Legal · data processing
Kairos's standard DPA for the Klarora SaaS. Incorporated by reference into the Terms of Service. Version 1.0, last updated 14 November 2026.
Between Kairos Connect B.V. (Processor) and the Customer (Controller)
Version 1.0. Last updated 14 November 2026. Art. 28 GDPR. Governed by Dutch law. This is Kairos's standard DPA for the Klarora SaaS. It is incorporated by reference into the Kairos Terms of Service and does not require a signature.
| Processor | Controller | |
|---|---|---|
| Legal name | Kairos Connect B.V. | the Customer (the entity agreeing to the Kairos Terms of Service) |
| Address | Walborg 2a, 1082 AM Amsterdam, Netherlands | the address provided by the Customer in its workspace account, or as otherwise notified to Kairos |
| KvK | 99923009 | as registered by the Customer, where applicable |
| Privacy contact | Moe Mollaei, Founder & CTO / privacy lead, info@thekairos.app | the workspace account owner, or any other contact the Customer designates |
| Underlying agreement | the Kairos Terms of Service at https://thekairos.app/terms (the "Terms") | |
This DPA forms part of the Terms. It takes effect when the Customer accepts the Terms or uses the Service, and no signature is required. On written request to info@thekairos.app, Kairos will provide a countersigned copy of the then-current DPA for the Customer's records.
Terms used in this DPA (personal data, processing, controller, processor, sub-processor, personal data breach, data subject, supervisory authority) have the meanings given in Regulation (EU) 2016/679 ("GDPR"). "Service" means the Klarora SaaS workspace platform as provided under the Terms, including during a pilot or trial. "Customer Personal Data" means personal data processed by Kairos on behalf of the Customer in providing the Service. "Customer" means the entity that agrees to the Terms.
2.1 Kairos processes Customer Personal Data only as a processor on behalf of the Customer, as described in Annex 1. The Customer is the controller (or a processor for a third-party controller, in which case Kairos acts as a sub-processor).
2.2 This DPA applies for the term of the Terms, including any pilot or trial period, and until all Customer Personal Data has been deleted or returned under clause 10.
2.3 The Customer is responsible for the lawfulness of the processing, including its legal basis and the information it gives data subjects.
3.1 Kairos processes Customer Personal Data only on the Customer's documented instructions, including on international transfers. The instructions are this DPA, the Terms, and the Customer's use and configuration of the Service, unless EU or Member State law requires otherwise. In that case Kairos informs the Customer first, unless the law prohibits it.
3.2 Kairos informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data-protection law (Art. 28(3)(h)).
3.3 Kairos does not use Customer Personal Data for its own purposes, including marketing or advertising, or training AI models, and does not sell it. Content sent to AI models is sanitised so it contains no Customer Personal Data (Annex 3).
Kairos ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations, accept Kairos's information security policies, and receive security awareness training.
Kairos implements the technical and organisational measures in Annex 2. They are maintained under Kairos's information security management system, which is aligned with ISO/IEC 27001:2022. Kairos is not certified to ISO/IEC 27001 as of the Last updated date of this DPA. Kairos may update the measures as long as the overall level of protection is not reduced.
6.1 The Customer gives general written authorisation for the sub-processors in Annex 3 and for the current list published at https://thekairos.app/subprocessors. Annex 3 records the list as at the Last updated date of this DPA. The published page, as updated under this clause 6, is the current authorised list.
6.2 Kairos gives at least 30 days' prior notice of any intended addition or replacement, by email to the workspace account owner and/or by updating https://thekairos.app/subprocessors (including any subscription option offered on that page). The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service without penalty.
6.3 Kairos imposes on each sub-processor, by written contract, data-protection obligations equivalent to this DPA. Kairos remains fully liable to the Customer for its sub-processors' performance.
Taking into account the nature of the processing, Kairos assists the Customer, by appropriate technical and organisational measures where possible, in responding to data subject requests. If Kairos receives a request directly, it forwards it to the Customer without undue delay and does not respond itself except on the Customer's instruction.
