1. Overview
This Data Processing Agreement forms part of the agreement between the customer and Kommon Poll where Kommon Poll processes Customer Data on behalf of the customer as a processor or service provider.
It is designed for the way Kommon Poll operates: customer-configured searches, tracked sources, tracking credits, dashboards, alerts, exports, reports, Kommon Poll AI, and support interactions.
2. Roles of the parties
The customer is the controller of Customer Data and determines the purposes and means of processing. Kommon Poll processes Customer Data as a processor on the customer's documented instructions, except where applicable law requires otherwise.
For account, billing, website, security, support, sales, marketing, and internal business operations data, Kommon Poll may act as a controller as described in the Privacy Policy.
3. Processing instructions
The customer instructs Kommon Poll to process Customer Data to provide, secure, support, maintain, improve, and administer the Service, including searches, data collection, enrichment, storage, analysis, AI-assisted processing, dashboards, alerts, reports, exports, integrations, troubleshooting, and customer support.
The customer may provide additional instructions through the Order Form, account settings, support requests, or written agreement. Kommon Poll is not required to follow instructions that are unlawful, technically infeasible, outside the Service scope, or inconsistent with the agreement.
4. Processing details
| Item | Details |
|---|---|
| Subject matter | Provision of Kommon Poll social listening, brand intelligence, AI analysis, reporting, alerting, integrations, and support. |
| Duration | For the term of the customer relationship and any retention period required by the agreement, law, backups, dispute resolution, or security needs. |
| Nature and purpose | Hosting, collection, searching, monitoring, storage, enrichment, deduplication, translation, classification, sentiment analysis, intent analysis, topic modelling, AI summarisation, reporting, exporting, alerting, support, troubleshooting, security, and administration. |
| Categories of data subjects | Customer users and administrators; public-source authors or users; individuals mentioned in public content; customer contacts; support contacts; and other individuals whose data is included in Customer Data. |
| Categories of personal data | Names, emails, handles, usernames, public profile information, public posts, comments, reviews, engagement metrics, URLs, timestamps, location cues, device or usage data, prompts, report content, and other data configured or submitted by the customer. |
| Sensitive data | The Service is not intended for unnecessary sensitive data. Customers must avoid submitting sensitive data unless they have a lawful basis and appropriate safeguards. Public Source Data may incidentally include sensitive information depending on the source and search configuration. |
5. Customer obligations
The customer is responsible for:
- ensuring it has a lawful basis, notices, consents, permissions, and rights to use Customer Data and configure searches or tracking links;
- ensuring Authorised Users comply with the agreement and applicable law;
- responding to data subject requests where the customer is the controller;
- using reports, exports, and AI outputs lawfully and responsibly;
- setting appropriate access controls, retention practices, and internal governance; and
- not instructing Kommon Poll to process data unlawfully.
6. Confidentiality and personnel
Kommon Poll will ensure that personnel authorised to process Customer Data are subject to appropriate confidentiality obligations and process Customer Data only as needed to provide and support the Service.
7. Security measures
Kommon Poll will maintain reasonable technical and organisational measures designed to protect Customer Data from unauthorised access, accidental or unlawful destruction, loss, alteration, disclosure, or misuse.
Measures may include access controls, authentication, role-based permissions, encryption in transit, infrastructure safeguards, logging, monitoring, backup practices, incident-response processes, confidentiality obligations, vendor review, and least-privilege access.
Additional general security information is available on our Security page.
8. Subprocessors
The customer authorises Kommon Poll to use subprocessors to provide the Service. Subprocessors may include hosting providers, cloud infrastructure, data processing providers, AI providers, analytics providers, payment providers, email providers, support providers, security tools, and other operational vendors.
Kommon Poll will impose data-protection obligations on subprocessors that are appropriate to the nature of the services they provide. We remain responsible for subprocessors as required by applicable law and the agreement.
Our current operational subprocessor list is available on the Subprocessors page.
9. Data subject requests
Where Kommon Poll receives a request from a data subject relating to Customer Data, we may direct the requester to the customer or notify the customer where legally permitted. Kommon Poll will provide reasonable assistance for customer responses to data subject requests, taking into account the nature of processing and the functionality available in the Service.
10. Security incidents
Kommon Poll will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Data, where required by applicable law. The notice will include information reasonably available to us to help the customer meet its obligations.
Notification of an incident is not an admission of fault or liability.
11. Audits and information
Upon reasonable written request, Kommon Poll will provide information necessary to demonstrate compliance with this DPA, subject to confidentiality, security, legal, commercial, and operational limitations. Audits must be reasonable, not disrupt operations, and not expose other customers' data or confidential information.
12. International transfers
Customer Data may be processed in countries where Kommon Poll, its affiliates, or subprocessors operate. Where required, Kommon Poll will use appropriate safeguards for international transfers.
13. Return and deletion
Upon termination or expiry of the Service, Kommon Poll will delete or return Customer Data in accordance with the agreement, account functionality, backup practices, legal requirements, and operational retention needs. Some data may remain in backups or logs for a limited period before deletion according to standard retention cycles.
Additional retention and deletion detail is available in the Data Retention and Deletion Policy.
14. Order of precedence
If there is a conflict between this DPA and the Terms of Service regarding processing of Customer Data as a processor, this DPA will control to the extent of the conflict. The Order Form may include additional or more specific data-processing terms.
15. Contact
For data processing questions, contact:
Synapse Artificial Intelligence Labs (Pvt) Ltd
132/12, Hiripitiya, Pannipitiya, Sri Lanka
Email: help@kommonpoll.com