Νομικά

Data Processing Addendum

Last updated: 4 November 2026

This Addendum governs the processing of personal data that Kobem carries out on behalf of its customers and gives effect to Article 28 of Regulation (EU) 2016/679 (GDPR). It forms part of the Terms of Service and is accepted when the service is contracted. If you need a signed copy for your records, write to us and we will send one.

1. Parties and roles

Controller: the customer, that is, the real estate company that contracts Kobem. It decides why and how the data of the people who call it is processed.

Processor: KOBEM TECHNOLOGIES - FZCO, a free zone company with limited liability (FZCO) incorporated in Dubai Silicon Oasis under Dubai Law No. 16 of 2021 and the DIEZA Implementing Regulations 2023, registration No. 85517 and trade licence No. 92297, issued by the Dubai Integrated Economic Zones Authority (DIEZA), IFZA Properties, Premises DSO-IFZA, Dubai Silicon Oasis, Dubai, United Arab Emirates. It processes that data solely on behalf of the controller and never for purposes of its own.

Were Kobem to determine the purposes or means of processing on its own, it would be liable as a controller for that particular processing (Article 28(10) GDPR). That is not what we do and not what we plan to do.

2. Subject matter, duration, nature and purpose

Subject matter: the provision of the service of answering, qualifying and recording the controller's inbound calls.
Duration: for as long as the subscription is in force, plus the return and deletion period in clause 9.
Nature and purpose: receiving and recording calls, transcription, analysis of the conversation, qualification of the contact, scheduling of viewings, and making all of it available to the controller in its dashboard and in the integrations it connects.
Types of data: identification and contact data (name, phone, email), the content of the conversation (audio and transcript) and the data derived from it (reason for the call, area, budget, timing, preferences).
Categories of data subjects: the people who call the controller — buyers, tenants, owners —, the people the controller loads as contacts, and the people it authorises to use the dashboard.

The service is not designed to process special categories of data under Article 9 GDPR. The controller undertakes not to configure questions aimed at obtaining them. The dashboard warns when it detects that a question may touch a protected category, without detecting them all.

3. The controller's instructions

Kobem processes personal data solely on documented instructions from the controller. Documented instructions are: these Terms, this Addendum and the configuration the controller sets in its dashboard — the greeting, the questions, the integrations it enables and the notices.

If Kobem believes an instruction infringes data protection law, it will inform the controller without delay and may suspend execution until the matter is clarified.

Kobem does not use the content of conversations to train its own or third-party models, nor for any purpose other than providing, maintaining and correcting the service for the controller.

4. Confidentiality

Kobem ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access is limited to those who need it to operate and support the service.

5. Security measures

Kobem implements the appropriate technical and organisational measures required by Article 32 GDPR. They are described, including what exists and what does not, on the Security and data protection page, which forms part of this Addendum for the purpose of evidencing those measures.

Measures may evolve with the state of the art. Kobem will not reduce the level of security contracted during the term of the agreement.

6. Sub-processors

The controller grants general authorisation for Kobem to engage the sub-processors necessary to provide the service. The current list is as follows:

Supabase — Database and storage of call recordings (EU)
Vercel — Hosting of the web application (EU / USA)
LiveKit Cloud — Audio transport, voice engine hosting and recording (EU / USA)
OpenAI — Voice processing for calls (USA)
Anthropic — Call analysis and summary, and dashboard assistant (USA)
didlogic — Telephony: numbering and call transit (EU / UK / Singapore)
Resend — Delivery of service emails (USA)
Telegram — Notifications and call audio, only if the customer links their account (International)
Slack — Alerts in a channel, only if the customer connects it (USA)
HubSpot — Lead sync, only if the customer connects it (USA)
Google Workspace — Calendar and Sheets, only if the customer connects them (USA)
Cal.com — Scheduling, only if the customer connects it (USA)

Sub-processors for optional integrations only come into play if the controller connects that integration from its dashboard.

Kobem uses sub-processors under their terms of service and data processing terms, and remains liable to the controller for their performance on the terms of this Addendum. Optional integrations the controller switches on, such as Telegram, are governed by their provider's terms.

Kobem will inform the controller of the addition or replacement of a sub-processor at least thirty days in advance. Within that period the controller may object on reasonable data protection grounds; if the objection cannot be resolved, the controller may terminate the affected part of the service without penalty.

7. Data subject rights

Kobem assists the controller, by appropriate technical and organisational measures and insofar as this is possible, in fulfilling requests for access, rectification, erasure, objection, restriction and portability.

