Data Processing Agreement

1. Scope

This agreement applies when you use Card by KEPPTIC as a company, publishing cards about your people. You are the controller of that data; we process it for you. It forms part of our Terms of Service and takes precedence over them on anything about personal data. A signed copy is available on request: hello@kepptic.io.

It does not apply to a personal card someone creates for themselves outside a workspace. There, we are the controller and our Privacy Policy applies.

2. Definitions

“Controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given in the EU General Data Protection Regulation. “Customer personal data” means personal data we process on your behalf under this agreement. “Applicable data protection law” means the GDPR, the UK GDPR and the Data Protection Act 2018, the California Consumer Privacy Act as amended, and any other law that applies to either party’s processing of customer personal data.

3. Roles

You are the controller (and, under California law, the business). We are the processor (service provider). You decide what goes on your people’s cards, who is in your workspace, and what your directory sync sends us. We process only on your documented instructions, which are: this agreement, the Terms of Service, and what you and your administrators do in the product.

We will tell you if we believe an instruction breaks applicable data protection law.

4. Details of the processing

Subject matter. Providing the Card by KEPPTIC service.

Duration. For as long as your workspace exists, plus the deletion period in section 12.

Nature and purpose. Storing, rendering and serving digital business cards; generating QR codes, contact files and printed NFC cards; synchronising cards from your directory; measuring card performance in aggregate; administering your workspace, seats and billing; preventing abuse.

Categories of data subject. Your employees, contractors and other people you publish cards about; people you invite to your workspace; people who open one of your cards.

Categories of personal data.

Special categories. None. The service is not designed for special-category data and you must not put it on a card.

Frequency. Continuous, for as long as the service is in use.

5. Our obligations

We will:

• process customer personal data only on your instructions, and not for our own purposes;
• never sell or share customer personal data, and never use it to train machine-learning models;
• keep it confidential and bind our personnel to confidentiality;
• apply the security measures in section 7;
• help you, so far as we reasonably can, with data subject requests, impact assessments and consultations with regulators, given the nature of the processing and the information available to us;
• tell you, unless the law forbids it, if we receive a legally binding demand for customer personal data, and challenge one that appears unlawful.

6. Sub-processors

You give us general authorisation to use sub-processors. Each is bound by written terms no less protective than this agreement, and we remain liable for their performance.

We will give you 30 days notice before adding or replacing a sub-processor, by email to your workspace administrators. If you reasonably object on data protection grounds, tell us within that period and we will work with you on an alternative; if there is none, either of us may terminate the affected part of the service and we will refund any unused prepayment.

Microsoft is not our sub-processor. When you enable directory sync we call Microsoft Graph inside your own tenant, under permissions your administrator granted us, read-only.

7. Security

We apply these measures, and will not reduce them during the term:

• Access. Passwordless sign-in by emailed link or Google or Microsoft sign-in. Sign-in links are stored hashed and expire in ten minutes. Session cookies are HTTP-only, HTTPS-only and scoped to our own domain. Roles separate owners, administrators, members and analytics-only viewers.
• Isolation. Every record carries the workspace or owner it belongs to, as a required column with a foreign key. Requests to a workspace’s data are authorised against that workspace’s membership on every request, read fresh from the database rather than trusted from the session, and a request that does not clear the check is refused before any data is returned. This is enforced per request today; we are extending the same guarantee into structural, type-level helpers so a future route cannot skip it by omission.
• Encryption. TLS in transit throughout. Encryption at rest by the database and object storage providers named above.
• Card exposure. Card pages are marked no-index, send no referrer, are not cached, and are refused to known search and AI crawlers. Revoking a card revokes its link, its QR code and its NFC tag at once.
• Abuse controls. Rate limits per email address and per network on sign-in and card creation, a disposable-email block, reputation checks on published links (when we check a link you publish, we refuse to fetch internal addresses, bare IP addresses and unusual ports), and traffic-pattern flags reviewed by a person.
• Accountability. An append-only administrative log enforced by the database.
• Secrets. Held in the platform’s secret store, never in source code.

We are not SOC 2 certified and hold no other third-party security certification today. We do not offer SAML single sign-on or SCIM provisioning yet.

8. Data subject requests

If a data subject contacts us directly about data in your workspace, we will not answer substantively. We will tell them to contact you, and tell you, promptly. The console lets your administrators read, correct, export and revoke any card in the workspace without needing us.

A person named on one of your cards may ask you to correct it, unpublish it or take their details off it. Your administrators can do all three in the console without us. When someone leaves your organisation, removing them revokes their card and its links at once.

9. Personal data breach

We will notify you without undue delay and within 72 hours of confirmation of a personal data breach affecting customer personal data. The notice will describe what happened, what data and roughly how many people are affected, the likely consequences, and what we are doing about it, so far as we know at the time, with updates as we learn more. Notice goes to your workspace owner’s email address. We will not treat notifying you as an admission of fault.

10. Audits

We will give you the information you reasonably need to show compliance with this agreement. If that is not enough, you may audit us, or appoint an independent auditor who is not our competitor, once in any twelve months, on thirty days’ notice, during business hours, without disrupting the service, and subject to confidentiality. You bear the cost unless the audit finds a material breach.

11. International transfers

We process customer personal data in the United States. For transfers out of the European Economic Area, the United Kingdom or Switzerland, the Standard Contractual Clauses approved by the European Commission apply, module two (controller to processor), incorporated here by reference, with the UK International Data Transfer Addendum where the UK GDPR applies and the Swiss amendments where Swiss law applies. Sections 4, 6 and 7 of this agreement populate their annexes. Where the clauses and this agreement conflict, the clauses win.

12. Deletion and return

During the term your administrators can export your workspace’s card data and delete cards themselves. On termination we delete customer personal data within 30 days of your written request, except what we must keep by law and what sits in backups, which are overwritten on their normal cycle and remain protected by this agreement until they are. Administrative records that exist to prove who did what are retained as described in the Privacy Policy.

13. California

For personal information subject to California law, we are a service provider. We will not sell or share it, retain, use or disclose it outside our direct business relationship with you, or combine it with personal information from another source, except as that law permits. We certify that we understand and will comply with these restrictions.

14. Liability and term

Each party’s liability under this agreement is subject to the limits in the Terms of Service, except where applicable data protection law does not permit that. This agreement starts when you first use the service as a workspace and ends when customer personal data has been deleted under section 12.

15. Signature

Accepting the Terms of Service accepts this agreement; no signature is needed. If your procurement process requires an executed copy, email hello@kepptic.io with the signatory’s name and title and we will countersign.

KEPPTIC LLC. Address for legal notices and service of process: c/o Accumera LLC, 911 Central Ave., #101, Albany, NY 12206.

Related: Privacy Policy · Terms of Service · Trust & security