Scope and Application

(a)

This Data Processing Addendum (the “DPA”) is published by Kendis Oy (Business ID 2874062-5), Lapinlahdenkatu 16, 00180 Helsinki, Finland (“Kendis”). It applies to the Processing of personal data by Kendis on behalf of a customer (the “Customer”) in connection with the Kendis cloud services, including Kendis Premium Cloud and Kendis Org View cloud subscriptions and free trials (the “Cloud Services”), where the agreement between the Customer and Kendis incorporates this DPA by reference (that agreement, the “Principal Agreement”).

(b)

Signed agreements. If the Customer has entered into a signed agreement with a Kendis contracting entity that contains its own data-processing terms, those terms govern the Processing of personal data under that agreement and this DPA does not apply to it.

(c)

Self-hosted deployments. This DPA does not apply to self-hosted or private-cloud deployments in which the software and Customer data are hosted by or for the Customer rather than by Kendis. Data-processing arrangements for such deployments are set out in the applicable signed agreement. For the data-processing terms applicable to a deployment or arrangement not covered by this DPA, contact Kendis at security@kendis.io.

(d)

Roles. As between the Parties, the Customer is the controller (or, where applicable law uses that terminology, the business) and Kendis is the processor (or service provider) in respect of Customer Personal Data. Kendis acts as a controller of Account Data to the extent it Processes Account Data to administer its relationship with the Customer, as described in the Kendis privacy policy.

(e)

Capitalised terms used but not defined in this DPA have the meanings given in the Principal Agreement.

Definitions

In this DPA:

“Account Data” means personal data relating to the Customer’s relationship with Kendis, including the names and contact details of users and administrators, billing and subscription information, and the content of support communications.

“Applicable Laws” means the data-protection and privacy laws applicable to the Processing of Customer Personal Data under this DPA, including, where applicable, EU Data Protection Laws and US state privacy laws.

“Contracted Processor” means Kendis or a Subprocessor.

“Customer Personal Data” means any personal data Processed by a Contracted Processor on behalf of the Customer in connection with the Cloud Services under the Principal Agreement, including personal data within Trial Data or Licensee Data (each as defined in the Principal Agreement, where used).

“EU Data Protection Laws” means the GDPR and any laws implementing or supplementing the GDPR, together with, where applicable, the equivalent laws of the United Kingdom and Switzerland.

“GDPR” means EU Regulation 2016/679.

“Hosting Region” means the geographic location in which Customer Personal Data (other than Account Data) is stored and Processed, being a Hosting Region identified in the Hosting and Subprocessor Schedule, as selected by the Customer or specified under the Principal Agreement.

“Hosting and Subprocessor Schedule” or “Schedule” means the Kendis Hosting and Subprocessor Schedule published at trust.kendis.io/subprocessors, identifying the Hosting Regions offered by Kendis, the infrastructure providers and Subprocessors engaged in each, and the transfer mechanisms relied upon, as updated in accordance with Section 6 (Subprocessing). The Schedule is incorporated into this DPA by reference.

“Restricted Transfer” means a transfer of Customer Personal Data to a Contracted Processor, or between Contracted Processors, that would be prohibited by EU Data Protection Laws in the absence of the Standard Contractual Clauses or another lawful transfer mechanism.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for international transfers approved by the European Commission, as set out or incorporated in Annex 3.

“Subprocessor” means any third party engaged by Kendis to Process Customer Personal Data in connection with the Cloud Services.

The terms “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given in the GDPR, and “Sell”, “Share”, “Service Provider” and “Business Purpose” have the meanings given under the CCPA (as defined in Section 13), in each case as the context requires. “Include” means include without limitation.

Processing of Customer Personal Data

(a)

Kendis shall comply with all Applicable Laws in its Processing of Customer Personal Data, and shall not Process Customer Personal Data other than on the Customer’s documented instructions (including as set out in the Principal Agreement and this DPA), unless required by applicable law, in which case Kendis shall, where legally permitted, inform the Customer before Processing.

(b)

The Customer instructs Kendis (and authorises Kendis to instruct each Subprocessor) to Process Customer Personal Data, and to transfer it as described in this DPA and the Schedule, as reasonably necessary to provide the Cloud Services consistent with the Principal Agreement. The Customer warrants that it is and will remain authorised to give these instructions, including on behalf of each relevant Affiliate.

