Version 1.0 — June 2026

This Data Processing Agreement (“DPA“) describes the terms under which Klaravex LLC processes personal data on behalf of its B2B clients in connection with the delivery of managed IT and support services. This DPA is incorporated into and forms part of the Master Service Agreement or engagement letter between Klaravex and the Client.

---

1. Parties

This DPA is entered into between:

• Controller: The client entity identified in the Master Service Agreement or engagement letter (“Client” or “Controller“)
• Processor: Klaravex LLC, a limited liability company (“Klaravex” or “Processor“)

The Controller determines the purposes and means of processing personal data. The Processor processes personal data only on behalf of and under the documented instructions of the Controller.

---

2. Subject Matter

Klaravex processes personal data as a processor on behalf of the Client to the extent necessary to deliver the managed IT and support services specified in the applicable Master Service Agreement or engagement letter. Processing takes place for the duration of the services agreement.

---

3. Nature and Purpose of Processing

Klaravex may process personal data in connection with the following service activities:

• IT support and troubleshooting: Access to client systems, user accounts, and associated data as necessary to diagnose and resolve technical issues
• Klaravex AI first-line support: Processing of end-user support conversation logs via the Klaravex AI AI assistant; conversation content used for issue triage and resolution
• Infrastructure monitoring: Collection and analysis of system telemetry, performance metrics, and log data to maintain service availability and security posture
• Security services: Review of access logs, authentication records, and security events as part of managed security services where applicable

---

4. Categories of Personal Data

Depending on the services engaged, Klaravex may process the following categories of personal data:

• Employee contact information: Names, email addresses, phone numbers, job titles of the Controller’s personnel
• IT asset data: Device identifiers, IP addresses, software inventory, configuration data
• Support ticket content: Issue descriptions, system states, error messages submitted in support requests
• System and access logs: Authentication events, system activity logs, security event records
• End-user support conversations: Text content of interactions with Klaravex AI where Klaravex AI is deployed for the Controller’s end users

Special categories of data: Klaravex’s standard services are not designed to process special categories of personal data (health data, financial account details, etc.). For healthcare clients where processing of protected health information (PHI) may occur, a separate HIPAA Business Associate Agreement (BAA) is required and available upon request at hello@klaravex.com.

---

5. Processor Obligations

Klaravex, as Processor, agrees to the following obligations:

5.1 Processing on Instructions

Klaravex will process personal data only on documented instructions from the Controller (as set out in the Master Service Agreement and this DPA), unless required to do otherwise by applicable law. Klaravex will inform the Controller if, in its opinion, an instruction infringes applicable data protection law.

5.2 Confidentiality

Klaravex will ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations and receive relevant data protection training.

5.3 Security Measures

Klaravex implements appropriate technical and organizational security measures, including:

• AES-256 encryption of data at rest
• TLS encryption for all data in transit
• Role-based access controls and least-privilege access principles
• Multi-factor authentication for administrative access
• Regular security assessments and vulnerability reviews
• Dedicated infrastructure for Klaravex AI (not shared with other tenants)

5.4 Sub-Processor Management

Klaravex will not engage sub-processors beyond those listed in Section 6 without providing the Controller with prior notice and an opportunity to object. Klaravex imposes data protection obligations on sub-processors equivalent to those in this DPA.

5.5 Data Subject Rights Assistance

Klaravex will assist the Controller in fulfillling its obligations to respond to data subject rights requests (access, rectification, erasure, restriction, portability, objection) by providing relevant data or taking technical action within the timeframes specified in Section 8.

5.6 Deletion or Return of Data

Upon termination of the service relationship, Klaravex will delete or return all personal data processed on behalf of the Controller within 30 days, unless applicable law requires longer retention. See Section 10.

5.7 Audit Cooperation

Klaravex will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and will cooperate with audits or inspections conducted by the Controller or a mandated auditor, provided that such audits are conducted on reasonable notice, during business hours, and in a manner that does not disrupt Klaravex’s operations or compromise the security or confidentiality of other clients’ data.

