Data Processing Agreement (DPA)

1. Parties

Controller: the customer organisation using a Kadova account. Processor: Kadova (trade name, sole proprietorship, Netherlands), contact privacy@kadova.nl. Together: the Parties.

2. Definitions

Terms have the meaning under the GDPR (EU 2016/679) and the Terms of Service. Personal data, processing, data subject, personal data breach and sub-processor are interpreted accordingly.

3. Subject, duration and nature

Kadova processes personal data only on the customer’s instructions, for the subscription term plus a reasonable period for export, backups and legal retention. Processing covers providing the SaaS platform for gift card management, online sales, redemption, reporting, email notifications and related integrations.

4. Controller instructions

Kadova processes personal data only on documented instructions from the customer, including platform configuration, API use and this DPA. Kadova will inform the customer if an instruction appears to conflict with the GDPR, where legally permitted.

5. Data categories and data subjects

Depending on customer use:

• Data subjects: customer staff, consumers/gift card holders, shop visitors, digital gift card recipients
• Categories: identification and contact data, gift card and transaction data, order and invoice data, limited technical logs
• Special categories: not intended; the customer must not process these via the platform without additional safeguards

6. Security (GDPR art. 32)

Kadova implements appropriate technical and organisational measures including TLS, encryption of sensitive fields, access control and MFA, tenant isolation, logging, backups, vulnerability management and incident response. Details are in the privacy policy; a summary is available on request.

7. Sub-processors

The customer authorises Kadova to use sub-processors for hosting, email, payments, storage, monitoring and mobile services. The current list is at /legal/subprocessors. Kadova notifies the customer of material changes (at least 30 days in advance by email or in-app notice). The customer may object on reasonable grounds; if unresolved, either party may terminate.

8. Transfers outside the EEA

Where sub-processors process data outside the EEA, Kadova ensures appropriate safeguards (e.g. SCCs, adequacy decisions or provider DPAs). See the subprocessor list for location per processor.

9. Personal data breaches

Kadova notifies the customer without undue delay after becoming aware of a breach, with information the customer needs to comply with GDPR arts. 33 and 34. Notifications go to the customer’s security contact or privacy@kadova.nl / security@kadova.nl.

10. Audits and information

Kadova provides reasonable compliance information on request. Customer audits are limited to once per year, with 30 days’ notice, during business hours and without disrupting operations or other customers. Kadova may share its own SOC/ISO or penetration test summaries where available.

11. Termination and return/delete

After subscription termination: (a) export facilities remain available per plan/agreement; (b) personal data is deleted or anonymised within 90 days, except legal retention or anonymised statistics; (c) backups roll off per retention policy. Gift card and fiscal records may be retained for 7 years where the customer is responsible or legally required.

12. Liability

Liability under this DPA follows the Terms of Service. Each party indemnifies the other for claims arising from GDPR breaches within its respective role.

13. Acceptance

The DPA applies by: (a) agreement at registration together with the Terms; (b) continued use after publication of changes; or (c) signing a separate order/quote referencing this DPA. You may generate a PDF via print/export of this page.

14. Contact

privacy@kadova.nl · security@kadova.nl · support@kadova.nl