This agreement forms part of the Kettly contract. It applies to personal data in customer content that we process on your behalf, called customer personal data. It does not cover processing for our own purposes described in the privacy notice.
1. Scope and responsibilities
1.1 Data protection law means the UK GDPR, the Data Protection Act 2018, applicable PECR requirements and other applicable data-protection law, each as amended. Controller, processor, processing and personal data breach have their meanings under that law. Annex A describes the processing.
1.2 You are normally the controller and we are your processor. Where you act as processor for another controller, we act as your sub-processor. You confirm you have authority to appoint us and give the relevant instructions, including required authorisation from that controller. You remain our contractual contact, without limiting the controller’s statutory rights.
1.3 You are responsible for the lawfulness of your collection, instructions and use of customer personal data, including required transparency and authority for optional AI processing. Each party remains responsible for the duties imposed directly on it by law. This agreement prevails over conflicting contract provisions concerning personal-data processing.
2. Documented instructions
2.1 We process customer personal data only on documented instructions in the contract, authorised use of Kettly and other written instructions we accept. This includes instructions concerning international transfers. We do not determine new purposes for customer personal data or use it to train AI models.
2.2 If UK law requires processing outside your instructions, we will tell you before processing unless the law prohibits that notice. We will promptly tell you if we believe an instruction infringes data protection law and may pause the affected processing while the parties resolve the issue lawfully.
3. Confidentiality and security
3.1 People authorised to process customer personal data must be subject to an appropriate confidentiality obligation. Access is limited to what they need for the contracted service, authorised support, security or legal duties.
3.2 We implement appropriate technical and organisational measures under Article 32, taking account of the processing and its risks. Annex B describes the agreed measures. We may improve or replace specific controls provided the overall protection is not materially reduced. Material adverse changes require your agreement unless required by law, in which case the terms’ change provisions apply.
4. Sub-processors
4.1 You give general written authorisation for the sub-processors and activities identified in the completed provider register. Providers acting solely for our own controller purposes, or as independent controllers, are not authorised sub-processors merely because they appear in that register.
4.2 We will give at least 30 days’ advance written notice before authorising a new or replacement sub-processor to process customer personal data, including the intended processing and location. You may object on reasonable data-protection grounds within that period. We will discuss a reasonable solution, such as retaining the existing arrangement, using another provider or disabling an optional feature.
4.3 If no reasonable solution is available, you may terminate the affected service before the change, or the whole subscription if it cannot reasonably be separated. Unused prepaid fees for the terminated service will be refunded proportionately and future charges for it will cease. We will not commence the disputed processing for your account while that timely objection remains unresolved; we may pause the affected feature with an appropriate fee adjustment.
4.4 We impose the applicable Article 28 obligations on each sub-processor by written contract and remain responsible to you for its performance of those obligations. We will not use a provider arrangement that prevents us meeting this agreement. The register identifies how to obtain information about further processing in the supply chain.
5. Assistance
5.1 Taking account of the nature of processing and information available, we provide appropriate technical and organisational assistance with individual rights requests, security, breach reporting, data protection impact assessments and required consultation with the ICO or another competent regulator.
5.2 We will forward requests about customer personal data promptly and will not respond substantively on your behalf unless instructed or required by law. We will cooperate within a timeframe that allows you to meet your statutory obligations. Routine assistance is included. Any agreed charge for exceptional additional work must be reasonable and must not obstruct required cooperation; we do not charge you to remedy our own breach.
6. Personal data breaches
6.1 We notify your nominated contact without undue delay and, in any event, within 48 hours of becoming aware of a personal data breach affecting customer personal data. We do not wait for a complete investigation before notifying you.
6.2 To the extent known, the notice explains the nature of the breach, affected data and people, likely consequences, contact point and containment or remedial steps. We supply further information as it becomes available, preserve relevant evidence and assist your reporting and response. A notice is not an admission of liability.
7. International transfers
7.1 We make restricted transfers only under your documented instructions and with a lawful mechanism covering the recipient and activity. The register records applicable locations and mechanisms. Where required, we carry out the relevant transfer assessment and apply supplementary safeguards.
7.2 A mechanism may include UK adequacy regulations, an applicable UK Extension certification, the UK International Data Transfer Agreement, or EU standard contractual clauses with the UK Addendum. We monitor material changes and will not continue a transfer without a valid basis. We provide relevant compliance information on reasonable request.