In practice, the dashboard lets the controller view any call, recording, transcript and lead, export calls and leads and remove calls by itself. Export of transcripts and recordings and permanent deletion are done on request, by writing to contact@kobem.ai. If we receive a request directly from a data subject, we will not answer it ourselves: we will pass it to the controller without delay.

8. Personal data breaches and assistance

Kobem will notify the controller of any personal data breach without undue delay and in any event within 72 hours of becoming aware of it, with the information available at that time: the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed.

Kobem also assists the controller in complying with Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to it.

9. Return and deletion on termination

On termination of the agreement, and at the controller's choice, Kobem will return or delete the personal data processed on its behalf.

Unless instructed otherwise, the controller has thirty days from termination to export its data: calls and leads from the dashboard, and transcripts and recordings on request. After that period Kobem deletes it, including recordings and transcripts, except for what it must keep under a legal obligation and for as long as that obligation requires, keeping it blocked.

10. Audit and information

Kobem makes available to the controller the information necessary to demonstrate compliance with this Addendum and Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the controller or an auditor it mandates.

Audits are agreed with reasonable notice, no more than once a year save for a security incident or a supervisory authority's requirement, are limited to what is necessary, and respect the confidentiality of other customers' and our providers' information.

11. International transfers

The database and recordings are stored in the European Union. Some sub-processors, marked in the list above, process data outside the European Economic Area.

When a transfer requires a safeguard, it relies on the standard contractual clauses approved by the European Commission or another valid mechanism under Chapter V GDPR. The controller authorises those transfers by accepting this Addendum.

12. Term and governing law

This Addendum takes effect when the service is contracted and remains in force for as long as Kobem processes personal data on behalf of the controller. In the event of conflict between this Addendum and the Terms of Service on data protection matters, this Addendum prevails. Clause 15 of the Terms of Service also limits liability arising from this Addendum, except where the law prevents it.

Where the processing is subject to the GDPR, this Addendum is construed in accordance with it, without prejudice to the governing law and jurisdiction clause of the Terms: These Terms are governed by the laws of the United Arab Emirates and the parties submit to the courts of Dubai. If you contract as a consumer or reside in the European Union, this clause does not deprive you of the protection afforded by the mandatory rules of your country of residence, nor of your right to bring proceedings before the courts of that country.

For any question about this Addendum, or to request a signed copy, write to contact@kobem.ai.

Schedule 1 · Details of processing

This Schedule corresponds to Annex I.B of the Standard Contractual Clauses. It describes the categories of data processed on behalf of the controller, the purpose, the retention period and the categories of data subjects.

Category of data	Purpose	Retention	Data subjects
Call content	Answer the inbound call, hold the conversation, transcribe it and recognise callers who are already contacts or have called before.	For the term of the subscription and until the customer asks for its deletion. The customer can remove any call from their dashboard at any time.	People who call the customer: buyers, tenants and property owners. Also the people the customer loads as contacts.
Contact and qualification data	Identify the caller and record what they need: reason, area, budget, timing and preferences.	For the term of the subscription and until the customer asks for its deletion.	People who call the customer.
Customer account data	Create and administer the account, provide support and bill.	While the account is active, plus the accounting retention periods required by law.	Customer personnel authorised to use the dashboard.
Usage data and technical logs	Maintain the service, diagnose incidents, prevent fraud and measure consumption.	As long as necessary for those purposes and, for telephony records, as required by carrier obligations.	Customer personnel and callers.

Frequency of transfer: continuous, for the term of the agreement. Nature of the processing: as described in clause 2.

Special categories of data: the service is not designed to process them and the controller undertakes not to configure questions aimed at obtaining them. If a data subject nonetheless mentions them spontaneously during a call, they will remain in the recording and the transcript, and the controller can remove the call from the dashboard and request its permanent deletion.

Schedule 2 · Technical and organisational measures

This Schedule corresponds to Annex II of the Standard Contractual Clauses and describes the measures Kobem applies under Article 32 GDPR. They are verifiable measures in force, not objectives.

