Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Kanue ("Processor") and you ("Controller") and governs the processing of personal data by Kanue on your behalf. This DPA is incorporated into and subject to the Terms of Service.

1. Definitions

• "Controller" means the entity that determines the purposes and means of the processing of personal data — i.e. you, the Kanue customer.
• "Processor" means Kanue, which processes personal data on behalf of the Controller.
• "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
• "Data Subject" means an identified or identifiable natural person whose personal data is processed.
• "Personal Data" means any information relating to a Data Subject, as defined in the UK GDPR and EU GDPR.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.

2. Scope and Purpose of Processing

The Processor processes personal data solely for the purpose of providing the Kanue platform and related services to the Controller, as described in the Terms of Service. This includes:

• Storing and managing client contact information (names, email addresses, phone numbers, addresses).
• Processing invoices, proposals, and contracts containing client data.
• Facilitating payment processing through integrated payment providers.
• Sending transactional emails on behalf of the Controller.
• Hosting the client portal and facilitating video calls.
• Providing real-time notifications and collaboration features.

The categories of Data Subjects include the Controller's clients, contacts, and end users of the client portal.

3. Processor Obligations

3.1 Confidentiality

The Processor shall ensure that all persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.2 Security Measures

The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit (TLS 1.2+) and at rest.
• Row-level security ensuring strict workspace data isolation.
• Hashed storage of sensitive tokens (e.g. portal access tokens stored as SHA-256 hashes).
• Regular security testing and vulnerability assessments.
• Access controls limiting personnel access to personal data on a need-to-know basis.
• Automated backups and disaster recovery procedures.

3.3 Assistance with Data Subject Rights

The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under Chapter III of the UK GDPR, including access, rectification, erasure, restriction, portability, and objection requests. The Processor provides data export and deletion tools within the platform to facilitate these requests.

3.4 Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach. The notification shall include the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.

4. Sub-processors

The Controller grants the Processor general written authorisation to engage the following sub-processors. The Processor shall inform the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object.

Each sub-processor is bound by data protection obligations no less protective than those set out in this DPA. The Processor remains fully liable for the acts and omissions of its sub-processors.

5. International Data Transfers

Where personal data is transferred outside of the United Kingdom or European Economic Area, the Processor shall ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs): as approved by the European Commission and the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs.
• Adequacy decisions: where the destination country has been deemed to provide an adequate level of data protection.
• Supplementary measures: additional technical and organisational safeguards where required by the specific transfer risk assessment.

6. Data Retention and Deletion

The Processor shall process personal data only for the duration of the Terms of Service. Upon termination of the agreement or upon the Controller's written request, the Processor shall:

• Delete or return all personal data to the Controller within 30 days.
• Delete existing copies unless applicable law requires storage.
• Provide written confirmation of deletion upon request.

The Controller may export their data at any time using the platform's built-in data export tools. After workspace deletion, all associated personal data will be permanently removed from active systems within 30 days and from backups within 90 days.

7. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

Audits shall be conducted with reasonable notice (at least 30 days), during normal business hours, and shall not unreasonably interfere with the Processor's operations. The Controller shall bear the costs of any audit unless the audit reveals a material breach by the Processor.

8. Liability and Indemnification

Each party shall be liable for any damage caused by processing that infringes the UK GDPR or this DPA. The Processor shall indemnify the Controller against all claims, damages, losses, costs, and expenses arising from the Processor's breach of this DPA or the UK GDPR.

The Processor's total aggregate liability under this DPA shall be subject to the limitations set out in the Terms of Service, except that liability for breaches of data protection law shall not be limited to the extent prohibited by applicable law.

9. Term and Termination

This DPA shall remain in effect for the duration of the Controller's use of the Kanue platform. It shall automatically terminate when the Terms of Service expire or are terminated, subject to the Processor's obligations regarding data deletion as described in Section 6.

Either party may terminate this DPA if the other party materially breaches its obligations and fails to remedy the breach within 30 days of receiving written notice.

10. Governing Law

This DPA shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

11. Contact

For questions about this Data Processing Agreement or to exercise any rights under it, please contact us:

• Email: privacy@kanue.io
• Support: kanue.io/support