Kairos assists the Customer with security, breach notification, data protection impact assessments, and prior consultation with the supervisory authority, taking into account the information available to Kairos.
9.1 Kairos notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
9.2 The notification includes, where known: the nature of the breach, the categories and approximate number of data subjects and records, the contact point, likely consequences, and the measures taken or proposed. Information may be provided in phases.
9.3 Kairos does not notify supervisory authorities or data subjects on the Customer's behalf without the Customer's written instruction, unless required by law.
At the end of the Service, or at the end of a pilot without conversion, Kairos will, at the Customer's choice, return Customer Personal Data in a commonly used machine-readable format or delete it. This happens within 30 days, and backups are overwritten within the applicable backup cycle (Railway volume backups: 6 days daily, 27 days weekly and 89 days monthly; Supabase: daily physical database backups, PITR disabled, Storage objects excluded, retained for 7 days on the Supabase Pro plan). Retention is only allowed where EU or Member State law requires it. Kairos confirms deletion in writing on request.
Kairos makes available all information necessary to demonstrate compliance with Art. 28: security documentation, audit reports or certificates when available, and answers to reasonable questionnaires. It allows for and contributes to audits, including inspections, by the Customer or an auditor mandated by the Customer. Notice is 30 days, no more than once per year except after a breach or a regulator request, and the auditor is bound by confidentiality.
12.1 The location of processing for each sub-processor is set out in Annex 3 and on https://thekairos.app/subprocessors. The primary database, authentication and file storage (Supabase project "Kairos Connect") are hosted in AWS region eu-west-2 (London, United Kingdom), which is covered by an EU adequacy decision. Kairos does not represent that all Customer Personal Data is hosted only in the EEA.
12.2 Kairos does not transfer Customer Personal Data outside the EEA except to sub-processors listed in Annex 3 (or the current published list) whose transfer basis is stated there: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients, and the EU adequacy decision for the United Kingdom) or Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with supplementary measures where needed. This includes remote access by sub-processor personnel outside the EEA.
12.3 Where a transfer of Customer Personal Data from the Customer to Kairos, or an onward transfer by Kairos, requires a transfer mechanism under Chapter V of the GDPR, the parties are deemed to have entered into the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), which are incorporated by reference. Module 2 (controller to processor) applies where the Customer is a controller. Module 3 (processor to processor) applies where the Customer is a processor. For each module, where applicable: the optional docking clause in Clause 7 applies; in Clause 9, Option 2 (general written authorisation) applies, with the notice period in clause 6.2 of this DPA; the optional language in Clause 11 does not apply; in Clause 17, Option 2 applies and the Clauses are governed by Dutch law; in Clause 18(b), disputes are submitted to the courts of the Netherlands (Rechtbank Amsterdam). Annexes I and II of the Clauses are deemed completed with the information in the parties table and Annexes 1, 2 and 3 of this DPA. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum is likewise incorporated and deemed completed with the same information.
13.1 Liability under this DPA is governed by the Terms, and is limited to the fees paid by the Customer under the Terms in the 12 months preceding the claim, subject to Art. 82 GDPR.
13.2 If this DPA conflicts with the Terms on data protection, this DPA prevails.
13.3 This DPA is governed by Dutch law. Disputes are submitted to the competent court of Rechtbank Amsterdam.
13.4 Kairos may update this DPA by publishing a new version at https://thekairos.app/dpa with a revised Last updated date. Material changes will be notified to workspace account owners. Continued use of the Service after the effective date of an update constitutes acceptance of the updated DPA, except that a change which materially reduces the Customer's data-protection rights does not take effect for that Customer until the Customer accepts it or a new term of the Service begins, unless the change is required by law.
| Nature & purpose | Providing the Klarora workspace (task management, goals, team chat, documents, forms, CRM, whiteboards, workflow automation, AI assistants, and any modules provided under the Terms), hosting, support, security and error monitoring, backups |
| Categories of data subjects | Customer's authorised users (employees, contractors); persons whose data the Customer enters (e.g. its contacts, customers, suppliers or clients in CRM and other modules) |
| Categories of personal data | Identification, contact, authentication data; communication content (chat, documents, attachments, recordings); technical and usage data (logs, device/browser, IP); operational data the Customer enters in the Service |
| Special categories | Not in scope unless agreed in writing. The Customer must not upload Art. 9/10 data without agreement |
| Frequency | Continuous during the term |
| Retention | Term of the Terms, then clause 10 |
Each measure is linked to an approved Kairos policy.
