Data Processing Agreement

Roles and scope

• You are the controller and K4 is your processor for the data described in Annex A, principally your customers’ details on the bookings you record.
• For your own account, sign-in and billing data, K4 acts as a controller under our Privacy Notice, not under this DPA.
• You must not submit special categories of personal data (such as health information) or data relating to children to K4; the service is not designed for it.

Our obligations

• We process the data only to provide K4 to you and in accordance with your documented instructions, given through the product or in writing, unless the law requires otherwise. We will inform you if we believe an instruction infringes the law.
• We never sell the data, share it for advertising or use it to train AI models.
• We grant access only to personnel who need it and who are bound by a duty of confidentiality.
• We protect the data with the measures set out in Annex B.

Your obligations

• You must have a lawful basis for the data you provide to us and inform your customers of how it is used.
• You decide which members of your team and which operators may see the data, and you keep your own accounts secure.

Sub-processors

• You authorise the sub-processors listed in Annex C. Each is bound by data protection terms at least as protective as these, and we remain responsible for their performance.
• We will notify account owners by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may close your account before the change takes effect and receive a pro-rata refund of any prepaid fees.

International transfers

The data is hosted by Amazon Web Services in the United States. Where data from the EU, the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses (module 2 or 3), together with the UK Addendum and the Swiss amendments where applicable.

Security incidents

If we become aware of a personal data breach affecting the data, we will notify you without undue delay and in any event within 48 hours, with the information available to us and the measures we are taking, so that you can meet your own 72-hour notification obligation to the supervisory authority. We will keep you informed and assist you in responding.

Assistance and audits

• We assist you in responding to your customers’ requests to access, correct or delete their data, primarily through tools in the product. If a customer contacts us directly, we will forward the request to you.
• We assist you with data protection impact assessments and prior consultations with supervisory authorities where the law requires them.
• We respond to reasonable security questionnaires and provide the information necessary to demonstrate our compliance with this DPA. On-site audits take place by agreement, at your expense, and no more than once a year unless a supervisory authority requires otherwise.

End of processing

You may export your data at any time. When you close your account, we delete the data within 90 days, including from backups as they expire, unless the law requires us to retain it.

Annex A · Description of processing

• Purpose: operating your fleet calendar: recording bookings, blocks and maintenance, scheduling preparation and turnover time, preventing double bookings, importing bookings from forwarded emails and calendar feeds, and showing operators what they are permitted to see.
• Data subjects: your customers, and your team members and operators once you add them.
• Categories of data: names, email addresses, phone numbers, number of guests, booking dates, notes you add, and the content of booking emails you forward.
• Special categories of data: none expected.
• Duration: for as long as you use K4, and thereafter as set out in End of processing; retention periods are stated in the Privacy Notice.

Annex B · Security measures

• Encryption: TLS in transit; storage and backups encrypted at rest; phone numbers and contact details additionally encrypted at the application level (AES-256-GCM).
• Access control: database access is restricted by role and by account and enforced within the database itself; operators see customer details only while a booking is active.
• Personnel: two-factor authentication, least-privilege access, and a record of every change.
• Artificial intelligence: card numbers, email addresses and phone numbers are removed before any text is sent to an AI model.
• Operations: hosted on Amazon Web Services in the United States, with automated backups, regular security updates, and a documented breach-response procedure.

Annex C · Sub-processors