Data Processing Agreement

Version: 2026-10-01

This data processing agreement (“DPA”) under Art. 28 GDPR is part of the Terms of Service at https://kanroo.app/legal/terms/. It applies between the customer as controller (“Customer”) and TECHPOINT, Seestraße 3, 82211 Herrsching am Ammersee, Bavaria, Germany, as processor (“Kanroo”). The Customer accepts it with the Terms of Service.

1. Subject and duration

1.1 Kanroo processes personal data on behalf of the Customer to provide Kanroo Cloud. Annex 1 describes the type and purpose of the processing, the types of data, and the data subjects.

1.2 This DPA runs as long as Kanroo processes personal data for the Customer under the Terms of Service.

2. Instructions

2.1 Kanroo processes the data only on documented instructions from the Customer, including for transfers to third countries, unless EU or member state law requires otherwise. In that case, Kanroo informs the Customer before processing, unless the law forbids it.

2.2 The Terms of Service, this DPA, and the Customer’s use and configuration of Kanroo Cloud are the Customer’s complete instructions. Further instructions must be in text form and within the scope of the service.

2.3 Kanroo informs the Customer at once if it believes that an instruction violates data protection law.

3. Obligations of Kanroo

3.1 Kanroo ensures that persons authorized to process the data are bound to confidentiality.

3.2 Kanroo takes the technical and organizational measures in Annex 2 (Art. 32 GDPR). Kanroo may adapt them to technical progress, as long as the level of protection does not decrease.

3.3 Kanroo supports the Customer, taking into account the nature of the processing:

with appropriate measures to answer requests from data subjects (Art. 12 to 23 GDPR); most requests can be handled with the functions of the service, such as export and deletion;
with security, breach notification, data protection impact assessments, and prior consultation (Art. 32 to 36 GDPR).

3.4 Kanroo informs the Customer without undue delay after it becomes aware of a personal data breach that affects the Customer’s data. The notice contains the information under Art. 33 (3) GDPR, as far as it is available.

3.5 Kanroo forwards requests from data subjects that concern the Customer’s data to the Customer and does not answer them itself without instruction.

4. Sub-processors

4.1 The Customer authorizes Kanroo to use the sub-processors in Annex 3.

4.2 Kanroo informs the Customer by email at least 14 days before it adds or replaces a sub-processor. The Customer can object for an important data protection reason within this period. If Kanroo cannot address the objection, the Customer can end the contract before the change takes effect.

4.3 Kanroo imposes data protection obligations on each sub-processor that are equivalent to this DPA.

5. Place of processing

Kanroo processes the Customer’s data only in the European Union. A transfer to a third country requires the Customer’s instruction and must meet the requirements of Art. 44 to 49 GDPR. Push notifications that a user turns on go, encrypted end to end, to the push service of that user’s browser vendor, which may be outside the European Union and is not under Kanroo’s control.

6. Rights of the Customer and audits

6.1 Kanroo makes available to the Customer the information needed to demonstrate compliance with this DPA.

6.2 The Customer can audit compliance, also through an auditor bound to confidentiality. Audits take place during business hours, with at least 30 days’ notice, without disturbing operations, and at the Customer’s cost. Kanroo can first answer with written information or suitable certificates; the Customer can then audit if these are not sufficient.

7. Deletion and return

7.1 The Customer can export its data at any time with the export functions of the service, except during a suspension under the Terms of Service.

7.2 At the end of the contract, Kanroo deletes the Customer’s data, unless EU or member state law requires storage. Deleting an organization deletes its data at once. Copies in backups expire after 30 days.

7.3 Content that the Customer deletes with the functions of the service, such as tasks, comments, attachments, and pages, is deleted for good 30 days after its deletion. Copies in backups expire 30 days later.

8. Liability and precedence

8.1 Liability follows Art. 82 GDPR and the Terms of Service.

8.2 If this DPA and the Terms of Service conflict, this DPA prevails for data protection matters.

Annex 1: Processing details

Purpose and type. Hosting and operating Kanroo Cloud, a service to organize work in boards, tasks, forms, and wiki pages: storage, display, search, sending notifications, receiving emails for the Customer’s organization, export, and deletion.

Types of personal data.

user data: name, email address, avatar, and role of members and invited persons;
content data: tasks, comments, files, form submissions, wiki pages, and any personal data that users put into them;
email data: emails that external persons send to the Customer’s Email Intakes or reply addresses;
usage and audit data: actions in the workspace, with time and person, and, for sign-in, IP address and browser information.

Data subjects. Members and invited persons of the Customer’s organizations; persons who submit forms or send emails to the Customer; persons mentioned in the Customer’s content.

Special categories. The service is not designed for special categories of data (Art. 9 GDPR). If the Customer stores such data, the Customer is responsible for assessing whether the measures in Annex 2 are appropriate.

Annex 2: Technical and organizational measures

Location. All servers run at netcup in Nuremberg, Germany. Files are stored at Scaleway in Amsterdam, Netherlands. Transactional email is sent through Scaleway in Paris, France.

Physical access control. The servers are in the data centers of netcup and Scaleway, which control physical access. Kanroo has no physical access.

System access control.

Server administration only through a private VPN. SSH accepts keys only; root login is disabled.
Host firewalls allow only the public ports the service needs.
Automatic security updates and regular hardening audits on all hosts.

Data access control.

Users sign in with one-time email codes or single sign-on (SSO); there are no passwords to steal. Sign-in codes are stored as hashes, expire after 10 minutes, and allow three attempts.
Roles inside each organization control who may read and change content.
The application separates the data of each organization and checks the organization on every access.
Database roles have only the rights they need.
Secrets of webhooks, push subscriptions, and SSO are encrypted with AES-256-GCM.
Files in object storage are encrypted at rest with server-side encryption by the provider.
Administrative access to production systems is limited to named persons who need it.

Transfer control.

All connections from users use TLS. Connections between the servers run through an encrypted private VPN.
The application loads no resources from third parties and uses no content delivery network.
Push messages are encrypted end to end between the server and the browser.

Input control. The audit log records security-relevant actions with time and person. Users and organization owners can see their security activity and audit log.

Availability control.

Databases are backed up daily to Scaleway Object Storage in Amsterdam, Netherlands. Backups are kept for 30 days, and restoring them is tested.
Monitoring with alerts runs on Kanroo’s own servers. Logs contain no IP addresses and no browser information.
Requests are rate-limited to protect the service against overload and abuse.

Separation control. Each organization’s data is logically separated by organization.

Review. Kanroo reviews these measures regularly and after every relevant change.

Annex 3: Sub-processors

Sub-processor	Service	Location of processing
netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany	Server hosting for the application, database, mail server, and monitoring	Nuremberg, Germany
Scaleway SAS, 8 rue de la Ville l’Évêque, 75008 Paris, France	Object storage for files and backups	Amsterdam, Netherlands
Scaleway SAS, 8 rue de la Ville l’Évêque, 75008 Paris, France	Transactional email	Paris, France