Data processing agreement (GDPR, Article 28)
Version of 02/11/2026
This is a translation. If the versions differ, the French text prevails: version française.
This agreement sets out how KYNA processes your clients' data on your behalf.
1. Roles and subject matter
The tradesperson decides what data they keep about their clients: they are the controller. [PUBLISHER: name, legal form, company number and registered office to be completed] hosts and processes it solely to make KYNA work: it is a processor within the meaning of Article 28 GDPR. This agreement forms part of the terms and conditions and applies for as long as KYNA is used.
2. Description of the processing
| Item | Content |
|---|---|
| Data subjects | The tradesperson's clients and prospects, their contacts, the tradesperson's staff who use KYNA |
| Data | Identity, contact details, job site addresses, VAT number, content of quotes, change orders and invoices, payments, site photos, drawn signatures (name, date, time, document fingerprint), requests submitted by clients through the tradesperson's link, team schedule and hours, job expenses, notes; with the Pro plan: recordings, transcripts and summaries of calls received |
| Sensitive data | None planned. The Customer undertakes not to enter any (health, opinions…) |
| Operations | Hosting, sync between devices, backup, document generation, sending at the Customer's request, deletion |
| Location | European Union (Ireland); copy on the Customer's devices |
3. Processor's commitments
- process the data only on the Customer's documented instructions, meaning the way it uses KYNA, and inform it if an instruction appears to breach the GDPR;
- ensure confidentiality: only those who need access have it, under a confidentiality commitment;
- apply the security measures in annex 2;
- engage another processor only under the conditions of article 4;
- help the Customer respond to requests to exercise rights, in particular through export and deletion of records;
- notify the Customer of any data breach within 48 hours of becoming aware of it;
- help the Customer with impact assessments and consulting the Authority, where necessary;
- at the end of the contract, allow export and then delete the data, unless there is a legal obligation to keep it; the Customer can erase everything itself at any time (“Delete my account”);
- make available the information needed to demonstrate compliance with this agreement and accept a reasonable audit, announced 30 days in advance, no more than once a year, at the Customer's expense.
4. Sub-processors
The Customer authorises those listed in annex 1. Any addition or replacement is announced 30 days in advance; the Customer may object on legitimate grounds and, failing agreement, cancel at no cost. Each sub-processor is bound by contract to the same obligations.
5. Customer's obligations
It has a legal basis for the data it enters, informs its own clients, enters only the data needed, and protects access to its devices and accounts.
Annex 1 — Sub-processors
| Provider | Role | Data location |
|---|---|---|
| Supabase Inc. (on Amazon Web Services) | Database, accounts, photo storage | Ireland (EU) |
| Cloudflare Inc. | Delivery of the website and the app | Global network; no customer data stored |
| HeiGIT gGmbH (openrouteservice) | Calculation of distances and driving time for quotes: only the departure, arrival and stop addresses, sent by the KYNA server (never the client's name or the device's IP address); nothing is kept | Germany (EU) |
| OVH SAS | Domain name and forwarding of emails sent to contact@kyna-pro.be | France (EU) |
| Sendinblue SAS (Brevo) | Sending sign-in and password reset emails, alerts and support replies | European Union (France) |
| Anthropic PBC (Claude AI), only if the AI assistant is turned on | Help assistant replies to questions typed by the user (KYNA does not pass on any client data) | United States: European Commission standard contractual clauses; no model training on this data (API commercial terms) |
To be added, with 30 days' notice, once chosen: subscription payment provider, Peppol access point, and for the Pro plan, the telephone operator and the speech recognition and synthesis service for the answering service (EU hosting preferred; otherwise standard contractual clauses).
Annex 2 — Security measures
- Encryption of traffic (HTTPS) and of data stored with the hosting provider.
- Separation between businesses enforced by the server (row-level access rules), tested automatically.
- Roles: owner, office, worker; the worker sees no prices, quotes or invoices.
- Issued invoices cannot be changed or deleted; change log.
- Passwords of at least 12 characters; two-step verification by code available for every account: once enabled, the server refuses access to the data without the code; secret keys are never present in the app.
- KYNA administration: access limited to a named list, two-step verification mandatory, every lookup logged (tamper-proof log, 12 months); the administrator sees counters, never the content of clients, quotes and invoices.
- Daily automatic purge of data no longer needed (handled requests, unused signature links, expired invitations, old error reports).
- Browser security headers (strict content policy, no display in a frame, HTTPS mandatory).
- Downsized photos, without GPS coordinates.
- Backup possible on the Customer's side; daily server backup when paid plans open.
Acceptance
This document is accepted by ticking, in the KYNA app, the box “I have read and accept the KYNA terms and conditions, privacy policy and data processing agreement”. The accepted version and the date are recorded in your account. You can ask for a copy of your acceptance at contact@kyna-pro.be.