Legal
Data Processing Addendum
Effective date: October 19, 2026 ยท Version 1.0
This Data Processing Addendum ("DPA") forms part of the Terms of Service or other agreement (the "Agreement") between Cullektor ("Processor", "we") and the customer named in the Agreement ("Customer", "you"). It applies automatically when you accept the Agreement. If you need a countersigned copy, email hello@cullektor.com.
1. Definitions
"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, which may include the California Consumer Privacy Act as amended by the CPRA ("CCPA") and other US state privacy laws; the EU General Data Protection Regulation 2016/679 ("GDPR"); the UK GDPR and Data Protection Act 2018; and India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 ("DPDP Act").
"Customer Personal Data" means personal data within Customer Data (as defined in the Agreement) that we process on Customer's behalf. "Controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "data fiduciary" and "data processor" have the meanings given in the applicable Data Protection Laws. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. "Subprocessor" means a third party we engage to process Customer Personal Data.
2. Roles and scope
2.1 Customer is the controller (or "business" / "data fiduciary") and Cullektor is the processor (or "service provider" / "data processor") of Customer Personal Data. Where Customer is itself a processor for a third party (for example, a reseller partner acting for its clients), Cullektor is a subprocessor and Customer confirms that it has its controller's authorization for these instructions.
2.2 The subject matter, duration, nature and purpose of processing, and the types of data and data subjects, are described in Annex 1.
3. Customer instructions and responsibilities
3.1 We will process Customer Personal Data only on Customer's documented instructions, which are: the Agreement and this DPA; Customer's configuration of the Service (including playbooks, templates, approval mode and Desk instructions); and other reasonable written instructions consistent with the Agreement. We will tell Customer if we believe an instruction breaches Data Protection Laws, and may suspend that processing until it is clarified.
3.2 Customer is responsible for the lawfulness of the instructions it gives, for having a lawful basis to collect and share Customer Personal Data with us and to contact each recipient, for giving any notices required by law, and for the accuracy of Customer Personal Data.
3.3 Customer will not provide special-category or sensitive personal data (such as health data or government ID numbers) or data about consumers' personal debts, except as strictly needed for invoicing B2B receivables.
4. CCPA service-provider terms
Where the CCPA applies, Cullektor: (a) will not sell or share Customer Personal Data; (b) will not retain, use or disclose it for any purpose (including any commercial purpose) other than the business purposes specified in Annex 1, or outside the direct business relationship with Customer; (c) will not combine it with personal information received from others, except as permitted by the CCPA; (d) will comply with the CCPA and provide the same level of privacy protection the CCPA requires of businesses; (e) will notify Customer if it can no longer meet its obligations; and (f) allows Customer to take reasonable and appropriate steps to stop and remediate unauthorized use. Cullektor certifies that it understands and will comply with these restrictions.
5. Confidentiality and personnel
We ensure that everyone authorized to process Customer Personal Data (including Desk personnel in India) is bound by written confidentiality obligations, has received data-protection and security training appropriate to their role, and accesses only the data needed for their tasks. Desk personnel are background-checked, to the extent permitted by local law, before they are given access to Customer Personal Data.
6. Security
We will implement and maintain the technical and organizational measures described in Annex 2, appropriate to the risk. We may update those measures, provided we do not materially reduce the overall level of protection.
7. Subprocessors
7.1 Customer gives general authorization for us to engage Subprocessors. Our current Subprocessors are listed at https://cullektor.com/subprocessors/. Where a Subprocessor is marked "to be confirmed", we will not send Customer Personal Data to it until it is named on that page and the notice process below has run.
7.2 We will give at least 30 days' notice before a new Subprocessor processes Customer Personal Data, by updating the Subprocessors page and emailing customers who have subscribed to updates (email hello@cullektor.com with the subject "Subprocessor updates"). Customer may object on reasonable data-protection grounds within that period. We will then try in good faith to resolve the objection; if we cannot, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.
7.3 We will impose data-protection obligations on each Subprocessor that are at least as protective as this DPA (to the extent relevant to the services it provides), and we remain responsible for its performance.
7.4 Services that Customer chooses to connect and contracts with directly (for example, Intuit QuickBooks Online, Google Workspace, Microsoft 365 or Customer's own Stripe account) are not our Subprocessors. Customer's agreements with those providers govern their processing.
8. International transfers
8.1 Customer acknowledges that Customer Personal Data will be processed in the United States (hosting and most Subprocessors) and accessed from India (our product, support and Desk personnel), and may be processed in other countries where our Subprocessors operate.
8.2 GDPR / UK GDPR. To the extent Customer Personal Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module 2 (controller to processor) where Customer is a controller and Module 3 (processor to processor) where Customer is a processor, with: Clause 7 (docking) applying; Clause 9 option 2 (general authorization, 30 days' notice); the optional wording in Clause 11 not applying; Clause 17 option 1 with the law of Ireland; Clause 18 courts of Ireland; and Annexes I and II completed by Annexes 1 and 2 of this DPA. For UK transfers, the UK International Data Transfer Addendum (version B1.0) applies, with the tables completed by reference to this DPA. We will put equivalent safeguards in place with our Subprocessors.
