Data Processing Agreement

This Data Processing Agreement ("DPA") applies between Katanso Solutions Ltd (trading as Kumo), registered in England and Wales under company number 16264296, of 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom ("Kumo"), and the customer identified in the Principal Agreement (the "Customer").

It is published at kumo.earth/dpa and is incorporated into the Principal Agreement by reference. It forms a binding agreement between Kumo and the Customer from the date the Principal Agreement takes effect, and does not require signature. Kumo will provide a countersigned copy on request.

1. Definitions and Roles

1.1. Terms defined in Data Protection Law have the same meaning in this DPA. "Data Protection Law" means the UK General Data Protection Regulation, the Data Protection Act 2018, the Data Use and Access Act 2025, and any other data protection law applicable to the processing. "Customer Personal Data" means personal data Kumo processes on the Customer's behalf, as described in the Annex. "Principal Agreement" means the agreement under which Kumo provides its services to the Customer, being Kumo's Terms of Service where the Customer has accepted them, and otherwise any written agreement between the parties that incorporates this DPA.

1.2. In respect of personal data contained in material the Customer uploads, and in hosting, storing, displaying, and transmitting that material at the Customer's direction, the Customer is the controller and Kumo is the processor. This DPA governs that processing.

1.3. In respect of account, billing, usage, technical, communications, and marketing data, and security monitoring and fraud prevention, Kumo is a controller and its processing is governed by Kumo's privacy policy. Where the same record is processed in both capacities, each regime applies to the processing carried out in that capacity.

2. Instructions

2.1. Kumo will process Customer Personal Data only on the Customer's documented instructions, including as to international transfers, unless required otherwise by law, in which case Kumo will inform the Customer first unless the law prohibits it.

2.2. The Principal Agreement, this DPA, and the Customer's use of Kumo's services are the Customer's documented instructions. Kumo will tell the Customer if it considers an instruction to infringe Data Protection Law, and may suspend the processing concerned until the instruction is confirmed or withdrawn.

3. Confidentiality and Security

Kumo will ensure that each person authorised to process Customer Personal Data is bound by an appropriate duty of confidentiality and has access only so far as necessary. Kumo will implement and maintain appropriate technical and organisational measures, described in the Security section of Kumo's privacy policy, taking account of the state of the art, the cost of implementation, the nature and purposes of the processing, and the risk to data subjects. Kumo may update those measures provided the level of protection is not reduced.

4. Sub-processors

4.1. The Customer gives Kumo general written authorisation to engage sub-processors. Kumo maintains a current list of those engaged from time to time, with the location of each, and will provide it to the Customer on request. Kumo keeps each superseded version of that list.

4.2. Kumo will give the Customer at least thirty (30) days' notice by email before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period, and if the objection cannot be resolved in good faith the Customer may terminate the affected services without penalty, with a pro rata refund of prepaid fees.

4.3. Kumo will impose on each sub-processor obligations no less protective than this DPA, and remains liable to the Customer for each sub-processor's performance.

5. Assistance

Kumo will assist the Customer, taking account of the nature of the processing and the information available to Kumo, in responding to requests from data subjects exercising their rights, and in carrying out data protection impact assessments and any prior consultation with a supervisory authority. If Kumo receives a data subject request directly it will not respond substantively, and will refer the data subject to the Customer and notify the Customer without undue delay.

6. Personal Data Breach

Kumo will notify the Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware, of a personal data breach affecting Customer Personal Data. The notification will describe the breach, its likely consequences, the measures taken or proposed, and a contact point, in phases if not all of that is available at once. Kumo will take reasonable steps to mitigate the breach at its own cost and will give the Customer the assistance it reasonably requires to meet its own obligations.

7. International Transfers

Kumo may process Customer Personal Data outside the United Kingdom and the European Economic Area. Kumo's sub-processor list identifies where each sub-processor is located. Any such transfer will be made under the UK International Data Transfer Agreement, the Addendum to the European Commission's Standard Contractual Clauses, those Clauses, or another mechanism permitted by Data Protection Law, and Kumo will carry out a transfer risk assessment where one is required. The Customer may request a copy of the relevant mechanism.

8. Deletion and Return

On termination of the Principal Agreement Kumo will, at the Customer's election, delete or return Customer Personal Data and delete existing copies, unless required by law to retain it. The Customer may delete its own uploaded material at any time and Kumo will give effect to that within thirty (30) days. Kumo may retain copies held in routine backups until deleted in the ordinary backup cycle, and copies it is required to retain by law; those copies remain subject to this DPA while held.

9. Information and Audit

Kumo will make available the information reasonably necessary to demonstrate compliance with this DPA and with Article 28 of the UK GDPR. The Customer may audit that compliance once in any twelve month period, and following a personal data breach affecting it, on thirty (30) days' notice, during business hours, without unreasonable disruption and subject to confidentiality. Kumo may satisfy a request by providing an independent assessment or certification that reasonably addresses it.

10. Anonymised Data

Kumo creates anonymised and aggregated data from Customer Personal Data on the Customer's instruction, and does so as processor. Once anonymised so that no individual can be identified, the resulting data is not personal data, this DPA does not apply to it, and its ownership and use are governed by the Principal Agreement. Kumo will not attempt to re-identify it and will impose the same prohibition on any recipient. If anonymised data Kumo holds can at any time reasonably be used to identify an individual, it is personal data and this DPA applies to it from that time.

11. Customer Responsibilities

The Customer warrants that it has a lawful basis for the processing it instructs, that it has given data subjects the transparency information Data Protection Law requires, and that its instructions comply with Data Protection Law. Where the Customer uploads personal data relating to third parties, including project personnel, consultants, landowners, and community participants, the Customer is responsible for those matters in respect of that data.

12. General

12.1. Liability under this DPA is subject to the exclusions and limitations of liability in the Principal Agreement. Nothing limits either party's liability to a data subject or a supervisory authority.

12.2. This DPA applies for as long as Kumo processes Customer Personal Data, and survives termination to the extent necessary to give it effect. In the event of conflict it prevails over the rest of the Principal Agreement in relation to Customer Personal Data.

12.3. Kumo may update this DPA on thirty (30) days' notice to reflect a change in Data Protection Law, in its services, or in its sub-processors, provided the level of protection is not reduced. Each version is published at kumo.earth/dpa with its version number and date, and earlier versions remain available there.

12.4. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, save that either party may seek interim relief in any court of competent jurisdiction.

Annex: Details of the Processing