Skip to main content

Private beta — access is by invitation only. Public sign-up is not open and paid plans are not yet available.

Data Processing Addendum

Status
Effective
Version
2026-09-21-v1
Effective date
2026-09-21

1. Scope and roles

This Addendum applies between KOTB Group Inc. and an organizational customer when KOTB Group Inc. processes Customer Personal Data on the customer's behalf through iKOTB. It forms part of the customer's iKOTB agreement once incorporated or agreed in writing. The customer determines purposes/instructions; KOTB Group Inc. acts as service provider/processor to the extent applicable.

2. Instructions and lawful data

The customer instructs KOTB Group Inc. to process Customer Personal Data as necessary to provide, secure, support and maintain iKOTB and follow documented instructions consistent with the Service. The customer is responsible for the lawfulness, accuracy and authority for data it provides.

3. Confidentiality and security

Access is limited to authorized personnel/providers subject to appropriate confidentiality obligations. Measures include organization-scoped RLS, private storage, role-based authorization, audit logging, authentication/session controls, TOTP/AAL2 for platform administrators, leaked-password protection, server-only secrets, security headers, rate limits, backups/recovery and transactional-email feedback handling. Measures may evolve without materially reducing overall protection.

4. Subprocessors and cross-border processing

The customer authorizes the providers listed in the current Subprocessors and Service Providers list. KOTB Group Inc. uses contractual or other appropriate measures intended to require protection and maintains provider review. Customer Personal Data may be processed outside the customer's province and outside Canada, including the current Supabase production region in the United States.

5. Rights assistance

Taking into account the nature of processing and information available, KOTB Group Inc. will provide reasonable assistance for valid access, correction, deletion or other privacy-right requests relating to Customer Personal Data. Current fulfillment/export/deletion procedures may be manual.

6. Security incidents

KOTB Group Inc. will investigate confirmed incidents affecting Customer Personal Data and notify the customer without undue delay when the incident materially affects Customer Personal Data or notice is required by law or agreement. The parties will reasonably cooperate on legally required notifications.

7. Return, retention and deletion

On termination or a valid documented request, KOTB Group Inc. will reasonably assist with return or deletion of Customer Personal Data, subject to law, legal holds, security/audit requirements, customer instructions and provider backup cycles. iKOTB currently uses a verified manual process rather than promising instantaneous automatic deletion.

8. Information, government requests and precedence

On reasonable request, KOTB Group Inc. will provide information reasonably necessary to demonstrate privacy/security measures, subject to confidentiality and proportionality. Where legally permitted, compulsory disclosures will be limited to what is required and affected customers will be notified where practicable. This Addendum controls a data-protection conflict with the main agreement; liability, governing law and dispute terms otherwise follow the main agreement unless mandatory law requires otherwise.