Draft — pending legal review. This document is a placeholder and is not the final agreement. The reviewed version will replace it before launch.
Data processing agreement between Klyk and its customers
1. Who is responsible
The customer is the controller of its employees’ personal data held in Klyk. Klyk is the processor of that data and processes it only on the customer’s documented instructions. Klyk is the controller of its own customer account data (admin contacts, billing and support).
2. Subject matter, nature and purpose
Klyk provides an asset platform that tracks the customer’s devices and the people who use them, from first day to last, including deliveries and collections, service requests, labels and carbon reporting. Processing lasts for as long as the customer’s workspace is open, plus the deletion periods in section 7.
3. Personal data and data subjects
Data subjects are the customer’s employees and contractors, and the admins who use Klyk. The personal data is: name, work email, phone, job title, team, office, start and leave dates, home address (deliveries and collections only) and an optional profile photo. Klyk never reads salary, date of birth, National Insurance number, bank details, health, diversity or performance data from HR tools.
4. Klyk’s obligations
- Process personal data only on the customer’s instructions, including when Klyk staff provide support inside the workspace. Every staff action is recorded in the customer’s audit log.
- Make sure everyone authorised to process the data is bound by confidentiality.
- Keep the data secure: encryption in transit (TLS 1.2 or later) and at rest, role-based access, an audit log of every change, and sign-in by Google, Microsoft or a magic link that expires after 15 minutes.
- Help the customer respond to subject access, erasure and other rights requests within 10 working days.
- Tell the customer without undue delay, and within 24 hours of becoming aware, of a personal data breach, so the customer can meet the ICO’s 72-hour deadline.
- Make available the information needed to show compliance with Article 28, and allow for reasonable audits.
5. Sub-processors
Klyk uses sub-processors for hosting, email delivery, payments (Stripe), Google and Microsoft APIs, and the HR and device management tools the customer chooses to connect. Klyk publishes its sub-processor list and gives 30 days’ notice of changes.
6. Where the data is kept
Data is stored in the United Kingdom. Where a sub-processor is outside the UK, transfers rely on the UK–US data bridge or the UK International Data Transfer Agreement or Addendum.
7. Retention and deletion
- Leavers: home address and phone are deleted 30 days after their devices are returned. The name stays on asset history for 12 months, then is anonymised.
- Closed workspace: the owner can export all data first. Data is deleted within 30 days and purged from backups within 90 days.
- Audit log: 24 months. Invoices and billing records: 6 years.
8. Contact
AH Technology Ltd trading as Klyk, company number 11773440. Questions about this agreement: Asad Hamir, care@helloklyk.com, Unit A12, Eldon Way, Park Royal Industrial Estate, London, NW10 7QQ.