(c)

Annex 1 sets out the information regarding Processing required by Article 28(3) GDPR. Nothing in Annex 1 confers any right or imposes any obligation beyond those in this DPA.

Personnel

Kendis shall take reasonable steps to ensure the reliability of any personnel of a Contracted Processor with access to Customer Personal Data, ensure access is limited to those who need it to provide the Cloud Services, and ensure such personnel are bound by confidentiality obligations. Kendis shall use commercially reasonable efforts to screen personnel with access to Customer Personal Data against applicable sanctions and denied- or restricted-party lists, and shall not knowingly permit any individual who is identified on such a list to have access to Customer Personal Data.

Security

Taking into account the state of the art, costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risks to Data Subjects, Kendis shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, as appropriate, the measures referred to in Article 32(1) GDPR. In assessing the appropriate level of security, Kendis shall take particular account of the risks presented by a Personal Data Breach.

Subprocessing

(a)

The Customer provides general authorisation for Kendis to engage the Subprocessors identified in the Schedule for the applicable Hosting Region, and to engage replacement or additional Subprocessors, subject to this Section. Kendis may continue to use Subprocessors already engaged as at the effective date of the Principal Agreement.

(b)

Before a new Subprocessor Processes Customer Personal Data, Kendis shall: (i) carry out adequate due diligence on the Subprocessor; (ii) impose contractual data-protection obligations on the Subprocessor that are at least as protective as those in this DPA and that meet Article 28(3) GDPR where it applies; and (iii) where the engagement involves a Restricted Transfer, ensure the Standard Contractual Clauses (or another lawful transfer mechanism) are in place. Kendis remains liable for the acts and omissions of its Subprocessors as for its own.

(c)

Kendis shall give the Customer at least thirty (30) days’ prior notice of any intended addition or replacement of a Subprocessor, by updating the Schedule and notifying the Customer through the Cloud Services or by email to the Customer’s account contact. The Customer may object on reasonable data-protection grounds within thirty (30) days of the notice. The Parties shall work together in good faith to address the objection. If they cannot resolve it within a reasonable period, the Customer may, as its sole remedy, terminate the specific Cloud Services that cannot be provided without the objected-to Subprocessor, with a pro-rata refund of pre-paid fees for the terminated services for the unused portion of the then-current term.

(d)

On reasonable written request, Kendis shall make available to the Customer (subject to confidentiality and redaction of commercially sensitive terms) information reasonably necessary to demonstrate compliance with this Section.

Data Subject Rights

Taking into account the nature of the Processing, Kendis shall assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects. Kendis shall promptly notify the Customer if a Contracted Processor receives a request from a Data Subject relating to Customer Personal Data, and shall not respond to the request except on the Customer’s documented instructions or as required by applicable law.

Personal Data Breach

Kendis shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, and shall provide sufficient information to enable the Customer to meet any obligation to report the breach or inform Data Subjects. Kendis shall cooperate with the Customer and take reasonable steps to assist in the investigation, mitigation and remediation of the breach. For the avoidance of doubt, unsuccessful or immaterial security events that do not result in unauthorised access to, or compromise of, Customer Personal Data do not constitute a Personal Data Breach for the purposes of this Section and are not individually notifiable, including pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial-of-service attacks that do not result in the relevant service being taken offline, and similar events that do not result in unauthorised access to or compromise of Customer Personal Data.

Data Protection Impact Assessment

Kendis shall provide reasonable assistance to the Customer with data-protection impact assessments and prior consultations with Supervisory Authorities that the Customer reasonably considers required under Article 35 or 36 GDPR, in each case solely in relation to the Processing of Customer Personal Data and taking into account the nature of the Processing and the information available to the Contracted Processors.

Deletion and Return

(a)

On expiry or termination of the Cloud Services involving Processing (the “Cessation Date”), Kendis shall, at the Customer’s election notified within thirty (30) days of the Cessation Date, return a complete copy of the Customer Personal Data to the Customer by secure file transfer in a reasonable format, and/or delete and procure the deletion of all copies. Absent such election, Kendis shall delete the Customer Personal Data within ninety (90) days of the Cessation Date. This Section applies except as otherwise provided in the Principal Agreement in respect of data on expiry or termination, including any provisions of the Principal Agreement that limit post-expiry export or provide read-only access only, which prevail over this Section.

