Data Processing Agreement
Effective June 8, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between KatchT (“Processor”) and any organization using KatchT HQ (“Controller”). It applies wherever KatchT processes personal data on behalf of the Controller — primarily lead and contact records captured in KatchT HQ. No separate signature is required; accepting the Terms of Service constitutes acceptance of this DPA.
1. Definitions
- “Personal data” has the meaning given in the GDPR (Regulation (EU) 2016/679) and the UK GDPR.
- “Controller” means the KatchT HQ customer (the organization) that determines the purposes and means of processing personal data.
- “Processor”means KatchT, which processes personal data on the Controller's behalf.
- “Sub-processor” means any third party engaged by KatchT to process personal data in connection with the service.
2. Processing details
| Subject matter | Storage and organization of the lead and contact records the Controller captures using KatchT HQ. |
| Duration | For the term of the Controller's subscription to KatchT HQ, plus the data-retention period described in the Privacy Policy. |
| Nature of processing | Storage, retrieval, display, export, deletion — as directed by the Controller through the KatchT HQ interface or API. |
| Purpose | To provide the KatchT HQ service: enabling the Controller to capture, store, organize, and export leads associated with marketing events and campaigns. |
| Categories of personal data | Lead contact fields entered by the Controller: first name, last name, job title, company name, email address, lead source, and capture timestamp. |
| Categories of data subjects | Individuals (event attendees, prospects) whose contact details the Controller captures at marketing events or imports into KatchT HQ. |
3. Controller's obligations
The Controller warrants that:
- It has a lawful basis under applicable data protection law for collecting and transferring to KatchT each category of personal data it enters into KatchT HQ.
- It has provided any required notices and obtained any required consents from the data subjects before capturing their details.
- It will not instruct KatchT to process personal data in a way that would violate applicable law.
4. KatchT's obligations as Processor
KatchT will:
- Process personal data only on the Controller's documented instructions and not for any other purpose.
- Ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations.
- Implement and maintain appropriate technical and organizational security measures as described in Section 6.
- Assist the Controller, to the extent reasonably possible, with fulfilling data subject rights requests (access, rectification, erasure, restriction, portability) within 30 days of a verified request.
- Assist the Controller with its obligations under Articles 32–36 of the GDPR (security, breach notification, DPIAs) to the extent that information held by KatchT is required.
- Promptly notify the Controller upon becoming aware that an instruction violates applicable data protection law.
- At the Controller's choice, delete or return all personal data to the Controller upon termination of the service, and delete existing copies except where retention is required by law.
5. Sub-processors
KatchT is authorized to use sub-processors to deliver the service. Current sub-processors that may handle lead data are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | US (AWS us-east-1) |
| Stripe | Payment processing (billing records only, not lead data) | US / EU |
KatchT will give Business-plan customers at least 10 days' prior written notice before adding or replacing a sub-processor that will handle lead personal data. If the Controller objects on reasonable data protection grounds, it may terminate the subscription with a pro-rata refund for the remaining pre-paid period.
KatchT requires each sub-processor to comply with obligations equivalent to those in this DPA and remains liable to the Controller for the sub-processor's acts and omissions as if they were KatchT's own.
6. Security measures
KatchT implements the following technical and organizational measures to protect personal data:
- Access control — Row-Level Security (RLS) in Postgres ensures that data is accessible only to authenticated members of the correct organization. Role-based permissions (owner, admin, editor, viewer) restrict write access.
- Encryption in transit — All traffic between clients and servers is encrypted using TLS 1.2+.
- Encryption at rest — Data is stored on encrypted volumes managed by Supabase (AES-256).
- API key security — API keys are stored only as SHA-256 hashes. The plaintext key is shown once at creation; KatchT cannot recover it.
- Integration token security — OAuth tokens for third-party integrations (e.g., HubSpot) are encrypted at the application layer using AES-256 before storage; plaintext tokens are never persisted.
- Authentication — Account access is protected by password hashing (managed by Supabase Auth / bcrypt). Email confirmation is required for new accounts.
7. Data breach notification
KatchT will notify the Controller without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting data processed under this DPA, to the extent required by applicable law. The notification will describe: the nature of the breach; the categories and approximate number of data subjects and records involved; likely consequences; and the measures taken or proposed to address it. Notification will be sent to the email address associated with the Controller's account.
8. International transfers
KatchT stores data on Supabase infrastructure hosted in the United States. Where the Controller is located in the UK or EEA, KatchT relies on the European Commission's Standard Contractual Clauses (SCCs) as the transfer mechanism. By accepting this DPA, the Controller enters into Module Two (Controller-to-Processor) SCCs with KatchT, which are hereby incorporated by reference.
9. Records of processing
KatchT maintains records of processing activities as required by Article 30 of the GDPR and will make them available to supervisory authorities on request.
10. Liability
Each party's liability under this DPA is subject to the limitations set out in the Terms of Service, except to the extent that applicable data protection law does not permit such limitations.
11. Term and termination
This DPA takes effect on the date the Controller accepts the Terms of Service and remains in force until the Controller's subscription ends. On termination, KatchT will delete or return personal data as described in Section 4, within 90 days.
12. Contact
Data protection questions or requests under this DPA: privacy@katcht.com.