Data Processing Agreement
Version v1.0
Data Processing Agreement pursuant to Art. 28 GDPR between the controller (school) and KIDO as processor.
§ 1 Parties
Controller: the school (as per registration data in the KIDO account). Processor: KIDO UG (haftungsbeschränkt) i.G., [TODO: full address as in the Imprint].
§ 2 Subject of processing
Processing of personal data of parents and children (booking data) for the purpose of providing the booking system on behalf of the school.
§ 3 Duration
This agreement applies for the duration of the main contract between KIDO and the school.
§ 4 Data categories & data subjects
Data categories: name, age (child); name, email, phone (parent); booking status; private notes by the school. Data subjects: parents and children who book a course at the school.
§ 5 Processor's obligations
KIDO processes data only on documented instructions from the school, secures it according to state-of-the-art (TLS, RLS, AES-256 at-rest with Supabase), binds all staff to confidentiality and supports the school in fulfilling data subject rights.
§ 6 Sub-processors
KIDO uses the following sub-processors (locations EU): • Supabase Inc. — eu-central-1 (database & auth) • Vercel Inc. — Frankfurt (app hosting) • Stripe Payments Europe Ltd. — Ireland (payments, DPA/SCC in place) • Resend — EU (transactional emails) • PostHog — EU cloud (analytics, only after end-user consent) • Sentry — EU region (error monitoring) • Google Maps — external map (only after end-user consent)
§ 7 Termination
Upon termination of the main contract, all personal data is deleted within 30 days or returned on request (data export from the account).
§ 8 Acceptance
Acceptance occurs by ticking the DPA checkbox during onboarding and is documented in the audit log together with timestamp, IP address and contract version (GDPR-04).