kilili
Book a call

Data processing agreement

Updated 2026-10-12

This agreement is part of the Terms. It applies between you, the organisation that holds a Kilili account, and Kilili, from the moment you accept the Terms at sign-up. It sets out how Kilili handles personal data on your behalf, as Article 28 of the GDPR requires of a processor. The four annexes at the end are part of it. A countersigned PDF is available on request from contact@kilili.io.

1. Parties, definitions and precedence

You are the organisation that created an account with a verified business email address and accepted the Terms. You act through your users.

Kilili is, until the company is incorporated, Nur Alda-Onggar and Yerkebulan Serikov, the two founders, in the Netherlands, acting together. On incorporation the company takes over this agreement by assignment, and your account owners are told by email. The company's registration numbers are added here on incorporation.

These words have a fixed meaning in this agreement.

Where this agreement and the Terms say different things about personal data, this agreement applies. On everything else, the Terms apply. Accepting the Terms at sign-up accepts this agreement in electronic form, which the GDPR allows.

2. Roles

You are the controller of candidate data processed for your roles, and of what your users write and do inside your workspace. You decide which roles to publish, what a role asks for, whom to contact, when to stop and when to delete.

Kilili is your processor for that data. It processes it only on your documented instructions and for no purpose of its own. Kilili does not reuse candidate data across customers, never uses it to train models, and keeps suppression lists per customer.

The one exception is a law of the European Union or of a member state that applies to Kilili and requires it to process the data otherwise. In that case Kilili tells you about the requirement before it acts, unless that law forbids telling you.

Kilili is a controller only for the data listed in Annex 4: your account, including your users' sign-in addresses and sessions, billing, support and the service data needed to run and secure the service. None of it includes candidate content. The Privacy Policy covers that data.

The provider of your own mailbox is your own processor under your agreement with it, not a sub-processor of Kilili. 'Kilili Mail' is the application you authorise on that mailbox. Annex 3 lists what it is allowed to do.

The recruitment data provider from which profiles are retrieved is a source of the data, described in Annex 1, not a sub-processor.

3. Instructions

This agreement, with Annex 1, is your complete documented instruction. You give further instructions through the service itself: by describing a role and your company profile, publishing a role, placing a sourcing order, asking for a candidate's email address, approving an email, closing a role, deleting data or disconnecting your mailbox.

A sourcing order is the sourcing instruction, and it covers every round run to carry it out. Annex 1 sets it out in full. In short: in each round Kilili retrieves up to ten public professional profiles that closely fit the role from a recruitment data provider, with the personal email address the provider holds for each, screens them against the role and your company profile, shows every one of them on your board with its fit for the role and its fit for your company's working style, drafts an email for your approval, sends it from your own mailbox with at most one follow-up, brings the replies back into your workspace, and deletes on the schedule in Annex 1.

A sourcing order after the first means "N more": the number of additional candidates you ask for, counted from what is on your board. It is never a new total.

Kilili processes candidate data only for your recruitment for the role concerned. If Kilili believes an instruction breaks data protection law, it tells you before acting on it, and may hold the instruction until you confirm or change it.

An instruction the service cannot take goes by email from an account owner to contact@kilili.io.

Kilili does not seek special categories of personal data. You must not enter them in a role, a company profile or an email.

4. Confidentiality and security

Everyone who processes personal data for Kilili, the founders included, is bound by a duty of confidentiality that continues after their work for Kilili ends.

Kilili maintains the technical and organisational measures in Annex 2. It may change them as the service develops, but not in a way that lowers the overall level of protection.

Kilili helps you meet your own security obligations with the information in Annexes 1 to 3, and answers reasonable questions about the measures.

5. Sub-processors

You authorise Kilili to use the sub-processors in Annex 3. Kilili binds each of them by written terms that impose on it the data protection obligations of this agreement, as Article 28(4) of the GDPR requires, and remains responsible to you for their work.

Before a new sub-processor processes your data, or a listed one changes what it does with them, Kilili emails your account owners at least thirty days ahead and adds a dated line to the change log in Annex 3.

You may object within those thirty days on reasonable data protection grounds. Kilili then looks for a way to serve you without the change. If there is none, you may end the affected service, or this agreement together with the Terms, by notice before the change takes effect, and clause 10 applies. That is your remedy for a sub-processor change.

6. Assistance

Kilili helps you answer requests from candidates and users about their rights: access, rectification, erasure, restriction, objection and portability. Where the service can carry out a request, you do it there. For the rest, Kilili provides the data or carries out the request on your instruction within a reasonable time.

A request that reaches Kilili directly is forwarded to you within five business days. Kilili does not answer it in your name unless you ask it to.

An objection made through the "Stop contacting me" link in an outreach email is carried out at once, under your standing instruction in Annex 1.

Every outreach email and follow-up sent through the service carries a link to a candidate notice page for your workspace on app.kilili.io, next to the "Stop contacting me" link. The notice tells the candidate where their details came from, how you and Kilili use them, and how to object. It names you as the party that decides and Kilili as the software you use.

Kilili also helps you with security, breach notification, data protection impact assessments and prior consultation of the supervisory authority. It does so with the facts in Annexes 1 to 3 and by answering reasonable questions about the processing.

7. Personal data breach

Kilili tells your account owners by email without undue delay, and at the latest within 48 hours after becoming aware of a personal data breach affecting your data. The first notice says what is known at that point: what happened, which data and roughly how many people are affected, the likely consequences, what Kilili has done or proposes to do, and whom to contact. Kilili adds the rest as it learns it.

Whether and how to inform the supervisory authority and the people affected is your decision as controller. Kilili helps with the facts. It does not contact the authority or the candidates about your data unless you instruct it to.

