Data Processing Addendum

Where you upload personal data about your own customers and contacts, you are the controller and KABAIDO LTD is your processor. We process that data only to provide the service and on your documented instructions.

We process the categories of personal data you choose to submit, typically the identity and contact details of your staff and contacts and the content of the commercial requests, quotes and orders you handle, so that we can structure requests, produce quotes and orders and operate the platform features you use. The data subjects are typically your own staff and contacts and the end customers whose requests you handle in the platform. We process this data for the duration of your account and, on termination, delete or return it at your choice.

We use the sub-processors listed in our Privacy Policy: Supabase, Vercel, Stripe, Resend and Anthropic. Each is independently certified to recognised standards, and any transfer to a provider outside the United Kingdom is covered by the safeguards set out below. We give notice of changes to this list so you can object on reasonable grounds.

We apply organisation-scoped row level security enforced in the database, encryption in transit with TLS and at rest with AES-256, and a further layer of application-layer encryption for integration credentials. Access is role-based and enforced at the database, administrative actions are recorded in an audit log, and our staff are bound by confidentiality. Our AI provider is configured for zero retention and we do not train models on your data. These practices are set out in full on our security page.

Data resides in the United Kingdom region of our infrastructure providers. The renewed EU adequacy decision covers transfers between the EEA and the United Kingdom to December 2031. Where data is transferred to a provider outside the United Kingdom, including our US-based sub-processors, we rely on Standard Contractual Clauses with the UK Addendum.

We assist you with data subject requests and with your security, breach notification and impact assessment obligations, and we notify you without undue delay of a personal data breach affecting your data. We make available the information you reasonably need to demonstrate compliance with these obligations. On termination we delete or return your data at your choice.

To request a countersigned Data Processing Addendum, contact hello@kabaido.com.