The current list is published at https://thekairos.app/subprocessors. The table below is the list as at 14 November 2026.
| Sub-processor | Service | Location of processing | Transfer basis |
|---|---|---|---|
| Supabase | Authentication, Postgres database, file storage | AWS eu-west-2 (London, United Kingdom), Supabase project "Kairos Connect" | EU adequacy decision (United Kingdom) for hosting in the UK. Supabase's DPA also provides SCCs / DPF for any processing in the United States. |
| Cloudflare | Edge Workers, R2 storage, Queues, Vectorize, Durable Objects, Email Routing, AI Gateway, RealtimeKit (calls), Turnstile | Workers and edge services: Cloudflare global network. R2: production Kairos buckets (including kairos-documents, kairos-attachments, kairos-files, kairos-chat-attachments, kairos-avatars, kairos-support-attachments) in WEUR (Western Europe); bucket "attachments" in ENAM (Eastern North America). D1 databases: jurisdiction "default" (not EU-restricted). | EU-US Data Privacy Framework, with EU SCCs as a further safeguard (Cloudflare Customer DPA v6.4, 3 April 2026) |
| Vercel | Dashboard frontend hosting (dashboard.thekairos.app) | United States; Functions default region iad1 (Washington, D.C.) | EU-US Data Privacy Framework and EU SCCs (Vercel DPA) |
| Railway | Document rendering (Gotenberg) and supporting services | United States (Railway's DPA states that primary processing operations are in the US; a service may be pinned to a region, including EU West / Amsterdam) | EU-US Data Privacy Framework where the recipient is certified, otherwise EU SCCs and the UK Addendum (Railway DPA, executed 18 September 2026) |
| Moira Connect (Moira Solutions B.V.) | Gmail / Google Calendar connector (mailbox and calendar data). Moira Solutions B.V. is the Netherlands holding company of Kairos Connect B.V. (intra-group). | Hosted on the same Cloudflare Workers infrastructure as Kairos; edge on Cloudflare's global network; any persistent objects follow the Kairos R2/D1 locations above. | Intra-group data processing agreement (to be executed) |
| Google Cloud Platform | OAuth application (project kairos-connect-437513); no separate customer-data store | Google Cloud (OAuth configuration only; no Customer Personal Data stored) | EU-US Data Privacy Framework and EU SCCs (Google Cloud CDPA) |
| Sentry | Error monitoring (scrubbed) | United States (Iowa). Organisation URL kairos-bv.sentry.io uses the US domain; EU organisations use de.sentry.io. Some account and organisation metadata is always stored in the US, per Sentry's documentation. | EU-US Data Privacy Framework, with EU SCCs as fallback (Sentry DPA v5.1.0, accepted 18 September 2026) |
| Langfuse Cloud | AI tracing metadata: user/team IDs, model, token counts. No prompts or responses. Listed while IDs are treated as pseudonymous rather than anonymous. | EU Ireland, AWS eu-west-1, via cloud.langfuse.com | EU SCCs, UK Addendum and EU-US Data Privacy Framework (Langfuse Cloud / ClickHouse Customer DPA) |
| Google Workspace | Support email, to the extent it contains Customer Personal Data | United States / global Google Workspace services | EU-US Data Privacy Framework and EU SCCs (Google Workspace CDPA) |
| Mailgun | Transactional and notification email (team invitations, automation notifications, subscription updates, unverified user reminders) | EU (api.eu.mailgun.net) | Processed in the EU |
| Firebase Cloud Messaging (Google) | Push notification delivery to mobile and web devices (notification text and device tokens) | United States / Google global infrastructure | EU-US Data Privacy Framework and EU Standard Contractual Clauses (Firebase Data Processing and Security Terms) |
Not sub-processors (no Customer Personal Data):