Measure	How it is met
Pseudonymisation and encryption of personal data	Website, dashboard and API traffic is encrypted in transit with TLS 1.2 or above, and audio in the browser with DTLS-SRTP under the WebRTC standard. Data at rest is encrypted with AES-256 in the database and in the recording store. Customer integration credentials are further encrypted with AES-256-GCM before storage, using a key that does not reside in the database.
Confidentiality, integrity, availability and resilience of processing systems	The infrastructure runs on providers with redundancy and automatic recovery. Object storage is redundant by the provider's design.
Ability to restore availability and access to data after an incident	Database backups managed by the provider.
User identification and authorisation	Each user signs in with their own account, managed by Supabase Auth. Only authorised Kobem staff access customer data, to provide support, maintain the service and fix errors.
Isolation of data between customers	Every table holding customer data has PostgreSQL row-level security (RLS) enabled, and each account's data is also separated in server code.
Protection of data during transmission	Website, dashboard and API traffic is encrypted. Service security headers include HSTS, a strict referrer policy, protection against framing by third parties and blocking of content-type sniffing. On routes where a session identifier travels in the URL, no referrer is sent at all.
Protection of data during storage	Call recordings are held in a private store whose address is never published: each playback generates a signed link that expires after sixty seconds. The database stores the file path, never a permanent address.
Physical security of processing locations	Kobem operates no data centres of its own. Physical processing is carried out by the infrastructure providers identified in the sub-processor list, in their certified facilities.
Event logging	The database keeps each call's status and diagnostics; hosting logs last as long as the provider sets.
System configuration and secret management	No credential is written into the source: all are injected as environment variables by the hosting provider, and files that could contain them are excluded from version control. Elevated-privilege keys are used on the server only and are never exposed to the browser.
Data minimisation	Only the data necessary to provide the service is processed, as described in Schedule 1. The dashboard warns the customer when it detects that a question they configure may touch a special category of data under Article 9 GDPR, without detecting them all.
Limited data retention	Retention periods are those in Schedule 1. The customer can remove any call from their dashboard at any time; permanent deletion, with its recording and transcript, is done on request. Artificial-intelligence providers do not use conversation content to train models and keep it only for the time set by their terms.
Portability and erasure	The customer can view their data, export calls and leads and remove calls from their dashboard. Export of transcripts and recordings, permanent deletion and any other request are handled by writing to contact@kobem.ai.
Technical and organisational measures of sub-processors	Kobem uses sub-processors under their terms of service and data processing terms, and remains liable to the customer for their performance on the terms of this Addendum. Optional integrations the customer switches on, such as Telegram, are governed by that provider's terms.

Measures may evolve with the state of the art. Kobem will not reduce the level of security during the term of the agreement.

Schedule 3 · Cross-border transfer mechanisms

Kobem is established in the United Arab Emirates, outside the European Economic Area, and some sub-processors process data in the United States. Where the processing is subject to the GDPR, those transfers rely on the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, which are deemed incorporated into this Addendum by reference and entered into by both parties on acceptance of the agreement.

Module Two (controller to processor) applies where the customer is a controller, and Module Three (processor to processor) where the customer acts as a processor on behalf of a third party. In clause 7 the docking clause does not apply; in clause 9, Option 2 applies, with the thirty-day notice period in clause 6 of this Addendum; in clause 11 the optional language does not apply; in clause 17 Irish law governs and in clause 18(b) the courts of Ireland have jurisdiction.

For the purposes of Annex I.A of the Clauses: the exporter is the customer, at the contact details designated in their account; the importer is Kobem, at the data protection contact given in this document. Annex I.B is Schedule 1 of this document, Annex II is Schedule 2, and the list of sub-processors is published on the Sub-processors page. The competent supervisory authority is that of the Member State in which the exporter is established.

For transfers from the United Kingdom, the ICO International Data Transfer Addendum (version B1.0) applies; for transfers from Switzerland, the Clauses are read with the adaptations of the Swiss FADP, the competent authority being the Federal Data Protection and Information Commissioner.

Schedule 4 · Jurisdiction-specific terms

European Union and European Economic Area. Regulation (EU) 2016/679 applies. This Addendum gives effect to its Article 28(3). The customer may lodge a complaint with the supervisory authority of their Member State.

United Kingdom. The UK GDPR and the Data Protection Act 2018 apply, and references to the GDPR are read as references to that legislation. The competent authority is the Information Commissioner’s Office.

United Arab Emirates. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) applies. Kobem expressly discloses that data is stored in the European Union and that its processing therefore involves a transfer outside the Emirates; the customer authorises that transfer by accepting this Addendum. Call recording requires consent; the service includes the prior notice by default.

Spain. Alongside the GDPR, Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights applies. The competent authority is the Spanish Data Protection Agency.