Data Processing Agreement

We will:

• process the data only on your instructions: these terms, your settings, and what you and your team do in Klasvo. If we think an instruction breaks the law, we tell you;
• process it for no purpose of our own, never sell it, and never combine it with another studio’s data;
• make sure everyone who can access it is bound to keep it confidential;
• keep the security measures in section 7 in place;
• help you answer your clients’ requests to see, correct, delete or take their data. Your back office lets you see, correct and export it. For a deletion your back office does not allow, email us and we do it within 10 business days;
• help you with breach notices, data protection impact assessments and questions from authorities, as far as they concern our part;
• give you, once a year on request, written answers about how we protect the data. If the law or an authority requires an audit, we allow one at your cost, with 30 days’ notice, during business hours, without access to other studios’ data.

You allow us to use these companies to process your studio’s data. Each is bound by a written contract with data protection duties at least as strict as ours.

These are not our sub-processors. Your clients pay you through your own Stripe account, connected to Klasvo through Stripe Connect, under your own agreement with Stripe: for those payments Stripe is your payment processor, and Klasvo creates each payment on your account without ever holding the money. If you turn on Google or Meta tags on your website, those companies receive data from your visitors under your own terms with them. The map on your website is loaded by the visitor’s own browser from OpenStreetMap, which so receives the visitor’s IP address and browser, and nothing else from us.

We tell the studio owner by email at least 30 days before we add or replace a sub-processor. If you object for a reasonable data protection reason, we will try to find a solution. If we cannot, you may cancel, and we refund what you paid for the time after you leave.

If we learn of a breach of security that affects your studio’s personal data, we tell you without undue delay, and within 48 hours of confirming it. We say what happened, what data and how many people may be affected, what we are doing about it, and who to contact. We keep you updated and help you tell authorities and clients where the law requires (for example within 72 hours under the GDPR or Thailand’s PDPA).

Your studio’s data is stored in Singapore. It may be accessed from other countries by our team and the sub-processors above, many in the United States.

• EU and EEA: where the GDPR applies to your studio and the data goes to a country without an adequacy decision, the Standard Contractual Clauses (European Commission Decision 2021/914) apply between you and us, Module Two (controller to processor), and are part of this agreement. Clause 7 (docking) applies; under Clause 9 option 2 applies, with the notice in section 3; Clause 11’s optional wording does not apply; under Clause 13 the authority is your studio’s lead authority; Clauses 17 and 18: the law and courts of Ireland. Annex I is section 1 of this agreement, Annex II section 7, Annex III section 3.
• United Kingdom: the UK International Data Transfer Addendum to those clauses applies, with the details in this agreement. Switzerland: the same clauses apply, with the Swiss Federal Act on Data Protection in place of the GDPR where needed.
• Thailand, Singapore, Malaysia, Indonesia, the Philippines, Vietnam and Australia: we and our sub-processors protect the data to the standard those laws ask for, under this agreement and our contracts with them. Where a law asks for a transfer assessment or filing (for example in Vietnam), we give you the facts you need for it.

You can export all your studio’s data at any time from the back office. When your account closes, we keep the data for 60 days so you can export it, then delete it. Backups expire within 30 days after that. If the law requires us to keep something, we keep only that, protect it, and use it for nothing else. On request, we confirm the deletion in writing.

These are the measures in place today:

• Each studio’s data is kept apart: every record carries its studio, and the database’s row-level security lets each request see one studio only. Before changes are released, we run a check that every table holding a studio’s data carries its studio and is protected by row-level security.
• Data is stored in Singapore, in a managed database that encrypts stored data, and is backed up every day.
• Every connection is encrypted: HTTPS on every page, with browsers told never to use plain HTTP, and encrypted connections to the database.
• No passwords: people sign in with a one-time link or code sent by email. We store only a fingerprint (hash) of each code and session, never the code itself. A session can be ended at any time, and removing a team member ends all their sessions at once.
• Access by role: owner, manager and teacher see different things. For example, teachers see the health notes they need to teach safely but not clients’ contact details. Only the owner can export the whole studio’s data; managers can download report lists, some of which include clients’ names and contact details.
• Important changes made in the back office are recorded: who did what, and when.
• Card details never reach our servers: they are typed into Stripe’s pages, and we keep only the brand and last four digits.
• Our logs never contain clients’ email addresses, phone numbers or payment identifiers.
• Our pages cannot be shown inside other websites, which stops a common kind of trick.
• Marketing: consent is recorded with its time and source, every marketing email has an unsubscribe link, and people who unsubscribe are not emailed again.
• Keys and passwords for our systems are kept in our host’s encrypted settings, never in our code. Access to production systems is limited to the people at Klasvo who need it.

• Have a lawful basis for the data you collect, and the consents you need, especially for health information and marketing.
• Tell your clients what you do with their data, in your own privacy policy.
• Give us only lawful instructions.
• Do not put data in Klasvo that it does not need, such as full card numbers, passport or ID numbers, in notes or forms.

The limits on liability in our Terms of Service apply to this agreement. If this agreement and the Terms of Service differ about personal data, this agreement applies. If the Standard Contractual Clauses and this agreement differ, the Clauses apply.

Questions: hello@klasvo.com.