KalplexBusinesses
Data Processing Addendum
Last updated 26 October 2026
How Kalplex processes your customers' personal data on your behalf. Part of our Terms of Service.
1. Roles
This addendum applies when Kalplex processes personal data on your behalf in providing the service. You are the controller and Kalplex is the processor. It forms part of our Terms of Service and meets the requirements of Article 28 of the GDPR and the UK GDPR.
GoCardless is not our sub-processor. You engage GoCardless directly under your own agreement with it.
2. Details of the processing
| Subject matter | Providing the Kalplex service under the Terms of Service |
|---|---|
| Duration | The term of your subscription and up to 30 days after it ends |
| Nature and purpose | Storing customer records, creating mandate and payment requests through your GoCardless account, and showing their status |
| Data subjects | Your customers and the people who pay you |
| Personal data | Names, email addresses, GoCardless customer and mandate references, payment amounts, dates, status and return reasons |
| Special category data | None — do not enter it |
3. Our commitments
Kalplex will:
- process the data only on your documented instructions, which are these terms and your use of the service, unless the law requires otherwise — in which case we will tell you if we lawfully can;
- ensure that everyone authorised to process the data is bound by confidentiality;
- maintain appropriate technical and organisational security measures, including encryption in transit, isolation of each business's data and restricted access to credentials;
- help you respond to requests from people exercising their data protection rights;
- notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, and help you meet your own obligations;
- help you with data protection impact assessments and consultations with authorities where they relate to our service;
- delete or return the data at the end of the service, unless the law requires us to keep it; and
- make available the information needed to demonstrate compliance with this addendum and allow reasonable audits, on reasonable notice and subject to confidentiality.
4. Sub-processors
You authorise us to use the following sub-processors. We will give you at least 30 days' notice of any new sub-processor, and you may object on reasonable data protection grounds; if we cannot address your objection you may close your account.
| Sub-processor | Service |
|---|---|
| Supabase | Database and authentication |
| Cloudflare | Hosting and network security |
| Lovable | Application hosting and build platform |
We impose data protection obligations on each sub-processor equivalent to those in this addendum and remain responsible for their performance.
5. International transfers
Where personal data is transferred outside the EEA or the UK, we ensure an adequacy decision or standard contractual clauses (with the UK addendum where needed) protect it.
6. Contact
Data protection questions: privacy@kalplex.com.