8. Return and deletion
8.1 At your choice, we return or delete customer personal data when services end, and delete existing copies unless UK law requires storage. The default retrieval and deletion timetable is in Terms 11.3 and 11.4. If you choose earlier deletion, we act without unnecessary delay. If no contrary instruction is received, the 30-day retrieval window and deletion by day 60 apply.
8.2 The obligation covers live systems, support copies and authorised sub-processors. Routine backups are put beyond ordinary use pending expiry, protected and deleted under the stated cycle; deletion instructions are reapplied after restoration. We confirm completion on reasonable request. Any legally required retained data is restricted to that purpose and deleted when the requirement ends.
8.3 Provider-specific retention described in the register does not override this agreement or permit indefinite retention. Before enabling a feature, we must resolve any inconsistency between provider terms and these obligations. This agreement continues until the relevant processing and deletion are complete.
9. Information and audits
9.1 We provide information reasonably needed to demonstrate compliance with Article 28 and this agreement, and allow and contribute to audits, including inspections, by you or an independent auditor you appoint. Appropriate documentary evidence may be used first where it sufficiently addresses the issue.
9.2 Routine audits normally occur no more than once a year on reasonable notice during business hours. This does not restrict an audit required by law or a regulator, following a relevant breach, or reasonably needed because of credible non-compliance concerns or a material change in processing. Urgent circumstances may require shorter notice.
9.3 Audit arrangements must protect other customers’ information, security and confidential material without preventing a necessary audit. You normally pay your auditor’s costs. Any charge for exceptional assistance must be agreed and reasonable and must not obstruct compliance. We bear the cost of remedying our own non-compliance.
Annex A. Processing description
| Item | Description |
|---|---|
| Subject matter | Providing Kettly’s development appraisal service to the subscribing business. |
| Duration | The subscription and the subsequent return, deletion and backup-expiry period, or a longer period required by UK law. |
| Nature and purpose | Receiving, storing, organising, displaying, calculating, recording changes, securing, backing up and exporting customer content; providing requested support; processing selected documents for optional AI autofill. |
| Personal data | Users’ names and identifiers in customer audit records; business contacts and other personal data included in appraisals, notes or submitted documents, such as landowner and agent names, contact details and addresses linked to individuals. |
| People concerned | Authorised users and individuals referred to in customer content, including landowners, agents, clients and advisers. |
| Frequency | Ongoing service processing; document processing and support when requested. |
| Restricted information | Special category and criminal offence data are not intended inputs. They must not be submitted without prior written agreement on lawful processing and additional safeguards. |
Annex B. Security measures
These are the security measures for Kettly’s production service.
B1 Storage and encryption. The primary customer database is hosted in London, United Kingdom. Customer personal data is encrypted in transit and at rest in the managed database and its backups. Other processing locations appear in the provider register.
B2 Separation and access. Database access rules separate customer accounts. Application and privileged server paths enforce authorisation and account status. Staff access is limited by role and need, reviewed when responsibilities change and removed promptly when no longer needed. Privileged administrative access uses multi-factor authentication.
B3 Authentication. Passwords are stored as salted one-way hashes. Production settings require passwords of at least 10 characters with letters and digits, check new passwords against known leaked passwords, and end sessions after 7 days without use. Invitation and password-reset links expire after 24 hours. Access revocation is tested across the application and database paths.
B4 Keys and development. Secret API keys and privileged credentials are held in controlled secret settings, not public code or browser bundles. Changes are reviewed for security impact. We maintain a process for applying relevant security updates and responding to identified vulnerabilities.
B5 Records. Security and access events are recorded with proportionate retention. Appraisal revisions record attribution and timing. Controls protect saved revision history from ordinary editing while allowing lawful correction, restriction and deletion processes where necessary.
B6 Backups and recovery. The managed database is backed up daily, with routine backup retention of seven days. We test restoration periodically. Kettly does not store documents or other files outside the database.
B7 Retention and incidents. Documented procedures cover account closure, deletion across relevant systems and support copies, backup expiry, personal-data requests and incident response. Staff and contractors receive appropriate security and confidentiality instructions. Measures are periodically reviewed and tested for effectiveness.
