Data Processing Agreement

This agreement applies where you submit Customer Data — data about your own end users — to the Service. For that data you are the controller and Kaidn is your processor.

It does not cover your own account, billing and website data, for which Kaidn is the controller. That is governed by the Privacy Policy.

Where this agreement conflicts with the Terms of Service on the processing of Customer Data, this agreement prevails. Terms defined in the Terms of Service carry the same meaning here. “Data Protection Law” means the EU GDPR, the UK GDPR and the Data Protection Act 2018, and any other data-protection law applicable to the processing.

Required by Article 28(3). This describes what we do with Customer Data and for how long.

• ›Subject matter and nature. Automated analysis of events you submit — signup, login, checkout, cashout and similar — to produce a risk score, a verdict and the reasons behind it.
• ›Purpose. Fraud and abuse prevention on your service, and nothing else. We do not use Customer Data for advertising, for profiling unrelated to that purpose, or to train machine-learning models, except as set out in clause 10.
• ›Duration. For the term of your subscription, plus the retention window for your plan (clause 9).
• ›Categories of data subject. Your end users, applicants and customers, and visitors to your properties where you deploy our browser tracker.
• ›Types of personal data. IP address; a hashed email address and its domain; a hashed phone number; a device identifier and associated browser and device characteristics; your own user identifier; event type and timestamp; and any optional attribution fields you choose to send.
• ›Special category data. The Service is not designed for it and you must not submit it. We do not knowingly process data within Article 9 or Article 10 on your behalf.

We process Customer Data only on your documented instructions, including as to transfers, unless required otherwise by law — in which case we will tell you before processing, unless that law forbids it. Your instructions are: these terms, the Terms of Service, the documented behaviour of the Service, and your configuration of it.

If we consider an instruction to infringe Data Protection Law, we will tell you and may suspend that processing until it is resolved.

We grant access to Customer Data only to personnel who need it to provide or support the Service, and only under a binding confidentiality obligation that survives the end of their engagement. Access is limited to what each role requires.

We implement appropriate technical and organisational measures under Article 32. Our current measures include:

• ›encryption of all data in transit over public networks (HTTPS/TLS);
• ›storing only a hash, never the raw value, for the identifiers used to detect reuse — an email address is never retained in the clear, and neither is a phone number;
• ›hashing with a secret key, so that a stolen database does not yield reversible identifiers for values with a small keyspace such as an IP address;
• ›per-tenant isolation, so one customer's data is never readable by another;
• ›hashed API keys with named, revocable credentials, and browser keys that are publishable, domain-locked and cannot read data or return a score;
• ›least-privilege access control, and separate credentials for administrative functions;
• ›reclaiming storage after deletion, so removed records leave the database file rather than only disappearing from queries.

These measures reflect the state of the art and the risk. We may change them, but will not materially reduce the overall level of security during your subscription.

You give general authorisation for us to engage sub-processors. The current list, what each one receives, and where it processes are published at kaidn.io/subprocessors.

We give at least 30 days’ notice before adding or replacing a sub-processor that handles Customer Data. If you object on reasonable data-protection grounds within that period, we will work with you to find an alternative; where we cannot, you may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees.

We impose data-protection obligations on each sub-processor that are no less protective than those in this agreement, and we remain fully liable to you for their performance.

You are responsible for responding to your end users. We help you do it inside the 30 days Article 12(3) allows, with endpoints rather than a support queue:

• ›Access and portability (Art. 15, 20). POST /v1/subject returns everything your account holds about one person, in structured JSON.
• ›Erasure (Art. 17). POST /v1/forget removes that person from every record your account holds, and reclaims the storage.
• ›Rectification and restriction (Art. 16, 18). You may correct data by resubmitting it, and suppress a record from further processing through the same erasure endpoint or your dashboard.

If a data subject contacts us directly about Customer Data, we will not respond substantively but will refer them to you and tell you promptly.

One limit, stated plainly. Where you have opted in to the shared fraud network, an erasure removes the person from your own records and stops your account acting on them, but does not by itself withdraw a confirmed-fraud signal you contributed to the shared network. Removing a shared signal goes through us, so that one participant cannot quietly erase network intelligence about themselves. Contact us and we will action a legitimate request.

Customer Data is hosted in Germany. Some sub-processors listed at kaidn.io/subprocessors process data outside the EEA or the UK. Where they do, the transfer is made under an appropriate safeguard under Chapter V — an adequacy decision, or the applicable Standard Contractual Clauses with the UK Addendum where relevant. We will tell you which safeguard applies to a given recipient on request.

Where the Standard Contractual Clauses apply, they are incorporated into this agreement, with you as data exporter and Kaidn as data importer, Module Two or Module Three as appropriate. If a mechanism we rely on is invalidated, we will implement an alternative safeguard without undue delay or give you the option to terminate the affected processing.

Event records are deleted automatically once they pass the retention window for your plan. This is enforced by a scheduled process, not by request, and each run is logged so that enforcement can be evidenced.

On termination or expiry, we will delete Customer Data within 30 days, or return it to you first if you ask within that period. We may retain data where law requires, in which case it stays subject to this agreement and is processed only for the purpose requiring its retention.

Deletion reclaims the underlying storage, so deleted records are removed from the database rather than merely hidden from queries. Encrypted backups are overwritten on their normal cycle.

We use signals derived from your use of the Service to operate, secure and improve it, and — where you opt in — to contribute to our shared fraud network. What crosses between customers is a keyed one-way hashof an identifier together with a decaying risk score. Raw identifiers never cross, and no customer learns another customer’s data.

We describe those hashes as pseudonymised, not anonymous, and treat them as personal data accordingly. They are stable and matchable by design, which is what makes the network useful and also what stops them being anonymous in the sense Recital 26 means.

Participation is off by default and controlled from your dashboard. We do not use Customer Data to train machine-learning models without your separate written authorisation.

We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to us so you can meet your Article 33 obligations.

Taking into account the nature of the processing and the information available to us, we provide reasonable assistance with your obligations under Articles 32 to 36, including data protection impact assessments and prior consultation.

We make available the information reasonably necessary to demonstrate compliance with Article 28, and will respond to a reasonable security questionnaire. You may audit no more than once in any twelve months, on 30 days’ notice, during business hours, subject to confidentiality and without unreasonable disruption — or more often where a supervisory authority requires it or following a breach affecting your Customer Data.

This agreement takes effect when you accept the Terms of Service and continues while we process Customer Data. Clauses that by their nature should survive termination do so.

Each party’s liability under this agreement is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Law does not permit that limitation. Nothing here limits a data subject’s rights or a supervisory authority’s powers.

We may update this agreement to reflect changes in law, our sub-processors or the Service. We will give notice of material changes in advance, and they will not materially reduce your protections.

Questions, audit requests, breach queries or a signature copy: support@kaidn.io.