Data Processing Agreement
Version 1.0. Effective 10 October 2026.
This agreement applies automatically. It is part of the Terms of Service between KiviDB and every customer of KiviDB Cloud, and takes effect when you start using the service. You do not need to sign it. If your organization needs a countersigned copy, write to privacy@kividb.io.
1. Parties and scope
1.1 This Data Processing Agreement ("DPA") is between KiviDB Private Limited, a company incorporated in India with its registered office in Indore, Madhya Pradesh ("KiviDB"), and the person or organization that has agreed to the Terms of Service ("Customer").
1.2 It applies to Personal Data that Customer stores in, or sends through, a database provided by KiviDB Cloud ("Customer Personal Data"), to the extent Data Protection Law applies to it.
1.3 It does not apply to personal data KiviDB processes as a controller for its own purposes, such as account, billing and support records. The Privacy Policy covers those.
1.4 It does not apply to KiviDB software that Customer runs on its own infrastructure outside KiviDB Cloud. KiviDB does not process data held there.
2. Definitions
"Data Protection Law" means the law on the protection of personal data that applies to the processing concerned, including, where applicable, Regulation (EU) 2016/679 ("GDPR"), the GDPR as it forms part of United Kingdom law ("UK GDPR"), the Swiss Federal Act on Data Protection, the Indian Digital Personal Data Protection Act 2023, and the California Consumer Privacy Act.
"Personal Data", "controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR, and include the equivalent terms in other Data Protection Law.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in KiviDB's possession or control.
"Sub-processor" means another processor engaged by KiviDB to process Customer Personal Data.
"Standard Contractual Clauses" or "SCCs" means the clauses annexed to Commission Implementing Decision (EU) 2021/914.
"Trust Center" means this website, trust.kividb.io.
3. Roles
3.1 Customer is the controller of Customer Personal Data, or a processor acting for another controller. KiviDB is Customer's processor, or sub-processor.
3.2 Customer decides what data to store. KiviDB does not know, and does not need to know, whether a database contains Personal Data or what kind. Customer is responsible for having a lawful basis for the processing and for giving any notices and obtaining any consents required.
3.3 Customer must not store data that the Terms of Service or the Compliance page say the service is not suitable for, including protected health information and payment card data.
4. Customer's instructions
4.1 KiviDB will process Customer Personal Data only on Customer's documented instructions. The Terms of Service, this DPA and Customer's use of the console, API and other features of the service are Customer's complete instructions.
4.2 KiviDB will tell Customer if it believes an instruction breaks Data Protection Law. It need not follow such an instruction.
4.3 If a law that applies to KiviDB requires it to process Customer Personal Data in another way, KiviDB will tell Customer before doing so, unless that law forbids it.
4.4 KiviDB will not sell Customer Personal Data, will not share it for cross-context behavioural advertising, and will not keep, use or disclose it for any purpose other than providing the service.
5. Details of the processing
| Subject matter | Hosting and operating Customer's database. |
|---|---|
| Duration | While Customer uses the service, and until deletion under section 11. |
| Nature and purpose | Storage, retrieval, replication, backup and deletion of data at Customer's direction, in order to provide the service. |
| Types of personal data | Whatever Customer chooses to store. KiviDB does not determine this. |
| Categories of data subjects | Whoever Customer's data relates to, typically Customer's own users and customers. |
| Special categories | None intended. Customer must not store special-category data unless it has assessed that the service's security is appropriate for it. |
6. Confidentiality
KiviDB will ensure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality.
7. Security
7.1 KiviDB will maintain the technical and organisational measures described on the Security page of the Trust Center. That page also states which measures are not in place.
7.2 KiviDB may change these measures. It will not make a change that materially reduces the overall security of the service.
7.3 Customer is responsible for deciding whether those measures are appropriate for its data, and for using the controls the service gives it: the allowlist, TLS, private connectivity, credentials, roles and backups.
8. Sub-processors
8.1 Customer gives KiviDB general authorisation to engage Sub-processors. The current list is on the Sub-processors page.
8.2 KiviDB will add a new Sub-processor to that page at least 14 days before it starts processing Customer Personal Data. A customer who has asked for notice by email will also be emailed.
8.3 Customer may object within those 14 days, on reasonable data-protection grounds, by writing to privacy@kividb.io. The parties will discuss the objection in good faith. If it cannot be resolved, Customer may stop using the affected part of the service and receive a refund of any prepaid, unused amount for it.