8. Transfers

Your data are stored and processed in the European Union, except where Annex 1 and Annex 3 say otherwise. The database is in Frankfurt. The app's functions and scheduled jobs run in Frankfurt. AI inference happens in the United States. The hosting provider's edge network and request logs are global.

For a transfer to the United States, Kilili relies on the EU-US Data Privacy Framework where the vendor is certified, and otherwise on the European Commission's standard contractual clauses. If the framework falls, the clauses apply. Annex 3 lists each vendor and where it is.

Outside the European Union, your data go to the United States, to the vendors Annex 3 places there, and through the hosting provider's edge network and request logs, which are global and covered by that provider's transfer tool in Annex 3. The recruitment data provider receives only what each search needs. Annex 1 says where it is. Kilili makes no other transfer to a third country. A change of vendor location or transfer tool follows clause 5.

9. Audit

Kilili gives you the information you need to show that this agreement is kept: the agreement itself, the annexes, a description of the measures in Annex 2 as applied, and the reports its sub-processors make available. Ask by email; Kilili answers within a reasonable time.

If that information does not suffice, you, or an independent auditor you appoint who is bound to confidentiality, may inspect Kilili's processing of your data, remotely or on site, at most once a year, on thirty days' written notice, during business hours, and in a way that does not disturb the service or expose other customers' data. Kilili cooperates and responds to the findings.

10. Deletion and return

During the agreement, the retention schedule in Annex 1 applies on its own, and you can delete earlier through the service.

When the agreement ends, you have thirty days to retrieve your data. Kilili provides an export in common formats on request.

After those thirty days, Kilili deletes your data: the workspace, the candidates and their emails, the screening reasoning and the drafts, and the copies in backups within 30 days. A profile copy in the shared identity table (Annex 1) is deleted when no customer's record points to it any more. While another customer's record still does, that customer's own instruction governs the copy.

Two things survive. First, what the app needs to work after an opt-out, for your workspace. Kilili keeps it as your processor, under your standing instruction in Annex 1, which continues after the agreement ends for this one purpose: so that a person who objected is never sourced for you again. When someone opts out, Kilili deletes their data and keeps only what the app needs to work, for your workspace alone. Second, the data Kilili holds as controller under Annex 4, for the periods in the Privacy Policy, such as invoices for seven years under Dutch tax law.

11. Support and operational access

The founders may open your workspace to reproduce or fix a problem. They do so at your request or, where practicable, after telling you, and with the least access the problem needs.

What they see is used for nothing else. The duty of confidentiality in clause 4 applies.

12. Liability, law and notices

Liability under this agreement follows the liability clause of the Terms: both sides exclude indirect loss, liability is capped at the fees you paid in the twelve months before the claim, the cap does not apply to intent or deliberate recklessness, and nothing in this agreement creates an uncapped indemnity.

Dutch law applies to this agreement, and disputes go to the courts of the Netherlands.

Notices from Kilili go by email to your account owners. Notices to Kilili go to contact@kilili.io.

Kilili may change this agreement with thirty days' notice by email. If you do not accept a change, you may end the agreement before it applies. Changes to Annex 3 follow clause 5.

This agreement lasts as long as the Terms apply. Clause 10 continues until deletion is complete, and the instruction to keep what the app needs to work after an opt-out continues after that.

Annex 1. Details of processing

Subject matter and duration. The service described in the Terms, for the life of the agreement, plus the thirty-day retrieval window in clause 10 and the deletion that follows it.

Nature and purposes. The purpose is your recruitment for the roles you publish: finding, screening, showing and contacting candidates, and storing their replies. Support for your workspace is a secondary purpose. The processing consists of retrieval from a recruitment data provider, personal email address included, storage, AI screening with written reasoning, showing on your board, drafting, sending from your own mailbox, bringing replies back, and deletion.

Data subjects.

Categories of personal data.

Sources.

The sourcing instruction. When you place a sourcing order, you instruct Kilili to do the following in each round it runs to carry out the order, and nothing more.

  1. Retrieve up to ten public professional profiles that closely fit the role from a recruitment data provider, with the personal email address the provider holds for each, leaving out people already on the role and people on your suppression list.
  2. Screen each profile against the role and your company profile with AI, and write down the reasoning.
  3. Show every retrieved profile on your board, with its fit for the role and its fit for your company's working style.
  4. Draft a personal email with AI. Send it only after a person at your organisation approves it, from your own mailbox. Send at most one follow-up.
  5. Bring the replies to those conversations back into your workspace. Store no other mail.
  6. Keep the data for the periods under Retention below, then delete them.

A further order means "N more": the number of additional candidates you ask for, counted from your board, never a new total. An order can take more than one round, and each round follows the same steps. Whom to contact and whom to meet is decided by a person at your organisation.

When you ask for a candidate's email address, Kilili asks the same provider for it.

Retention.

Locations.

The shared identity table. Kilili stores one copy of a retrieved profile even when more than one customer sourced the same person, to avoid holding the same person twice. Each customer's own records point to that copy. The table is never read to skip a provider query: every round queries the provider. The copy is deleted when no customer's record points to it any more. It is deduplicated storage, not a pool Kilili uses for itself.

Annex 2. Technical and organisational measures

These measures are in place on the date at the top of this page.

Annex 3. Sub-processors

You authorise these sub-processors under clause 5. A change is emailed to your account owners thirty days ahead and recorded in the change log below. Each line gives the vendor, the purpose, the data and the location; clause 8 says which safeguard covers a transfer outside the EU.

Three parties are deliberately not on this list.

Change log.

Annex 4. What Kilili processes as controller next to this agreement

Kilili is the controller for the following data. None of it includes candidate content. The Privacy Policy explains the legal bases and your users' rights.