GDPR Art. 28
Data Processing Agreement
Last updated: 29 September 2026
Processor: Kardu Technologies S.L. (“Kardu”)
Controller: The Customer who has accepted Kardu's Terms of Service and uses the Kardu platform (“Customer”).
This DPA forms part of and is incorporated into Kardu's Terms of Service. By accepting the Terms, the Customer enters into this DPA on behalf of their organisation.
1. Subject matter and duration
Kardu processes personal data on behalf of the Customer solely to provide the GRC platform services described in the Terms of Service (“Services”). Processing begins on account creation and continues until the Customer terminates their account or 30 days after termination (data deletion period).
2. Nature and purpose of processing
Kardu processes personal data to: (a) provide platform functionality including storing and displaying Customer-entered compliance data; (b) authenticate users and protect accounts against abuse; (c) deliver transactional emails; (d) provide AI-assisted features when a user chooses to use them; and (e) collect pseudonymous product analytics, only where the user has consented.
3. Type of personal data processed
- User account information (name, work email, company details)
- Authentication credentials (hashed passwords, MFA data)
- Compliance content entered by users (which may include employee names, roles, contact details)
- Usage metadata (event timestamps, IP addresses for rate limiting)
- Text submitted to AI-assisted features (e.g. assistant messages, client questionnaire questions)
- Audit log entries linked to user identifiers
4. Categories of data subjects
- Customer's employees and contractors who are granted platform access
- Individuals referenced in compliance content (e.g. task owners, risk owners, evidence custodians)
5. Processor obligations
5.1 Confidentiality
Kardu ensures that all personnel with access to Customer personal data are bound by confidentiality obligations. Access is restricted on a need-to-know basis.
5.2 Security measures
Kardu implements appropriate technical and organisational measures including: TLS 1.3 encryption in transit; AES-256 encryption at rest; row-level security (RLS) enforcing strict tenant isolation at the database level; multi-factor authentication; and immutable audit logging. See Security page for details.
5.3 Sub-processors
Kardu engages the sub-processors listed in Section 6. Kardu will provide 30 days' notice before adding or replacing sub-processors. The Customer may object in writing within that period.
5.4 Data subject rights
Kardu will assist the Customer in fulfilling data subject rights requests (access, rectification, erasure, portability) by providing appropriate technical capabilities in the platform. Where direct assistance is required, Kardu will respond within 5 business days.
5.5 Breach notification
Kardu will notify the Customer of a personal data breach without undue delay and in any event within 48 hours of becoming aware, providing sufficient information to enable the Customer to meet its notification obligations under GDPR Art. 33–34.
5.6 Audit rights
Kardu will provide information reasonably necessary to demonstrate compliance with this DPA upon written request. On-site audits may be conducted with 30 days' prior notice, no more than once per year, at the Customer's expense.
5.7 Instructions
Kardu processes personal data only on documented instructions from the Customer (as implemented through use of the platform). If Kardu is required by applicable law to process data for other purposes, it will inform the Customer unless prohibited.
6. Sub-processors
| Sub-processor | Function | Personal data | Data location | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | All Customer account and compliance data, uploaded evidence files | EU (Frankfurt, Germany) | Data hosted in the EU; US entity: Standard Contractual Clauses for any remote accessPending confirmation |
| Vercel, Inc. | Application hosting and delivery | Request data in transit, IP addresses and technical logs | EU (Frankfurt, fra1) | Data processed in the EU; US entity: Standard Contractual Clauses for any remote accessPending confirmation |
| Scaleway SAS | Transactional email delivery | Recipient name and email address, email content | EU (Paris, France) | EU — no transfer |
| Mistral AI SAS | AI-assisted features (assistant chat, questionnaire answers, suggestions) | Text the user submits to AI features, including assistant chat messages, questions received in client questionnaires and processing-register entries. Uploaded document contents are never sent. | EU (France), as stated by the provider | EU — no transfer; Mistral AI data processing addendum accepted with its terms of service. Use of API data to train Mistral models is disabled on Kardu’s account. |
| Upstash, Inc. | Rate limiting and account lockout protection | IP addresses and login email addresses, held temporarily | EU (Frankfurt, Germany — AWS eu-central-1) | Data hosted in the EU; US entity: Standard Contractual Clauses for any remote accessPending confirmation |
| Stripe Payments Europe, Ltd. | Payment processing | Organisation name, billing contact email, payment details | EU (Ireland), with onward processing by Stripe group companies | Standard Contractual Clauses for transfers within the Stripe groupPending confirmation |
| PostHog, Inc. | Product analytics, only with the user’s consent; error monitoring | Analytics: pseudonymous user ID, plan, sector and in-app events. Error monitoring: error message, stack trace and the page or route where it happened — never request contents, cookies or headers; browser errors only with consent. No names or email addresses. | EU (eu.posthog.com) | Data hosted in the EU; US entity: Standard Contractual Clauses for any remote accessPending confirmation |
| Intuition Machines, Inc. (hCaptcha) | Bot protection on login, registration and password reset | IP address and browser/device signals | United States | Standard Contractual Clauses — pending confirmationPending confirmation |
| Cloudmersive, LLC | Malware scanning of uploaded evidence files | Full content of each uploaded file | Canada (Beauharnois, Quebec); legal entity in the United States | EU adequacy decision for Canada; data processing agreement pending confirmationPending confirmation |
Kardu's policy is to keep Customer data in the EU/EEA. hCaptcha (United States) and Cloudmersive (Canada) are the two deliberate exceptions. Several providers are EU-hosted but belong to US corporate groups; where remote access from outside the EU/EEA is possible, it is covered by Standard Contractual Clauses. Entries marked “Pending confirmation” are being verified against each provider's signed terms. List last reviewed: 17 October 2026.
7. Return and deletion of data
Upon termination of the Services, Kardu will: (a) allow the Customer to export their compliance data for 30 days; (b) after 30 days, delete all Customer personal data from production systems; (c) provide written confirmation of deletion upon request.
Kardu may retain anonymised, aggregated data that cannot identify the Customer or any individual for product improvement purposes.
8. Customers established in Chile
Where the Customer is established in Chile, Kardu acts as the Customer's processor (“encargado del tratamiento”) and will also comply with the obligations that Chilean Law No. 21,719 on the protection of personal data (in force from 1 December 2026) places on processors, including acting only on the Customer's instructions, keeping the data confidential, applying appropriate security measures, and assisting the Customer in responding to data subject requests and security breaches.
The transfer of personal data from Chile to Kardu and its sub-processors takes place under the safeguards described in Section 6. This Section adds to, and does not replace, the governing law and jurisdiction set out in Section 10.
9. Liability
Each party shall be liable to the other for any damages arising from a breach of this DPA. Kardu's total liability under this DPA shall not exceed the amounts paid by the Customer in the twelve months preceding the claim. Nothing in this DPA limits liability for wilful misconduct or fraud.
10. Governing law
This DPA is governed by the laws of Spain and subject to the jurisdiction of the courts of Barcelona, Spain.
For DPA enquiries or to request a signed copy: privacy@kardu.eu