Scope
These Data Processing Terms (the “DPA”) form part of the Kiroa Terms and Conditions (the “Terms”) between Honne Technologies Ltd, trading as Kiroa (“Kiroa”, “we”), and the customer named in the Account (“you”). They apply whenever we process Guest Data on your behalf. Words defined in the Terms have the same meaning here.
01. Definitions
- “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679) and the e-privacy rules that apply to the processing, as amended or replaced.
- “Personal Data”, “Data Subject”, “Processing”, “Controller”, “Processor” and “Personal Data Breach” have the meanings given in the UK GDPR or the EU GDPR, whichever applies.
- “Guest Data” has the meaning given in the Terms: Personal Data of your guests, clients and website visitors processed through the Service.
- “Sub-processor” means a processor we engage to process Guest Data on your behalf.
02. Roles and instructions
2.1. For Guest Data, you are the Controller and Kiroa is your Processor. Where you are yourself a processor for another business, you confirm that its instructions allow you to use Kiroa.
2.2. We process Guest Data only on your documented instructions. Your instructions are the Terms, this DPA, the way you set up and use the Service (for example, the forms you publish and the emails you send), and any other written instruction that is consistent with them. Details of the processing are in Appendix 1.
2.3. We will tell you if we believe an instruction infringes Data Protection Law; we are not required to follow it.
2.4. We do not sell Guest Data, do not use it for our own purposes, and do not use it to train AI models. We may use aggregated, anonymised information about how the Service is used, as described in the Terms (clause 10.6).
2.5. You are responsible for having a lawful basis for the Guest Data you collect, for the privacy information you give to Data Subjects, and for the accuracy and quality of the data.
03. Confidentiality
3.1. Everyone at Kiroa who can access Guest Data is bound by confidentiality, and only accesses it when needed to provide the Service or support you (clause 5.5 of the Terms).
3.2. We will not disclose Guest Data to a public authority unless the law requires it. Where the law allows, we will tell you before we do, so that you can object.
04. Security
4.1. We apply the technical and organisational measures in Appendix 2, which take into account the state of the art, the cost, the nature of the processing and the risks to Data Subjects. We may update them as long as the overall level of protection does not go down.
4.2. Security is shared. You are responsible for the security measures that are in your hands: who you invite to your team and with which role, removing people who leave, strong passwords, and not collecting more Guest Data than you need.
05. Sub-processors
5.1. You give us general authorisation to use the Sub-processors listed in Appendix 3 (the same list as clause 10.4 of the Terms).
5.2. We impose on each Sub-processor, by written contract, data protection obligations that offer at least the same protection as this DPA, and we remain responsible to you for its performance.
5.3. We will email the Account Owner at least 30 days before adding or replacing a Sub-processor. If you object on reasonable data protection grounds and we cannot address your objection, you may cancel the Contract without charge before the change takes effect.
06. International transfers
6.1. Guest Data is stored in the European Union (Ireland). Kiroa is established in the United Kingdom, which the European Commission recognises as providing adequate protection.
6.2. Where a Sub-processor processes Guest Data in a country without an adequacy decision, we make sure the transfer is protected by an approved mechanism: the EU-US Data Privacy Framework and its UK extension where the recipient is certified, or otherwise the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
07. Data Subject requests
7.1. The Service gives you tools to find, export, correct and delete a guest’s data (for example, from the customer record).
7.2. If a Data Subject contacts us directly about Guest Data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to. Where you cannot answer a request with the tools in the Service, we will help you as far as is reasonable.
08. Personal Data Breaches
8.1. We will notify you without undue delay, and within 48 hours where possible, after becoming aware of a Personal Data Breach affecting Guest Data. We will give you the information you need to meet your own obligations, as it becomes available: what happened, the categories and approximate number of Data Subjects and records concerned, the likely consequences and the measures taken or proposed.
8.2. We will take reasonable steps to contain the breach and reduce its effects.
8.3. Attempts that do not compromise Guest Data (for example, blocked login attempts, scans or denial-of-service attacks) are not Personal Data Breaches.
