Data Processing Addendum

Kaptly’s operator is Aleksandar Šterijev, an individual. Contact address: Višnjička 61D, Karaburma, 11000 Belgrade, Serbia. Data-processing enquiries: privacy@getkaptly.com.

Where a Kaptly account holder collects personal data from respondents through a published form, the account holder is generally the data controller and Kaptly acts as a data processor on their behalf. [CONFIRM — legal review: this characterization, and any exceptions (e.g. account-holder data itself, where Kaptly is the controller).]

Invited collaborators act within the form permissions assigned by the owner. Viewer and Editor permissions do not include respondent data, exports or delivery integrations. The owner controls publication and is responsible for granting and removing access. A change of form ownership requires acceptance by the receiving account; the parties remain responsible for the authority and instructions for transferring collected data.

[CONFIRM: standard DPA clause — processor processes personal data only on documented instructions from the controller, including regarding international transfers.]

Current subprocessors are listed on the Subprocessors page. [CONFIRM: notice period for adding a new subprocessor, and the controller's right to object.]

See the Security and Responsible Disclosure page for the current, verified state of security measures. [CONFIRM: this section should list only measures that have actually been implemented and reviewed, once that review happens — not aspirational measures.]

[CONFIRM: process and SLA for Kaptly assisting a controller in responding to access/erasure requests from their respondents, beyond the self-serve per-response delete that already exists.]

[CONFIRM: breach notification timeline and process — currently undefined.]

When a controller closes their Kaptly account from Settings → Danger zone, successful deletion removes the account, owned forms and responses from the active database without a grace period. Uploaded files are queued for removal and may require retries. An active preservation hold can pause deletion; contact support if this happens. Previously created recovery copies and separate email records are not all erased by that action; see the Privacy Policy’s retention and deletion section.

[CONFIRM: a documented controller choice between return and deletion, the scope and format of return, completion times, backup expiry and recovery handling, and any legally required retention. These terms and supporting controls must be completed before this draft is used as an executed DPA.] DPA and deletion enquiries: privacy@getkaptly.com.

[CONFIRM: whether/how a controller can audit Kaptly's processing — likely limited given the current beta/pre-audit state.]