8.4 KiviDB will bind each Sub-processor to data-protection obligations no less protective than this DPA, and remains responsible to Customer for the Sub-processor's performance.
8.5 Where Customer runs a database in its own cloud account, the cloud provider acts under Customer's own agreement with it and is not KiviDB's Sub-processor.
9. Assistance
9.1 The service lets Customer read, correct, export and delete its data itself. Customer will use those features to respond to requests from data subjects.
9.2 If KiviDB receives a request from a data subject about Customer Personal Data, it will pass the request to Customer and will not answer it, except to say that it has been passed on.
9.3 Taking into account the nature of the processing and the information available to it, KiviDB will give Customer reasonable help with data protection impact assessments and consultations with supervisory authorities.
10. Personal Data Breach
10.1 KiviDB will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach.
10.2 The notice will be sent to the email address of the organization's owner, and will describe, as far as KiviDB knows it: what happened, what data and which databases are affected, the likely consequences, and what KiviDB has done and proposes to do. KiviDB will add information as it learns more.
10.3 KiviDB will take reasonable steps to contain and remedy the breach.
10.4 A notice under this section is not an admission of fault or liability.
11. Deletion and return
11.1 Customer can export its data, and delete its databases, snapshots and exports, at any time. The Data page states what each deletion does and how long residual copies last.
11.2 When the agreement ends, KiviDB will delete Customer Personal Data remaining in the service within 30 days, and it is erased from backups within the further periods stated on the Data page, unless the law requires KiviDB to keep it.
12. Information and audit
12.1 KiviDB will make available the information needed to show that it meets its obligations under this DPA. The Trust Center is the primary source. KiviDB will answer reasonable written questions from Customer about it.
12.2 KiviDB has not been audited by an independent third party. If one is performed, KiviDB will make a summary of the report available under a duty of confidentiality.
12.3 If the information under 12.1 and 12.2 is not enough for Customer to meet its obligations under Data Protection Law, Customer may audit KiviDB's processing of Customer Personal Data, itself or through an independent auditor bound by confidentiality, on these terms: at least 30 days' written notice; no more than once in any 12 months, unless a supervisory authority requires it or there has been a Personal Data Breach; during business hours and without unreasonable disruption; limited to what is relevant to Customer Personal Data, with no access to other customers' data; and at Customer's cost.
13. International transfers
13.1 KiviDB stores a database in the region Customer chooses. Account records, credentials, logs and metrics are stored in Germany. KiviDB's staff are in India and can access the service from there.
13.2 Where Customer Personal Data that is subject to the GDPR is transferred to KiviDB in a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA and apply as follows:
- Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) where Customer is a processor.
- Clause 7 (docking clause) does not apply.
- Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 8.2.
- Clause 11: the optional language does not apply.
- Clause 17: the Clauses are governed by the law of Ireland.
- Clause 18: disputes are resolved by the courts of Ireland.
- Annex I: the parties are as in section 1, Customer as data exporter and KiviDB as data importer; the description of the transfer is section 5; the competent supervisory authority is the one that supervises Customer, or the Irish Data Protection Commission if none is identified.
- Annex II: the measures in section 7.
- Annex III: the list in section 8.1.
13.3 For transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0) is incorporated and completed with the information in section 13.2; either party may end the Addendum as set out in its section 19.
13.4 For transfers subject to Swiss law, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.
13.5 If there is a conflict between the Standard Contractual Clauses and the rest of this DPA or the Terms of Service, the Standard Contractual Clauses prevail.
13.6 If KiviDB receives a legally binding request from a public authority for Customer Personal Data, it will tell Customer before responding unless the law forbids it, will challenge a request it reasonably believes is unlawful, and will disclose no more than the request requires.
14. Liability
Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service. Nothing in this DPA limits a data subject's rights under the Standard Contractual Clauses or a party's liability to a data subject.
15. Term, changes and order of precedence
15.1 This DPA lasts as long as KiviDB processes Customer Personal Data.
15.2 KiviDB may update this DPA to reflect changes in the law or in the service. It will publish the new version here with its date, and record it in the change log. A change that reduces Customer's protection takes effect 30 days after publication, and Customer may end its use of the service before then.
15.3 If this DPA and the Terms of Service conflict on the processing of Customer Personal Data, this DPA prevails.
15.4 Apart from the Standard Contractual Clauses, this DPA is governed by the law and subject to the courts named in the Terms of Service.
16. Contact
Data protection: privacy@kividb.io. Security: security@kividb.io.