8.4. Notifying or responding to a breach is not an admission of fault or liability.
09. Assistance
Taking into account the nature of the processing and the information available to us, we will help you, as far as is reasonable, with data protection impact assessments and prior consultations with a supervisory authority that relate to the Service.
10. Information and audits
10.1. We will make available the information reasonably needed to show that we comply with this DPA, including a description of our security measures.
10.2. If that information is not enough, you may audit our compliance, yourself or through an independent auditor bound by confidentiality, no more than once a year (unless a supervisory authority requires it or after a Personal Data Breach), with at least 30 days’ written notice, during business hours and at your cost. Audits may not give access to other customers’ data or to the systems of our Sub-processors, for which we will provide their own certifications or reports where available.
11. Return and deletion
11.1. When the Contract ends, we keep Guest Data for the 90-day retention period in clause 16.6 of the Terms. During that period you can ask us for an export of it.
11.2. After that period we delete Guest Data, unless the law requires us to keep it. Copies in disaster-recovery backups are overwritten in the normal backup cycle and are protected by this DPA until then.
12. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions in clause 14 of the Terms, except where Data Protection Law does not allow it.
13. Duration and precedence
13.1. This DPA applies for as long as we process Guest Data on your behalf, including during the retention period.
13.2. If this DPA conflicts with the Terms on the processing of Personal Data, this DPA prevails. If the EU Standard Contractual Clauses or the UK International Data Transfer Addendum apply and conflict with this DPA, they prevail.
Appendix 1 — Details of the processing
| Item | Description |
|---|---|
| Subject matter | Providing the Service under the Terms: hosting your Website, receiving enquiries and form submissions, managing customers, events and quotes, sending emails and taking staged payments through your Stripe account. |
| Duration | For as long as the Contract lasts, plus the 90-day retention period (clause 11 of this DPA). |
| Nature and purpose | Collection through your forms, storage, organisation, consultation, sending of emails you trigger, export and deletion, only to provide the Service to you. |
| Data Subjects | Your guests, enquirers and event clients; people who contact you through your Website; their companions or attendees when you record them; and visitors to your Website. |
| Categories of data | Identity and contact details (name, email, phone, company); enquiry, event and booking details (dates, numbers of guests, requirements, quotes, messages); payment status and amounts (card details are handled by Stripe, never by Kiroa); consent records (which notice was shown and when, marketing consent); communications you send through the Service; and technical data needed to protect forms (such as IP address, for rate limiting and bot protection). |
| Special categories | Not required by the Service. Your forms may ask for dietary, allergy or accessibility requirements, which can be health data. If you collect them, you are responsible for the lawful basis and for informing the guest, and should ask only for what you need. |
| Frequency | Continuous, while the Service is used. |
Appendix 2 — Security measures
- Separation between customers: every record carries its customer’s identifier, and the database enforces row-level security on every table, so one customer’s users cannot read another’s data. Public visitors have no direct access to any table.
- Access control: team roles chosen by the Account Owner; administrative (service-level) access is used only by audited server code at defined points, always filtered by customer. Changes to team membership are logged.
- Kiroa staff: access a customer’s Account only with that customer’s invitation, or when strictly needed for security or to keep the Service running (clause 5.5 of the Terms). [confirm: multi-factor authentication on staff accounts for Supabase, Vercel, Stripe and GitHub]
- Encryption: in transit with TLS on every connection; at rest by the database and storage provider. [confirm: encryption at rest and its standard with Supabase]
- Availability and backups: managed hosting with regular backups by the provider for disaster recovery. [confirm: backup frequency and retention of the Supabase plan]
- Abuse protection: bot protection and rate limits on public forms and on signup.
- Secrets: keys and credentials kept in the hosting providers’ secret stores, never in the code.
- Changes to the Service: reviewed and tested automatically before release; database changes are applied in a controlled order and checked.
- Incidents: a process to investigate, contain and notify breaches (clause 8).
Appendix 3 — Sub-processors
The list in clause 10.4 of the Terms, kept up to date there. Guest Data is stored in the European Union (Ireland, Supabase).