Data processing agreement
Last updated: 30 October 2026
1. Parties and scope
This agreement is between the business that runs a store on Kaizena Flow (the controller, "you") and KaizenaLabs, organisation number 915429777 (the processor, "we"). It is part of our terms of service and applies for as long as we process personal data on your behalf.
It meets the requirements of Article 28(3) of the General Data Protection Regulation (GDPR). If it conflicts with the terms of service on the processing of personal data, this agreement applies.
2. The processing
Subject matter and purpose: hosting and running your stores and the tools in the admin, so that you can sell, deliver, invoice, give support and market to your customers.
Nature: storing, organising, showing, sending, analysing, translating and deleting data, as you use the service.
Duration: as long as you have stores on Kaizena Flow, and until the data is deleted or returned as in section 11.
Data subjects: your customers and shoppers, people who sign up to your lists, fill in your forms, book with you or contact you, and the people you give access to the admin.
Types of personal data: names, email addresses, phone numbers and postal addresses, company details, orders, bookings, returns and invoices, payment references (never card numbers, which only the payment provider sees), messages and support conversations, reviews, consent and subscription records, and the custom fields you choose to add.
You decide which special categories of personal data, if any, are processed. The service is not designed for them, and you should not collect them in it unless you have a lawful basis and have assessed the risk.
3. Your instructions
We process personal data only on your documented instructions: this agreement, the terms of service and the settings and actions you and your staff choose in the admin. We do not process it for our own purposes, except to keep accounts of our fees and where the law requires it. If the law requires us to process it in another way, we tell you first unless the law forbids it.
We tell you at once if we believe an instruction breaks data protection law.
4. Confidentiality
Everyone at Kaizena Flow who can reach your personal data is bound by a duty of confidentiality and reaches it only as far as needed to run, support and secure the service. Kaizena Flow's platform administrators do not read your stores' support conversations.
5. Security
We take the technical and organisational measures GDPR Article 32 requires, including:
encryption of data on its way to and from the service, and of stored secrets
passwords, recovery codes and tokens kept only as hashes
each store's data kept apart from other stores', with access checked on every request
roles and permissions for your staff, two-step sign-in and an activity log of changes
backups of the database and the ability to restore it
hosting in data centres in the EU with their own physical security
We review and improve the measures as risks and technology change.
6. Sub-processors
You give us general authorisation to use sub-processors. We use these today:
Vercel (hosting; functions in Dublin, Ireland)
Supabase (database, sign-in and file storage, in Ireland)
Resend (sending the emails your store sends)
OpenAI (AI features, when Kaizena Flow's own AI connection is used)
We tell you at least 30 days before we add or replace a sub-processor. If you object on reasonable grounds and we cannot meet the objection, you may end the affected service before the change takes effect. We bind each sub-processor to the same data protection obligations as in this agreement and are responsible for its compliance.
Services you connect yourself are not our sub-processors: payment providers such as Stripe and Mollie, carriers, your own AI provider, Slack, analytics and marketing tools. Your own agreements with them apply.
7. Transfers outside the EEA
Your stores' data is stored in the EU. Where a sub-processor can reach data from a country outside the EEA, the transfer is made under the EU–US Data Privacy Framework where the sub-processor is certified, or otherwise under the standard contractual clauses adopted by the European Commission (GDPR Articles 45 and 46).
8. Helping with data subjects' rights
The admin lets you answer requests from data subjects yourself: you can find, correct and export a customer's data and erase or anonymise it, while orders you must keep by law are kept restricted. If a data subject contacts us directly about your store, we send the request on to you without undue delay and do not answer it ourselves unless you ask us to.
9. Other assistance
Taking into account the nature of the processing and the information available to us, we help you meet your obligations under GDPR Articles 32 to 36: security, notifying breaches, data protection impact assessments and prior consultation.
10. Personal data breaches
We notify you without undue delay, and no later than 48 hours after we became aware of it, of a personal data breach that affects your stores. The notice describes what happened as far as we know it, the data and people likely to be affected, the likely consequences and what we are doing about it, and is followed up as we learn more. You decide whether to notify the supervisory authority and the people affected (GDPR Articles 33 and 34).
11. When the processing ends
Before you close a store you can export its data from the admin. After the store is closed for good, we delete or anonymise its personal data within 90 days, except what the law requires to be kept, such as orders and invoices under accounting rules, which is kept restricted for the period required and then anonymised.
12. Information and audits
We make available to you the information needed to show that we meet this agreement. You may audit our compliance, yourself or through an independent auditor bound by confidentiality, with at least 30 days' notice, once a year unless a breach or an authority gives reason for more. Each party bears its own costs.
13. Liability and law
Liability between us follows the terms of service, without limiting what GDPR Article 82 gives data subjects. This agreement is governed by Norwegian law, as the terms of service are.