Data processing agreement

This agreement is between the organization that uses Kairobot (the controller) and the operator of Kairobot (the processor):

Omelas, Netherlands Chamber of Commerce (KvK) 98455303, VAT NL005331814B35. Email: events@kairobot.work.

It covers the personal data the controller brings into Kairobot — the people it invites and their availability, answers and results — described in Annex 1. It forms part of our terms of service and applies automatically to every account; where the two differ on data protection, this agreement prevails.

We process the controller’s personal data only on its documented instructions: these terms and the controller’s use of the service (creating events, inviting people, setting options). We do not use it for our own purposes. If we believe an instruction breaks data protection law, we tell the controller. If EU or member-state law requires us to process data otherwise, we inform the controller first unless that law forbids it.

Only people who need access to run or support the service can reach the controller’s data. They are bound to confidentiality, and administrator access is recorded in an audit log.

We apply appropriate technical and organizational measures under Art. 32 GDPR, listed in Annex 2, and keep them up to date as the service and its risks change.

The controller gives us general authorization to use sub-processors. The current list, with what each does and where, is on the sub-processors page (Annex 3). We bind each one to data protection obligations equivalent to this agreement and remain responsible for them.

We announce any new or replacement sub-processor on that page at least 30 days before it starts processing personal data, and email account owners. The controller may object on reasonable data protection grounds; if we cannot resolve the objection, the controller may close its account before the change takes effect.

The service lets the controller answer most requests itself: it can see, correct and delete each person it invited, delete events and tournaments, and close its account. When a data subject contacts us directly, we pass the request to the controller without delay and help it respond.

We help the controller meet its obligations on security, breach notification and data protection impact assessments (Art. 32–36 GDPR), taking into account the nature of the processing and the information available to us.

If we become aware of a personal data breach affecting the controller’s data, we notify the controller without undue delay and, where feasible, within 48 hours — with what we know about its nature, the data and people affected, likely consequences and the measures taken — and keep the controller updated.

When the controller closes its account, we delete its personal data immediately, except where law requires us to keep something (such as invoices, which Stripe keeps). Before closing, the controller can ask events@kairobot.work for a copy of its data. During the agreement, events and tournaments are deleted 12 months after they end.

We make available the information needed to show compliance with Art. 28 GDPR and answer reasonable questions in writing. Where that is not enough, the controller may audit us, or have an independent auditor do so, once a year on 30 days’ notice, at its own cost, during business hours and without access to other customers’ data.

The service runs in Germany. Where a sub-processor processes data outside the European Economic Area, the transfer is covered by the EU Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework.

This agreement lasts as long as we process personal data for the controller. Liability is governed by the terms of service, without limiting liability that cannot be limited under the GDPR. Dutch law applies.

• Subject matter and purpose: collecting availability from people the controller invites, finding times that work, scheduling events and tournament fixtures, and sending invitations, reminders and confirmations.
• Data subjects: guests, members and participants the controller invites.
• Personal data: name or display name, email address or phone number, availability (selected times and weekly patterns), messages to the organizer, tournament fixtures, results and standings, and delivery records.
• Special categories: none intended; the controller does not enter them.
• Nature: storage, organization, matching of availability, and transmission by email and SMS.
• Duration: for the term of the account, subject to the retention periods in the privacy policy.

• Hosting on a dedicated server in Germany; the database is not reachable from the internet.
• Encryption in transit for all traffic (HTTPS with HSTS).
• Invitation and schedule links are long random tokens stored only as one-way hashes; invitation links expire and are revoked when replaced.
• Tenant isolation: every organizer query is scoped to the organization of the verified, signed-in account; other customers’ data is never reachable.
• Sign-in through Firebase Authentication; no passwords stored by us.
• Administrator access limited to named system administrators and recorded in an audit log.
• Link tokens removed from server logs; logs rotated and size-capped.
• Payment data handled only by Stripe (PCI DSS certified).
• Data minimization: no tracking, no analytics, no advertising use.
• Automatic deletion according to defined retention periods.
• Nightly database backups, encrypted on the server for a key held off the server, kept 14 days; restores are tested.

The current list is maintained on the sub-processors page.