(b)

Each Contracted Processor may retain Customer Personal Data to the extent and for the period required by applicable law, provided it maintains the confidentiality of, and does not further Process, such data except as required by that law.

(c)

Kendis shall, on request, certify in writing its compliance with this Section.

Audit and Compliance

Kendis shall demonstrate compliance with this DPA through documentary evidence. On reasonable written request (no more than once per calendar year, except following a confirmed Personal Data Breach affecting Customer Personal Data or where required by a competent Supervisory Authority), Kendis shall provide, within thirty (30) days: its current ISO/IEC 27001 certificate (or a substantially equivalent recognised certification); the most recent third-party security and compliance reports of its key Subprocessors as identified in the Schedule, as made available under those Subprocessors’ own compliance programmes; a summary of its most recent third-party penetration test; and a completed security questionnaire in a format reasonably required by the Customer. Information provided under this Section is Kendis’s Confidential Information. Customer Personal Data is hosted by the Subprocessors identified in the Schedule in their data centres; inspection of those facilities is governed by those Subprocessors’ own audit programmes and certifications, and on-site audits at Kendis’s premises are not available, as Customer Personal Data is not stored there. Where, after good-faith review of the documentary evidence, the Customer has a reasonable, specific and material concern that has not been adequately addressed, the Parties shall promptly meet and confer in good faith, including through written follow-up, additional documentation, or remote walk-through sessions as appropriate. Where required by a competent Supervisory Authority or by mandatory Applicable Laws, Kendis shall additionally provide such cooperation as is legally required.

Hosting Regions and Restricted Transfers

(a)

Kendis warrants that Standard Contractual Clauses (or another lawful transfer mechanism) are in place to legitimise all Restricted Transfers, and that the Schedule contains an accurate list of the Subprocessors engaged for each Hosting Region and the corresponding transfer mechanisms relied upon.

(b)

Where the EU Cloud (Germany) Hosting Region applies, Customer Personal Data other than Account Data is stored and Processed within the European Economic Area as described in the Schedule, and no Restricted Transfer of that data arises in the ordinary provision of the Cloud Services.

(c)

Where the United States Hosting Region applies, and in all cases in respect of Account Data, Customer Personal Data may be transferred outside the European Economic Area, and such transfers are legitimised by the Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework (or a successor framework), as identified in the Schedule. If a transfer mechanism is invalidated, the Parties shall work together in good faith to implement an alternative lawful basis without undue delay.

US State Privacy Laws

This Section applies where US state privacy or data-protection laws apply to the Processing of Customer Personal Data, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (“CCPA”) and comparable laws of other US states (including, as applicable, Virginia, Colorado, Connecticut, Utah and Texas) (together, “US Privacy Laws”). Where this Section applies: (a) Kendis acts as a “service provider” or “processor” and the Customer acts as the “business” or “controller”; (b) Kendis shall not Sell or Share Customer Personal Data, and shall not retain, use or disclose Customer Personal Data (i) for any purpose other than the specific Business Purpose of providing the Cloud Services, (ii) outside the direct business relationship between the Parties, or (iii) by combining it with personal information obtained from sources other than the Customer, except as permitted by US Privacy Laws; (c) Kendis certifies that it understands the restrictions in this Section and will comply with them, and will notify the Customer if it determines it can no longer meet its obligations under US Privacy Laws; (d) Kendis shall provide the same level of privacy protection as is required of businesses by US Privacy Laws, and shall reasonably assist the Customer in responding to verifiable consumer requests (such as access, deletion, correction and opt-out) relating to Customer Personal Data; and (e) Kendis shall enable the Customer to take reasonable and appropriate steps to help ensure that Kendis uses Customer Personal Data in a manner consistent with the Customer’s obligations under US Privacy Laws, and shall, on reasonable notice, allow the Customer to take reasonable steps to stop and remediate any unauthorized use of Customer Personal Data.

Liability, Precedence and General

(a)

All liability arising under or in connection with this DPA and the Standard Contractual Clauses is subject to, and counts towards, the limitations and exclusions of liability in the Principal Agreement. This DPA creates no separate or additional remedy. This Section does not limit liability to the extent such limitation is not permitted by Applicable Laws.

(b)

In the event of conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail in respect of Restricted Transfers. Otherwise, in the event of conflict between this DPA and the rest of the Principal Agreement regarding the Processing of personal data, this DPA prevails, save that the provisions of the Principal Agreement concerning data on expiry or termination prevail over Section 10 (Deletion and Return).

