This agreement applies between KLOXA and every business that uses the system, and is part of the Terms of Use. It governs the holding of the personal information that the business manages in the system and its processing, under the Protection of Privacy Law, 5741-1981, and the Protection of Privacy (Data Security) Regulations, 5777-2017. Opening a business account constitutes agreement to this agreement. With regard to the processing of personal information on behalf of the business, this agreement prevails over the Terms of Use.

Which services and addresses this document covers

The KLOXA website - kloxa.io
The management system - workspace.kloxa.io
The KLOXA mobile app
The public pages - kloxa.one: forms, documents, business pages and contact forms
The mailboxes and document intake addresses - kloxa.co.il
Any other address under the KLOXA domains (kloxa.io, kloxa.one, kloxa.co.il)
Messages and notices sent in the name of KLOXA or through it by email, SMS and WhatsApp

The services are operated by KLOXA Ltd., Company No. 517336467 (hereinafter: "KLOXA" or "we"). The same text applies to all the services, and no other text prevails over it.

The roles

The business is the database controller of the information it manages in the system: information about its customers, employees, suppliers and contacts, forms, documents and files. The business determines why the information is collected and what is done with it.
KLOXA is only a holder (processor): it stores and processes the information on behalf of the business, and solely for the purpose of providing the services.
Information about the business owner and the users as users of the system (account, sign-in and billing details) is not part of this agreement, and is governed by the Privacy Policy.

What is processed and why

Types of information: identification and contact details, employment and attendance details, payroll and bank details, accounting documents, form answers and signatures, files, messages and records of actions - according to what the business chooses to enter and enable.
Data subjects: the business's customers, employees, candidates, suppliers and contacts, and users acting on its behalf.
Purpose of processing: providing the services to the business - storage, display, calculation, sending, intake, backup, security and support - according to the business's settings and actions.
Duration of processing: the entire term of the engagement, and afterwards according to the section "End of the engagement".

The business's instructions

KLOXA will process the information only according to the business's instructions. The instructions are the Terms of Use, this agreement, the settings that the business configured in the system and the actions that the business and its users perform in it.
KLOXA will not use the information for its own purposes, will not sell it, will not transfer it to a third party for marketing and will not combine it with information of another business.
If the law requires KLOXA to process information other than according to the business's instructions, it will notify the business in advance, unless the law prohibits this.
If KLOXA believes that an instruction of the business violates the law, it may decline to carry it out and will notify the business of this.

Confidentiality

KLOXA staff access to the information is limited to those who need it for support, security or maintenance purposes, and it is logged and visible to the business.
Everyone with access is bound by confidentiality, in writing, also after the end of their employment.

Information security

KLOXA takes reasonable technical and organizational security measures, under the Protection of Privacy (Data Security) Regulations, including:

Database and file storage on servers in Israel, and enforced isolation between businesses.
Encryption of traffic, and encryption of sensitive fields in the database.
Permission-based access, two-step verification for revealing sensitive information, and a log of actions that is locked against modification and deletion.
Daily backup and a recovery process that is tested.
Monitoring of unusual activity and handling of security incidents.

The business is responsible for security within its control: granting permissions only to those who need them, safeguarding sign-in details, enabling two-step verification, and removing access from anyone who has finished working.

Sub-processors

The business authorizes KLOXA to use sub-processors for the purpose of providing the services - infrastructure and storage providers, network protection, email, SMS, WhatsApp, payment clearing and artificial intelligence (only when a user triggers an AI-based action), and services that the business chose to connect.
Connections the business enabled: a mailbox that the business connected (Google or Microsoft) is read with read-only access and only to import supplier invoices and receipts, and documents sent to KLOXA's WhatsApp bot pass through Meta. KLOXA processes this information on behalf of the business and according to its instructions only.
KLOXA will engage a sub-processor only with a written undertaking of confidentiality and security at a level no lower than that in this agreement, and will remain responsible to the business for its performance under this agreement.
To the extent that a sub-processor processes information outside Israel, the transfer will be made only under the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
A business can request the current list of sub-processors by contacting us.

Assistance to the business

Requests of data subjects: the business owner can access, correct, export and delete information with the tools in the system. A request that reaches KLOXA directly will be forwarded to the business, and KLOXA will assist it in handling the request to a reasonable extent.
Security incident: KLOXA will notify the business without delay of a serious security incident concerning its information, will provide the information it has and will act to limit the damage. The notice is not an admission of liability.
Annual report: At least once a year, KLOXA will provide the business with a written report on how it meets its obligations under the Privacy Protection (Data Security) Regulations and under this agreement.
Inquiries and oversight: KLOXA will provide the business, at its request, with reasonable information about the security measures, so that it can meet its obligations. A further review will be coordinated in advance, to a reasonable extent, at most once a year, subject to confidentiality and at the business's expense, and without exposing information of other businesses or sensitive security details.

The business's responsibility

To collect and enter information only lawfully, to give data subjects the notice required under Section 11 of the Protection of Privacy Law, and to obtain consent where it is required.
To enter only information that is necessary for the purpose for which it was collected, and to correct or delete information that is no longer needed.
To register the database, appoint a privacy protection officer or meet any other obligation - to the extent that the law requires this of the business.
Not to give an instruction that violates the law.
The business is responsible to the data subjects and will indemnify KLOXA for any damage caused by collection, entry or use of information that was unlawful.

End of the engagement

Until the end of the engagement, and afterwards for a reasonable period that we will announce, the business can export the information with the tools in the system.
We do not delete business data automatically. At the business's request, and after it has been able to export it, we will delete the information, except for what must be kept under law and the audit record, and subject to the backup cycle - backup copies are deleted when the backup cycle ends.

Liability and its limitation

The limitation of liability and the other provisions in the Terms of Use also apply to this agreement, to the extent that the law permits.

Contact us

For any question about the Data Processing Agreement: [email protected]

KLOXA Ltd. · Company No. 517336467