Jurisdiction Specific Terms

Last Updated: October 14, 2026

Jurisdiction Specific Terms. Certain jurisdictions require other specific terms. Where required under applicable Data Protection Law, this DPA fully incorporates the applicable Jurisdiction Specific Terms as follows:

European Economic Area, United Kingdom, and Switzerland:
Transfers of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland are governed by the Standard Contractual Clauses as incorporated in Section 8.2 of the DPA. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0, issued by the Information Commissioner’s Office) is incorporated, and the information required by its tables is completed with the information in the DPA and its Appendices. For transfers subject to the Swiss Federal Act on Data Protection, the EU Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority. KYRO does not participate in the EU-U.S. Data Privacy Framework.

State of California, United States:
The California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations.

KYRO’s obligations to Customer under the DPA are only those express obligations imposed by the CCPA that require that a “Business” and a “Service Provider” to have in place. Each party is responsible for fulfilling its respective obligations set out in the CCPA.

KYRO will not collect, sell, retain, disclose or use the Personal Information of the Consumer for any purpose other than to perform the Services specified in the Agreement, or as otherwise permitted by CCPA. KYRO certifies that it understands and will comply with the restrictions set forth herein. KYRO will not (a) sell or share Customer Personal Information, (b) retain, use, or disclose Customer Personal Information outside the direct business relationship with Customer, or (c) combine Customer Personal Information with personal information KYRO receives from other sources, except as permitted by the CCPA. KYRO will notify Customer if it determines it can no longer meet its obligations under the CCPA, and Customer may then take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Information.

The terms used in the applicable provisions of the DPA shall be replaced as follows: “Personal Data” shall mean "Personal Information"; "Controller" shall mean "Business"; "Processor" shall mean "Service Provider"; and "Data Subject" shall mean "Consumer" (collectively, the “replaced terms”). Further, the replaced terms shall have the definitions ascribed to in the CCPA.

Other U.S. States:
State consumer privacy laws other than the CCPA, including those of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, each as amended (“U.S. State Privacy Laws”).

Where a U.S. State Privacy Law applies, KYRO acts as a “processor” and will: (a) process Customer Personal Data only on Customer’s Documented Instructions; (b) ensure that each person processing Customer Personal Data is subject to a duty of confidentiality; (c) at Customer’s direction, delete or return Customer Personal Data at the end of the provision of the Services, unless retention is required by law; (d) make available to Customer the information in its possession reasonably necessary to demonstrate compliance, including by providing KYRO’s SOC 2 Type II report as described in Section 6.2 of the DPA, which the parties agree satisfies any requirement to allow and contribute to reasonable assessments; and (e) engage Subprocessors only under written contracts requiring them to meet KYRO’s obligations for Customer Personal Data, after giving Customer notice and an opportunity to object as described in Section 5 of the DPA.

Canada (including Québec):
The Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Québec’s Act respecting the protection of personal information in the private sector, as amended by Law 25 (the “Québec Privacy Act”), and any substantially similar provincial privacy laws.

KYRO processes Customer Personal Data as a service provider to Customer and will protect it with security safeguards appropriate to its sensitivity. Customer acknowledges that Customer Personal Data may be stored and processed outside Canada, including in the United States and India, where it may be subject to access by courts, law enforcement, and national security authorities under local law. Before communicating Customer Personal Data outside Québec, Customer is responsible for conducting any privacy impact assessment required by Section 17 of the Québec Privacy Act, and KYRO will provide information reasonably requested by Customer to support that assessment. KYRO will notify Customer without undue delay of any “confidentiality incident” (as defined in the Québec Privacy Act) or breach of security safeguards affecting Customer Personal Data, so that Customer can meet its own notification and record-keeping obligations.

Australia:
The Privacy Act 1988 (Cth), including the Australian Privacy Principles (“APPs”).

KYRO will handle Customer Personal Data in a manner consistent with the APPs applicable to it as Customer’s contracted service provider, and will not use or disclose Customer Personal Data except to provide the Services or as required by law. Customer acknowledges that Customer Personal Data may be disclosed to and processed by KYRO, its Affiliates, and its Subprocessors outside Australia, including in the United States and India, and that KYRO’s obligations under the DPA constitute reasonable steps for purposes of APP 8.1. KYRO will notify Customer without undue delay of any Personal Data Breach affecting Customer Personal Data so that Customer can assess whether an eligible data breach has occurred and meet its obligations under the Notifiable Data Breaches scheme.