Data Processing Agreement
This agreement applies when an organization uses Kalamo to translate for an audience. It sets out how we process personal data on the organization's behalf under Article 28 of the GDPR.
Roles and scope
For personal data processed inside a room or event the Customer runs (for example the speech captured and the resulting translations and any attendee context), the Customer is the controller and ProConf is the processor. The Customer is responsible for having a lawful basis and any required notices or consents for that processing. The details of the processing are set out in Annex I.
Processing on instructions
We process the Customer's personal data only to provide Kalamo and only on the Customer's documented instructions, which include these terms and the Customer's use of the service. We will tell the Customer if an instruction appears to infringe data-protection law, and we will not process the data for our own purposes.
Confidentiality
We ensure that anyone authorized to process the Customer's data is bound by an appropriate duty of confidentiality and processes it only as needed to provide the service.
Security
We implement appropriate technical and organizational measures to protect personal data, taking account of the state of the art and the risks of the processing. These measures are summarized in Annex II and include encryption in transit, access controls, and a least-data design in which audio and slide images are processed transiently and not stored by us, and room transcripts and slide notes are kept only for the Customer to download.
Sub-processors
The Customer gives general authorization for us to engage the sub-processors listed at kalamo.ai/legal/subprocessors, each under a written agreement that imposes data-protection obligations equivalent to these. We keep that list current and will give reasonable notice before adding or replacing a sub-processor, so the Customer can object on reasonable data-protection grounds. We remain responsible for our sub-processors' performance.
International transfers
We process data in the European Union where we can. Some sub-processors process data outside the European Economic Area: Google's AI services route requests globally, and speech recognition runs in the United States. Where a sub-processor processes data outside the European Economic Area, that transfer is made under the European Commission's Standard Contractual Clauses or another approved safeguard, with supplementary measures where appropriate.
Assistance to the Customer
We help the Customer, taking the nature of the processing into account, to:
- respond to requests from individuals exercising their rights;
- meet its security, breach-notification, and data-protection-impact-assessment duties;
- and demonstrate compliance with Article 28.
Personal data breaches
We will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information the Customer reasonably needs to meet its own notification obligations.
Return and deletion
On termination, and at the Customer's choice, we delete or return the Customer's personal data and delete existing copies, unless the law requires us to keep them. Kalamo does not store room audio or slide images, so the data we hold for a Customer is account, billing, and room-metadata records, plus room transcripts, slide notes, and each room's recent captions. The Customer can also ask us to delete those at any time.
Audits
We make available the information needed to demonstrate compliance with Article 28 and allow for reasonable audits by the Customer or its appointed auditor, on reasonable prior notice, no more than once a year unless a regulator requires otherwise or there has been a breach, and in a way that respects the confidentiality and security of other customers' data.
Annexes
Annex I - Details of processing
- Subject matter: providing live speech translation for the Customer's audience through Kalamo.
- Duration: for as long as the Customer uses Kalamo, plus any short legally required retention.
- Nature and purpose: capturing speech, producing translations, delivering them to listeners and any connected display or broadcast output, and keeping room transcripts and slide notes for the Customer to download.
- Types of personal data: the content of speech translated in a room and the resulting text; images of presentation slides used in a room (for a shared window, tab or screen: still images of what was shared), short notes describing them, and which slide was up when; account and contact data of the Customer's users; technical data such as IP and device type. Kalamo is not intended for the deliberate processing of special-category data, and the Customer should not use it for that.
- Categories of data subjects: the Customer's speakers, attendees, and staff who use Kalamo.
Annex II - Security measures
- Encryption of data in transit (HTTPS and secure transport to all providers).
- Transient handling of audio: it is sent to the translation provider to produce the translation and is not stored by us afterward.
- Transient handling of slide images and slide text: from the moment a PDF is loaded, the current slide and the next one, or, when a window, tab or screen is shared, one still image of it each time a new still picture settles in it (normally a new slide, including anything else visible at that moment), are sent to the AI provider to write short notes for the translator and are not stored by us afterward.
- Personal-translation transcripts kept on the end user's device; room transcripts and slide notes downloadable only by the Customer's signed-in users and the room's host.
- Access controls and least-privilege access to systems and data.
- Use of reputable infrastructure and a limited, contracted set of sub-processors.
- Logical separation of customers' data and isolation of room sessions.
Annex III - Sub-processors
The authorized sub-processors are published and kept current at kalamo.ai/legal/subprocessors.