Kevlex Data Processing Agreement

Last updated: 19 October 2026

Kevlex Management B.V., trading as Kevlex Digital and Kevlex Academy. Sisalbaan 5a, 2352 AZ Leiderdorp, The Netherlands. KvK 81126042. VAT NL861943120B01.

This Data Processing Agreement ("DPA") forms part of every Agreement under which Kevlex processes personal data on the Client's behalf. Terms not defined here have the meaning given in the Kevlex General Terms and Conditions for Services ("General Terms") or in the EU General Data Protection Regulation ("GDPR").

1. Roles

The Client is the controller and Kevlex is the processor of personal data processed under the Agreement. Where US state privacy laws such as the CCPA apply, Kevlex acts as the Client's "service provider" or "processor". Kevlex does not sell or share that personal data and uses it only to perform the Services.

2. Subject matter and details

3. Special categories and HIPAA

The Client will not instruct Kevlex to process special categories of personal data, including health data, unless the parties agree this in writing first.

Kevlex is not a HIPAA business associate. The Client will not send Kevlex protected health information subject to HIPAA unless the parties have signed a Business Associate Agreement.

4. Kevlex's obligations

Kevlex will:

1. process personal data only on the Client's documented instructions, which are the Agreement and the Client's reasonable written instructions, and tell the Client if an instruction appears to breach the law;
2. ensure that staff and contractors with access are bound by confidentiality;
3. take appropriate technical and organizational security measures under Article 32 GDPR, including access control, encryption in transit, multi-factor authentication on admin accounts and least-privilege access;
4. assist the Client, at reasonable cost, with data subject requests, impact assessments and regulator inquiries;
5. make available the information needed to demonstrate compliance with this DPA.

5. Sub-processors

The Client authorizes Kevlex to use the sub-processors listed in Annex 1. Kevlex will notify the Client of any new sub-processor at least 14 days in advance. The Client may object on reasonable data protection grounds in that period. If no solution is found, the Client may terminate the affected Service.

Kevlex imposes equivalent data protection obligations on each sub-processor and remains responsible for their performance.

6. International transfers

Personal data may be processed in the United States and other countries outside the European Economic Area. Where GDPR applies to a transfer, Kevlex relies on an adequacy decision, such as the EU-US Data Privacy Framework for certified recipients, or on the EU Standard Contractual Clauses.

7. Personal data breaches

Kevlex will notify the Client without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Data. The notice will describe the breach, the data and data subjects affected, the likely consequences and the measures taken. Kevlex will reasonably assist the Client with any required notifications to regulators or individuals.

8. Audits

The Client may audit Kevlex's compliance with this DPA once a year, with 30 days' written notice, during business hours and at its own cost. Kevlex may first answer the request with documentation or third-party certifications. Audits are subject to confidentiality and must not disrupt Kevlex's operations.

9. Return and deletion

Within 30 days after the Agreement ends, Kevlex will return Client Data on request, or delete it, unless retention is required by law. Data kept in the Client's own third-party accounts, such as its GoHighLevel account, remains under the Client's control.

10. Liability

The limitation of liability in clause 15 of the General Terms applies to this DPA.

Annex 1 — Sub-processors