---

6. Sub-Processors

Klaravex currently uses the following sub-processors in connection with delivering services. The Controller provides general authorization for use of these sub-processors:

Sub-Processor	Purpose	Location	Transfer Mechanism
Hosting provider (EU)	Infrastructure hosting for Klaravex AI	EU (Germany)	Within EEA — no transfer mechanism required
AI provider	LLM API for Klaravex AI response generation	USA	Standard Contractual Clauses (SCCs)
Zoho Corporation	Remote desktop and screen-sharing sessions	USA / EU	SCCs / EU data processing available
Payment processor	Payment processing	USA	Independent controller — outside scope of this DPA

Note: The payment processor acts as an independent data controller for payment processing purposes and is not a sub-processor under this DPA. The payment processor’s data practices are governed by its own privacy policy and terms.

---

7. International Data Transfers

Klaravex’s primary infrastructure for Klaravex AI is hosted in the EU (Germany). The following international transfers may occur:

LLM API Processing

When Klaravex AI generates responses, conversation content is transmitted to the AI provider’s API infrastructure, which may be located in the United States. This transfer is made under Standard Contractual Clauses (SCCs) as adopted by the European Commission. Clients may request copies of the applicable SCCs at dpa@klaravex.com.

Remote Session Data

Remote support sessions facilitated through our remote-support tool may involve processing in EU or US infrastructure. EU-region data processing options are available. Session metadata is subject to the tool provider’s data processing terms, which incorporate SCCs for cross-border transfers.

Data Residency Requests

Clients with strict data residency requirements should contact Klaravex at dpa@klaravex.com to discuss available options, which may include dedicated deployment configurations that limit or eliminate third-country data transfers.

---

8. Data Subject Rights

Klaravex will assist the Controller in responding to requests from data subjects exercising their rights under applicable data protection law (including GDPR Articles 15–22: access, rectification, erasure, restriction of processing, data portability, and right to object).

Upon receiving a verifiable data subject rights request from the Controller, Klaravex will:

• Acknowledge the request within 72 hours
• Provide the Controller with the relevant data or perform the requested action within a timeframe that allows the Controller to respond to the data subject within the applicable legal deadline (typically 30 days under GDPR)
• Inform the Controller if any request cannot be fulfillled and the reason why

Note: Klaravex acts as processor and will respond to data subject rights requests only when directed by the Controller. If a data subject contacts Klaravex directly, Klaravex will redirect the data subject to the Controller.

---

9. Security Incidents & Data Breach Notification

Klaravex maintains security incident response procedures and will:

• Notify the Controller within 48 hours of becoming aware of a personal data breach that affects data processed on the Controller’s behalf
• Provide initial notification including: the nature of the breach, categories and approximate number of data subjects affected, categories and approximate number of records affected, likely consequences, and measures taken or proposed to address the breach
• Cooperate with the Controller’s incident response efforts and provide additional information as it becomes available
• Implement reasonable measures to contain, remediate, and prevent recurrence of the incident

The Controller is responsible for determining whether the breach triggers notification obligations to supervisory authorities or data subjects under applicable law (e.g., GDPR Article 33/34 notification requirements).

---

10. Termination & Data Return or Deletion

Upon termination or expiration of the Master Service Agreement (or upon written request from the Controller):

• Klaravex will, at the Controller’s election, either return all personal data to the Controller or securely delete all personal data processed on behalf of the Controller
• This will be completed within 30 days of the termination date or written request
• Klaravex will provide written confirmation of deletion upon request
• Klaravex may retain personal data beyond this period only where required by applicable law (e.g., financial records retention requirements), in which case Klaravex will notify the Controller and continue to protect such data in accordance with this DPA

---

11. Governing Law

This DPA is governed by the laws of the State of California, USA, subject to any mandatory data protection law provisions that apply in the jurisdiction of the Controller. For EU Controller clients, GDPR provisions and standard contractual clauses take precedence over any conflicting provisions in this DPA.

---

12. Contact & Requesting a Signed DPA

To request a countersigned DPA PDF for your organization, or for questions about Klaravex’s data processing practices:

DPA requests: dpa@klaravex.com
Privacy inquiries: privacy@klaravex.com
General: hello@klaravex.com
Entity: Klaravex LLC (Los Angeles, CA)

We aim to respond to DPA requests within 3 business days.