This Data Processing Agreement ("DPA") forms part of the agreement between Radius Studios LLC, doing business as Kaixon (30 N Gould St Ste N, Sheridan, WY 82801, USA — "Kaixon", "we") and the customer accepting it ("Customer", "you") for the Kaixon subscription services, including the free trial (the "Service"). It applies whenever we process personal data on your behalf and takes effect when you first accept it in your dashboard.
1. Roles, and what this DPA covers
For personal data you put into the Service — entries in your Document Vault records, names and details in your registers, content in your compliance documents, and personal data in evidence files you upload — you are the controller and we are your processor under Article 28 GDPR. We process that data only as this DPA and your use of the Service instruct.
This DPA does not cover data for which we are the controller (your account email, billing, the free readiness check) — that is described in our Privacy Notice at kaixon.ai/privacy.
2. Details of the processing
The subject matter, duration, nature and purpose of the processing, and the types of data and categories of data subjects, are set out in Annex A.
3. Our core promises as your processor
We will:
a. Follow your instructions. We process your vault data only on your documented instructions — which are this DPA, the main agreement, and your use of the Service's features (saving, exporting, deleting) — unless EU or member-state law requires otherwise, in which case we tell you first unless that law prevents it. If we believe an instruction breaks data protection law, we will tell you.
b. Keep it confidential. Only people authorised to operate the Service can access your data, and each is bound by confidentiality obligations. Access is limited to what operating the Service requires (Annex B).
c. Keep it secure. We maintain the technical and organisational measures in Annex B and will not weaken them during your subscription. We may improve them.
d. Use only approved sub-processors (section 4).
e. Help you with data subject requests. Taking into account the nature of the processing, we give you the tools (search, export, correction, deletion of uploaded files, and deletion of your account) and reasonable assistance to answer access, correction, deletion, portability, restriction and objection requests. If a data subject contacts us directly about your records, we forward the request to you without undue delay and do not answer it ourselves except to point them to you.
f. Help you with security, breach and DPIA duties. We provide reasonable assistance with your Articles 32–36 obligations (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to us.
g. Tell you about breaches. If we become aware of a personal data breach affecting your data, we notify you without undue delay, and in any case within 72 hours of becoming aware, with what we know: the nature of the breach, the records concerned, likely consequences, and the measures taken or proposed. We won't notify authorities or data subjects on your behalf unless you ask or law requires.
h. Delete or return your data at the end. While you are a paying subscriber you can export your records at any time (Excel, Word, PDF). When a paid subscription ends, your vault becomes read-only and you have a 30-day export window; we then delete your vault data within 90 days of the end of the subscription, unless EU or member-state law requires us to keep it. During a free trial, documents Kaixon creates for you cannot be exported until you subscribe, but files you uploaded yourself can be downloaded at any time; if a trial ends without a subscription, the vault becomes read-only, your uploaded files stay downloadable, and we delete the vault, including those files, no sooner than 30 days after the trial ends. In every case, backups holding your data expire on the normal backup rotation.
i. Show you it's true. We make available the information reasonably necessary to demonstrate compliance with Article 28 — this DPA, our sub-processor list, our security documentation — and allow audits as set out in section 6.
4. Sub-processors
You give general written authorisation for the sub-processors listed at kaixon.ai/subprocessors (summarised in Annex C). Each is bound by a written agreement imposing data protection obligations materially equivalent to this DPA, and we remain fully responsible to you for their performance.
Before we add or replace a sub-processor that touches your vault data, we update that page and notify subscribers by email at least 14 days in advance. If you have a reasonable data protection objection, tell us within that window; if we can't offer a workaround, you may terminate the affected subscription and we refund any prepaid fees for the period after termination.
5. Where your data lives, and international transfers
Your vault data is stored in the EU (Frankfurt). Where a sub-processor is in a country without an EU adequacy decision — or has a US parent — the transfer is protected by Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as listed on the sub-processor page. We will not transfer your vault data outside these arrangements without putting a valid transfer mechanism in place first.
6. Audits
We answer reasonable written audit questions and provide supporting documentation at no charge. Where you (or your supervisory authority) need more, you may audit our compliance with this DPA once per 12 months, on at least 30 days' written notice, during business hours, without access to other customers' data or to information that would compromise our security. Each party bears its own costs. If an audit reveals a material breach of this DPA, we fix it at our cost.
7. Liability and order of precedence
Liability under this DPA follows the liability terms of the main agreement. Nothing in this DPA limits either party's liability to data subjects under Article 82 GDPR. If this DPA conflicts with the main agreement on data protection matters, this DPA wins.
8. Duration and law
This DPA runs as long as we process your vault data and section 3(h) survives until deletion is complete. It is governed by the same law as the main agreement, except where GDPR requires otherwise.
Annex A — Details of the processing
| Subject matter | Compliance records the Customer builds and stores in the Kaixon dashboard/Document Vault (registers, policies, action tracking) and evidence files the Customer uploads. |
| Duration | The trial or subscription term, plus the export window and deletion period in section 3(h). |
| Nature & purpose | Hosting, storage, display, autosave, export (Excel/Word/PDF) and deletion of Customer-entered records and uploaded files; no other use. Kaixon's scoring of the free readiness check is outside this DPA (controller processing, deterministic, no AI model in the data path). |
| Types of personal data | What the Customer chooses to enter — typically names, roles, work contact details of staff and vendor contacts appearing in compliance records (e.g. access matrices, RoPA entries, incident logs) — and, where the evidence-upload feature is used, whatever personal data appears in the evidence files the Customer uploads (e.g. signed agreements, configuration screenshots). The Service asks customers not to enter special-category data. |
| Categories of data subjects | The Customer's employees, contractors, and vendor/business contacts referenced in its compliance records. |
Annex B — Technical and organisational measures (summary)
- Encryption: TLS 1.2+ in transit on every hop; AES-256 at rest in the EU database.
- Tenant isolation: database row-level security — every read and write is scoped to the authenticated customer; verified by test harness. No shared-tenant access paths.
- Access control: passwordless magic-link sign-in for customers; multi-factor authentication on every administrative account for the systems that hold or serve your data, with hardware security keys on our email, password manager and DNS accounts; least-privilege service credentials; no service-role keys in customer-facing paths.
- Auditability: append-only event log of document creation, saves and exports; its records are removed only when an account is erased at your or a data subject's request.
- Infrastructure: EU (Frankfurt) database and functions; deliberately small, documented vendor set (see sub-processor list); encrypted database backups on managed rotation.
- Organisational: single-operator company with documented security policies (ISMS evidence maintained), security-over-convenience standing principle, vendor data-processing terms in place, and pre-launch security review of the authentication layer.
Annex C — Approved sub-processors
The authoritative, always-current list (with regions and transfer safeguards) is published at kaixon.ai/subprocessors. At the date of this DPA, sub-processors that can touch Customer vault data: Supabase (database/functions/storage, EU-Frankfurt; US parent under SCCs), Cloudflare (delivery/rendering, SCCs/DPF), Resend (transactional email incl. sign-in links; sent from the EU (Ireland), with the email itself, metadata and logs stored in the US; SCCs/DPF), Anthropic (the AI help chat in your account; it receives only the messages you type into the chat and has no route to your vault, your answers or your reports; US; SCCs). Billing (Stripe) and marketing (Kit) providers process Kaixon-controller data only and are listed in the Privacy Notice.