Annex C. Providers and processing
The register distinguishes processing of customer personal data from processing for Kinda Living’s own administration. A provider may have more than one role, depending on the activity. The database location is not a promise that all processing remains in the UK.
| Provider | Activity and relevant information | Role and location |
|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database, authentication and managed database backups; account records and retained customer content. | Customer-content sub-processor; processor for our own account administration. Database and backups: London, United Kingdom. Logs: European Union. Support and security access: worldwide, including Singapore and the United States. |
| Netlify, Inc. | Website and application hosting, server functions and forms (feedback, team enquiries and requests to subscribe); request data, documents passing through to autofill, and form submissions, including any appraisal a user attaches to feedback. | Customer-content sub-processor where content passes through or is submitted; processor for other service records. Functions: United States (Ohio). Content delivery: worldwide. Other processing: United States. |
| Anthropic Ireland, Limited | Optional autofill; selected document text, page images, prompts and outputs. | Customer-content sub-processor for the contracted API processing. Contracting entity in Ireland; processing in the United States and other countries where Anthropic’s providers operate. |
| Plus Five Five, Inc. (Resend) | Invitation and password emails; recipient details, email contents and delivery records. | Processor for account administration; sub-processor only if customer content is included in a permitted message. Locations: United States. |
| Stripe Payments Europe, Limited (Ireland), with Stripe, LLC | Invoices and payments; billing contacts, transaction information and payment details handled through Stripe. | Processor, and independent controller for fraud prevention, legal compliance and its own operations. Not a customer-content sub-processor for ordinary subscription billing. Locations: Ireland, the United States and other countries where Stripe operates. |
| Cloudflare, Inc. | Domain services, email routing, Web Analytics for kettly.co.uk, and Turnstile, the check on the free trial form; routing metadata, emails sent to us, page views with the visitor’s browser type and country, and the trial form’s IP address and browser details. | Processor for business communications and sub-processor where support emails contain customer content; processor for the trial form’s check. Locations: United States, and Cloudflare’s worldwide network. |
| Microsoft (Microsoft 365, Exchange Online) | Business mailbox; emails and attachments sent to Kettly. | Processor for business communications and sub-processor where support emails contain customer content. Locations: the United Kingdom, the United States and other countries where Microsoft operates. |
C1 Transfer safeguards. The safeguard for each provider’s restricted transfers of personal data from the UK:
| Provider | Applicable safeguard and agreement |
|---|---|
| Supabase | The EU standard contractual clauses with the UK Addendum, in Supabase’s DPA (1 August 2026), for transfers to Supabase Pte. Ltd. and its providers. |
| Netlify | The UK Extension to the EU-US Data Privacy Framework (Netlify, Inc. is certified); otherwise the standard contractual clauses with the UK Addendum, in Netlify’s DPA (9 June 2026). |
| Anthropic | The EU standard contractual clauses with the UK Addendum, in Anthropic’s DPA (24 February 2025) with Anthropic Ireland, Limited. |
| Resend | The UK Extension to the Data Privacy Framework (Resend is certified); otherwise the standard contractual clauses with the UK Addendum, in Resend’s DPA. |
| Stripe | The UK Extension to the Data Privacy Framework for Stripe, LLC; otherwise the standard contractual clauses with the UK Addendum, in Stripe’s Data Transfers Addendum. |
| Cloudflare | The UK Extension to the Data Privacy Framework (Cloudflare, Inc. is certified); otherwise the standard contractual clauses with the UK Addendum, in Cloudflare’s DPA (version 6.4). |
| Microsoft | The UK Extension to the Data Privacy Framework (Microsoft Corporation is certified), and the standard contractual clauses with the UK Addendum, in Microsoft’s Products and Services Data Protection Addendum. |
C2 Hosting and communication retention. Supabase customer content follows the DPA schedule; authentication and security records follow the privacy notice’s retention table. Netlify keeps request and function logs for up to 7 days. Form submissions are kept until we delete them: correspondence within 24 months of the matter closing, and an appraisal attached to feedback once it is no longer needed for support. Resend keeps delivery data for 30 days. Cloudflare does not store the emails it forwards, and keeps routing records for 31 days. Microsoft mailbox records follow the privacy notice’s correspondence schedule, including items recoverable after deletion. We delete old form submissions and emails by hand against these periods.
C3 AI retention. Kettly uses Anthropic’s Messages API with Claude Sonnet, under Kettly’s own commercial account; documents are sent within the request, not through the Files API. Kettly has no separate retention agreement with Anthropic, so its standard policy applies: inputs and outputs are deleted within 30 days of receipt or generation, except where content is flagged under Anthropic’s usage policy (kept for up to 2 years) or longer retention is required by law.
C4 Provider information. Links to each provider’s privacy notice, data processing terms and list of its own sub-processors are available from hello@kettly.co.uk. Provider terms do not replace our own obligations to customers. Changes involving customer-content sub-processors follow DPA clause 4.