Data processing agreement

This is the standard text Kitform offers. To put it in place, email support-email-not-set@example.com with your company's legal name and address.

1. Roles

The customer is the controller of personal data in the brand guides, files and team details it puts into Kitform. Kitform is the processor and processes that data only to provide the service, on the customer's documented instructions (these terms and the customer's use of the product).

2. Kitform's obligations

• Process personal data only as instructed, and tell the customer if an instruction appears unlawful.
• Ensure people with access are bound by confidentiality.
• Apply appropriate technical and organisational measures, described on the security page.
• Help the customer respond to data subject requests and meet its security, breach notification and impact assessment obligations.
• Notify the customer without undue delay (and within 48 hours) after becoming aware of a personal data breach affecting its data.
• Delete customer data at the end of the service (within 30 days), unless the law requires keeping it.
• Make available the information needed to show compliance, and allow reasonable audits.

3. Sub-processors

The customer authorises these sub-processors: Vercel Inc. (hosting and storage), Stripe (payments), Resend (transactional email, if used) and Google (sign-in, only if the person chooses Google sign-in). Kitform will give notice of changes and the customer may object.

4. International transfers

Where data is transferred outside the UK or EEA, it is covered by the UK International Data Transfer Addendum or EU Standard Contractual Clauses with the relevant sub-processor.

5. Details of processing

• Subject matter: turning brand guides into design systems.
• Duration: the term of the customer's use of Kitform.
• Data subjects: the customer's users and team members; people named in uploaded files.
• Data: names, email addresses, roles; any personal data inside uploaded files.