8.3 India. Processing in India of personal data of data principals outside India under this DPA is subject to section 17(1)(d) of the DPDP Act; we will in any case maintain the reasonable security safeguards required by section 8(5) of the DPDP Act.
9. Assistance with data subject requests and compliance
9.1 Taking into account the nature of the processing, we will help Customer respond to requests from individuals to exercise their rights. If we receive a request directly, we will forward it to Customer without undue delay and will not respond except to direct the individual to Customer, unless the law requires otherwise. The Service lets Customer search, export, correct and delete Customer Personal Data and add contacts to a do-not-contact list.
9.2 We will provide reasonable information and help for Customer's data protection impact assessments and consultations with regulators, to the extent Customer cannot do so itself using information available to it.
10. Personal Data Breaches
10.1 We will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and the measures taken or proposed. We will update Customer as more information becomes available.
10.2 We will take reasonable steps to contain, investigate and remediate the breach, and cooperate with Customer so that it can meet its own notification obligations. Our notice is not an admission of fault.
11. Audits
11.1 On written request, no more than once a year (or after a Personal Data Breach, or when required by a regulator), we will provide information reasonably necessary to demonstrate our compliance with this DPA, such as completed security questionnaires, our policies and summaries of security testing. Once we have a SOC 2 report or a similar third-party audit, we will provide it under confidentiality, and it will be the primary means of meeting this obligation.
11.2 If that information is not enough to demonstrate compliance, Customer (or an independent auditor bound by confidentiality, who is not our competitor) may conduct an audit, on at least 30 days' notice, during business hours, without disrupting our operations or accessing other customers' data, at Customer's cost.
12. Return and deletion
On termination of the Agreement, Customer may export Customer Personal Data for 30 days. We will then delete it from active systems within 90 days after termination, and from backups within a further 35 days, unless the law requires us to retain it, in which case we will keep it confidential and process it only for that purpose. On request, we will confirm deletion in writing.
13. Liability and order of precedence
Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses control.
Annex 1: Details of processing
| Item | Description |
|---|---|
| Data exporter / controller | Customer (contact: the account owner named in the Service) |
| Data importer / processor | Cullektor (legal entity registration in progress), hello@cullektor.com |
| Subject matter and purpose | Providing the Cullektor accounts-receivable service: syncing invoices, customers and payments from Customer's accounting system; drafting, sending and tracking reminders in Customer's name; reading and classifying replies in Customer's AR mailbox; tracking promises to pay and disputes; generating payment links through Customer's payment processor; reporting; audit logging; and, on Desk plans, human follow-up by email and phone on Customer's B2B receivables; plus support, security and fraud prevention. |
| Nature of processing | Collection via API and mailbox integration, storage, organization, retrieval, AI-assisted drafting and classification, transmission (email, and phone on Desk plans), display, and deletion. |
| Data subjects | Employees and contractors of Customer's business customers (for example, accounts-payable staff, owners, buyers); Customer's own users and staff; other individuals who appear in invoices or AR correspondence. |
| Categories of personal data | Names; business email addresses and phone numbers; job titles; company names and addresses; invoice, payment and remittance details linked to a contact; content of emails, replies and call notes; promise-to-pay and dispute records; user account data and audit-log entries. |
| Sensitive data | None intended. Customer must not submit special-category or sensitive personal data. |
| Frequency | Continuous for the term of the Agreement. |
| Duration and retention | Term of the Agreement plus the return and deletion periods in section 12. |
| Subprocessors | As listed at https://cullektor.com/subprocessors/ |
Annex 2: Technical and organizational security measures
These are the measures we commit to for production Customer Data. Our Security page tracks what is in place and what is on our roadmap.
- Access control. Role-based access in the app; least-privilege access for staff; unique named accounts; multi-factor authentication for all staff and administrative access; access reviews at least quarterly; prompt removal of leavers' access.
- Encryption. TLS 1.2 or higher in transit; encryption at rest for databases, file storage and backups using our providers' managed encryption; OAuth tokens and API credentials stored encrypted and never shown to staff in plain text.
- Integration scopes. We request the narrowest scopes available from accounting and mailbox providers; the AR X-Ray is read-only; Customer can disconnect at any time.
- Logging and monitoring. Application audit log of user, AI-agent and Desk actions visible to Customer; infrastructure and access logs retained for up to 12 months; alerts on suspicious activity.
- Desk security. Desk personnel work only on company-managed devices with full-disk encryption, screen lock and endpoint protection, inside our controlled tools; no use of personal email or messaging for Customer Data; removable media and local downloads restricted; confidentiality agreements and training before access.
- Secure development. Code review for production changes; separation of development and production environments; dependency vulnerability scanning; secrets kept out of source code.
- Vendor management. Due diligence on Subprocessors and written data-protection terms with each.
- Resilience. Backups of production data with restoration testing; documented incident-response plan; breach notification as set out in section 10.
- Data minimization and deletion. Only data needed for the Service is synced; deletion on request and at contract end as set out in section 12.
- AI providers. AI model providers are used only under terms that prohibit training on our inputs and outputs and that limit their retention of that data.