Data Processing Addendum
The Art. 28 terms on which Kanvo processes personal data for its customers. Published rather than sent on request.Last updated: October 8, 2026
1. Scope and roles
This Data Processing Addendum ("DPA") forms part of the agreement between Kanvo, Inc. ("Kanvo", "Processor") and the customer ("Customer", "Controller") for use of the Kanvo services. Customer is the controller of personal data it submits to the services. Kanvo is the processor and processes that data only on Customer…
2. Subject matter, duration, nature and purpose
Subject matter: the provision of Kanvo's unified messaging services. Duration: for as long as Customer holds an active account, plus the deletion window in section 9. Nature and purpose: receiving, storing, routing, displaying and searching the messages and files Customer and its users submit; transcribing audio submi…
3. Instructions
Kanvo processes personal data only on Customer's documented instructions, which comprise this DPA, the agreement, and the configuration choices Customer makes in the product. Kanvo will tell Customer if, in its opinion, an instruction infringes applicable data protection law, and may suspend the affected processing un…
4. Confidentiality
Kanvo ensures that personnel authorised to process personal data are bound by an obligation of confidentiality, and limits access to those who need it to provide, secure or support the service. Access to production data is role-scoped and logged. Kanvo does not read message content in the course of ordinary operations…
5. Security
Kanvo implements the technical and organisational measures described at kanvo.ai/security, which include encryption in transit and at rest, row-level authorisation on every table, scoped credentials hashed at rest, signature-verified inbound webhooks, rate limiting, second-factor step-up on the actions that outlive a…
6. Subprocessors
Customer gives general authorisation for Kanvo to engage subprocessors. The current list is published at kanvo.ai/subprocessors and is incorporated into this DPA by reference. Kanvo imposes on each subprocessor data protection obligations no less protective than those in this DPA, and remains liable to Customer for it…
7. Data subject rights
The services give Customer the means to answer most requests directly: a person can export a complete copy of their account as one document, correct their profile, set a retention window, and delete their account, from any Kanvo client. Where a request cannot be answered through the product, Kanvo will provide reasona…
8. Personal data breach
Kanvo will notify Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting Customer personal data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the m…
9. Deletion and return
On termination, or on Customer's written request, Kanvo will delete Customer personal data within 30 days, save where retention is required by law. Before deletion, Customer may export its data through the product. An account deletion removes the rows the account owns, revokes its API keys and platform tokens, deletes…
10. Audit
Kanvo will make available the information necessary to demonstrate compliance with Art. 28 and will contribute to audits, including inspections, conducted by Customer or an auditor it mandates. In practice Kanvo will satisfy an audit by providing its security documentation, architecture description, subprocessor list,…
11. International transfers
Kanvo and its subprocessors process personal data in the United States and the European Union. Where personal data is transferred out of the EEA, the UK or Switzerland to a country without an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses (Decision 2021/914), Modul…
12. Signing this DPA
This text is the DPA Kanvo offers. To have it countersigned, write to kanvo@aw3.tech with your entity name and address; we will return an executed copy. Kanvo, Inc. Attn: Legal — kanvo@aw3.tech Countersignature requests, data-subject requests and breach notices all reach that one address, which is read by a person. Th…