Data Processing Addendum

This addendum applies where, in using kitset.io, you act as a controller of personal data and we act as your processor. It supplements the Terms of Service. Terms such as controller, processor, personal data, processing and supervisory authority have the meanings given in applicable data protection law.

1. Roles

You are the controller of the personal data in your workspace and determine why and how it is processed. We are your processor and process it only to provide the service.

2. Subject matter and duration

Processing lasts for as long as your workspace exists, plus the deletion period in clause 8.

3. Nature and purpose

Hosting, storing, transmitting, indexing for search, generating notifications and reminders, sending transactional email, and maintaining an audit trail — all so that the service works as described.

Where you enable the Developer API, processing also includes serving your data to API credentials you issue, and transmitting your data to endpoints you nominate, on your instruction. Both are under your control: you decide whether to create a credential, what it may read, whether to register an endpoint and what it receives. Neither happens unless you do.

Where you turn on AI connections, processing also includes serving your data to the AI apps your users connect, on their instruction, and recording what each app asks for. This too is under your control: you decide whether AI apps may connect and which parts of the product they may read, and an app reads only what the user who connected it can see. None of it happens unless you turn it on.

4. Categories of data subject

Your employees, contractors and other participants; and any individual named in a record your users create, such as a vendor contact, an approver or a visitor.

5. Types of personal data

Identification and contact data; employment data such as job title, department, team, manager, cost centre and work location; account and authentication data; activity and audit data including IP address and browser user-agent; content your users choose to enter; and any personal data inside files they attach.

Where you use webhooks, we also hold a delivery record for each event we send you: the payload as transmitted, the destination, the response status, and any transport error. The payload contains whatever personal data the event itself carries.

Where you turn on AI connections, we also hold a record of each request an AI app makes: the user it acted for, the app, what it asked for, the identifiers of the records returned, the outcome and the IP address. Search terms and other free text are kept only as their length. These records are deleted 90 days after the request.

Special-category data is not permitted without prior written agreement — see the Acceptable Use Policy.

6. Our obligations

• Process personal data only on your documented instructions, of which using the service is one, unless the law requires otherwise — in which case we will tell you unless prohibited.
• Ensure everyone authorised to process it is bound by confidentiality.
• Apply appropriate technical and organisational security measures, described on the security page.
• Assist you, so far as we reasonably can, with data subject requests, impact assessments and consultations with supervisory authorities.
• Notify you of a personal data breach affecting your data without undue delay and within 72 hours of becoming aware of it.
• Delete or return personal data on termination, as set out in clause 8.
• Make available the information reasonably necessary to demonstrate compliance, and permit an audit no more than once in any 12 months, on 30 days' notice, at your cost, subject to confidentiality and to not disrupting other customers.

7. Subprocessors

You give general authorisation for us to engage the subprocessors listed at /subprocessors. We will give at least 30 days' notice before adding one and you may object on reasonable data protection grounds, as described on that page. Each subprocessor is bound by obligations no less protective than these, and we remain responsible for its performance.

An endpoint you nominate is not a subprocessor. A subprocessor is a party we choose, to perform part of the service on our behalf, and we are answerable for it. A webhook destination is a party you choose, to receive data on your own instruction; it is not listed on the subprocessors page, we give no notice before you add one, and we are not responsible for what happens to data after it arrives there. That transfer is controller-to-controller between you and whoever operates the destination, and it is your responsibility to establish that you are entitled to send it and that it is adequately protected on arrival.

An AI app is not a subprocessor either. Its provider is a party you and your users choose, not one we engage. It is not listed on the subprocessors page, we give no notice before one is connected, and we are not responsible for what happens to data after it reaches the provider. What an AI app reads is sent to that app's provider under your own agreement with them, and that agreement, not this addendum, sets the provider's role and how the data is protected. It is your responsibility to establish that you are entitled to send it.

8. Deletion and return

On termination, or on your written request, we will delete personal data within 30 days, except where the law requires retention. Backups expire in the ordinary course within 30 days. The product exports the user directory, the audit trail, vendors, assets, systems, access reviews, purchase requests, workplace records, learning completion records, handovers, employee transitions, KPI definitions and KPI results as CSV, at any time while the workspace is live and including during a read-only period following an expired trial or subscription. For uploaded files, ask us at [email protected] before termination and we will extract them for you.

Webhook delivery records, including the payloads they carry, are deleted with the workspace on the same 30-day horizon. Data already delivered to an endpoint you nominated is outside our control and we cannot recall it; deletion requests for that data go to whoever operates the destination.

AI activity records are deleted with the workspace on the same horizon, if their 90 days have not already ended. What an AI app has already read is outside our control in the same way, and deletion requests for it go to that app's provider.

9. International transfers

Processing locations are listed on the subprocessors page. Note in particular that transactional email is processed in the United States. Where a transfer requires a safeguard, we rely on the relevant standard contractual clauses, which are incorporated into this addendum by reference.

A webhook destination is different, and worth being plain about: we do not know where the server behind a URL you registered is, we make no transfer assessment for it, and no safeguard in this addendum covers it. If you send personal data to an endpoint outside your own jurisdiction, that transfer is yours to assess and to document.

The same is true of an AI app: we make no transfer assessment for its provider, and no safeguard in this addendum covers what it reads. That transfer is yours to assess and to document.

10. Liability

Each party's liability under this addendum is subject to the limits in the Terms of Service.

11. Contact

FLOW FN PTE. LTD. (UEN 202617303Z), Singapore. Data protection contact: [email protected], [email protected].