 days’ written notice; (iii) audits are conducted during normal business hours, do not unreasonably disrupt Keito’s operations and do not give access to data of other customers; (iv) the auditor enters into reasonable confidentiality undertakings; and (v) the Customer bears its own costs of the audit.
12. Liability
Each party’s liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Agreement. Nothing in this DPA limits either party’s liability to the extent it cannot be limited under applicable law, or affects either party’s liability to data subjects under Article 82 of the UK GDPR.
13. General
This DPA is governed by the law governing the Agreement, and disputes are subject to the same jurisdiction provisions. Notices to Keito under this DPA shall be sent to support@keito.ai. Notices to the Customer may be given by email to the workspace owners. If any provision of this DPA is held invalid, the remainder remains in effect. This DPA may be executed in counterparts, and acceptance through the Service or by electronic signature is effective.
Annexes
These Annexes form part of, and are incorporated into, the Data Processing Agreement between OSO DevOps Limited, trading as Keito, and the Customer. They are referenced in clauses 1, 3.1, 5 and 6.1 of that agreement.
Annex A
Details of the processing
Subject matter. The provision of the Keito time tracking, project management, invoicing and expense management service.
Duration. The term of the Agreement, plus the 30 day retention window described in clause 10 of the DPA.
Nature and purpose. Hosting, storage, display, transmission and analysis of Customer Data as necessary to provide time tracking, timesheets, project and task management, planning and capacity, approvals, invoicing, estimates, expense management, reporting, data import and export, and customer support.
Categories of data subjects. The Customer’s employees, contractors and other workspace users; contacts at the Customer’s clients; and suppliers, partners or other individuals appearing in project, invoice or expense records submitted to the Service.
Categories of Personal Data. Identification and contact data (name, email address, telephone number, profile image); employment data (role, team, working capacity, cost and billable rates); time entries and timesheets; project and task assignments; invoice and estimate data, including client contact details; expense records and receipts; usage and log data; and support communications.
Special categories of data. None expected. The Customer agrees not to submit special category data or criminal offence data to the Service.
Recipients. Keito personnel with a business need, acting under confidentiality obligations, and the Sub-processors listed in Annex C.
Annex B
Keito maintains the following measures. They may be updated from time to time in accordance with clause 5 of the DPA, provided the overall level of protection is not materially reduced.
Hosting and physical security. The Service runs in the Amazon Web Services eu-west-2 (London) region within isolated virtual private networks, with infrastructure managed as code. Physical and environmental security controls are inherited from AWS data centres, which hold independent certifications including ISO 27001 and SOC 2.
Encryption. Customer Data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest for databases, file storage and backups.
Access control. Authentication is provided through WorkOS, supporting single sign-on and multi-factor authentication. Access within a workspace is governed by role-based permissions. Internal access to production systems follows least privilege, uses unique named accounts with multi-factor authentication, is reviewed periodically, and is revoked promptly when personnel change roles or leave.
Segregation. Customer workspaces are logically segregated, and application queries are scoped to the authenticated workspace so that one customer cannot access another customer’s data.
Availability, backup and recovery. Customer Data is stored redundantly across availability zones. Encrypted backups are taken at least daily with point-in-time recovery, and restoration is tested periodically.
Secure development. Changes are peer reviewed, covered by automated tests, and deployed through a staged pipeline. Dependencies are scanned for known vulnerabilities and patched on a risk-based schedule.
Security testing. An independent penetration test is carried out at least annually, and findings are remediated on severity-based timescales. A summary can be made available to customers under clause 11 of the DPA.
Logging and monitoring. Application and infrastructure logs are collected centrally with alerting, and key account and administrative actions are recorded in an audit log.
Incident response. A documented incident response process is maintained, covering detection, triage, containment, remediation and customer notification in line with clause 9 of the DPA.
Personnel. Personnel are bound by written confidentiality obligations and receive security guidance appropriate to their role.
Deletion. On termination, Customer Data is retained for 30 days to allow export and is then deleted, subject only to the carve-outs in clause 10 of the DPA.
Annex C: Sub-processors
The Sub-processors engaged at the date of this DPA are set out below. The current list is also published in section 5 of the Keito Privacy Policy at https://keito.ai/privacy, and Keito gives workspace owners at least 30 days’ notice by email before adding or replacing a Sub-processor.
| Sub-processor | Service provided | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, storage and transactional email (SES) | United Kingdom (eu-west-2) | Not a restricted transfer |
| WorkOS, Inc. | Authentication and single sign-on | United States / EU | UK Extension to the EU-US Data Privacy Framework where certification is active, otherwise the UK Addendum |
| Stripe, Inc. / Stripe Payments Europe | Payments and billing | United States / EU | UK Extension to the EU-US Data Privacy Framework where certification is active, otherwise the UK Addendum |
| PostHog, Inc. | Product analytics | United States / EU | UK Extension to the EU-US Data Privacy Framework where certification is active, otherwise the UK Addendum |
| Grafana Labs | Infrastructure monitoring | United States / EU | UK Extension to the EU-US Data Privacy Framework where certification is active, otherwise the UK Addendum |
| Zendesk, Inc. | Customer support | United States | UK Extension to the EU-US Data Privacy Framework where certification is active, otherwise the UK Addendum |
Third party services that the Customer chooses to connect to its workspace, such as Xero, QuickBooks or Google Calendar, are engaged at the Customer’s direction and are not Sub-processors of Keito, as set out in clause 6.5 of the DPA.