(c)

This DPA is governed by, and subject to the jurisdiction stipulated in, the Principal Agreement.

(d)

If Kendis receives a legally binding request from a public authority for access to Customer Personal Data, it shall, where legally permitted: (i) promptly notify the Customer; (ii) inform the authority of its contractual obligations and direct the request to the Customer; and (iii) use reasonable efforts to challenge requests that are unlawful or overbroad. Kendis shall provide annual transparency information regarding such requests to the extent permitted by law.

(e)

Kendis may update this DPA from time to time by publishing an updated version at trust.kendis.io/dpa. An update that materially reduces the protections available to the Customer under this DPA takes effect, for the Customer’s existing subscription or trial, at the start of the Customer’s next renewal or subsequent purchase; other updates take effect on publication. The version of this DPA applicable to the Customer at any time is the version then in force, as recorded in the version history below.

(f)

This DPA takes effect on the effective date of the Principal Agreement and remains in force for as long as Kendis Processes Customer Personal Data under the Principal Agreement. Sections 4, 8, 10, 11 and 14 survive termination or expiry.

Annex 1

Details of Processing

This Annex sets out the information regarding the Processing of Customer Personal Data required by Article 28(3) GDPR.

Subject matter and duration. As set out in the Principal Agreement and this DPA; for the duration of the Cloud Services and any retention period required by applicable law.

Nature and purpose. Processing to provide the Kendis Cloud Services in accordance with the Principal Agreement, including hosting and visualising work-management data extracted from the Customer’s connected ALM tools.

Categories of data subjects. End users of the Cloud Services, and individuals whose personal data is supplied by such end users.

Types of personal data. Direct identifiers (first name, last name, email); device and traffic data (e.g., IP and MAC addresses); and any personal data supplied by users of the Cloud Services.

Special categories of data. None. Kendis does not knowingly collect, and the Customer and its users shall not submit, special categories of data as defined under EU Data Protection Laws.

Location of Processing. As set out in the Hosting and Subprocessor Schedule for the applicable Hosting Region.

Annex 2

Subprocessors

The Subprocessors engaged by Kendis, the Hosting Regions in which they operate, and the transfer mechanisms relied upon are identified in the Hosting and Subprocessor Schedule published at trust.kendis.io/subprocessors. The Schedule is incorporated into this DPA by reference and is updated in accordance with Section 6 (Subprocessing). Kendis remains fully liable to the Customer for the performance of its Subprocessors’ obligations.

Annex 3

Standard Contractual Clauses

(a)

This Annex incorporates the Standard Contractual Clauses approved by the European Commission for controller-to-processor and processor-to-processor transfers (Commission Implementing Decision (EU) 2021/914), as applicable to the relevant Restricted Transfer. The full text of the SCCs is incorporated by reference and available at the official European Commission source. Where the Parties execute a separate SCC document, that executed document governs.

(b)

The SCCs apply to all transfers of Customer Personal Data between Kendis and the Customer, and to Subprocessor transfers as described in the Schedule, where such transfers are Restricted Transfers.

(c)

For transfers outside the EEA, including to the United States, the Parties shall comply with applicable Data Protection Laws and rely on an appropriate transfer mechanism, including the EU–U.S. Data Privacy Framework (or a successor) or the SCCs. If a mechanism is invalidated, the Parties shall implement an alternative lawful basis in good faith without undue delay.

(d)

Any amendment to these SCCs must be agreed in writing by both Parties, except that Kendis may make changes required by regulatory change on notice to the Customer, implemented in compliance with applicable laws.

(e)

In the event of conflict between these SCCs and the rest of the Principal Agreement, these SCCs prevail with respect to Restricted Transfers and international data-transfer compliance.

(f)

If Kendis receives a legally binding request from a public authority for access to Customer Personal Data, it shall handle the request in accordance with Section 14 (Liability, Precedence and General) and the requirements of the SCCs.

History

Version History

Version 1.010 August 2026Initial publication.

Customers with a signed agreement with a Kendis contracting entity, and customers with self-hosted deployments, are governed by the data-processing terms of their agreement rather than this DPA. For the data-processing terms applicable to your deployment, hosting arrangement or location, contact Kendis at security@kendis.io.

Choose your language

KENDIS DATA PROCESSING ADDENDUM