Data Processing Agreement (DPA)

What is this?

When you use Kraaft, your company entrusts us with personal data about your teams and worksites. To govern how we process this data on your behalf, we enter into a Data Processing Agreement ("DPA") with each client, in accordance with Article 28 of the GDPR.

This page explains its content in plain terms. The contractual DPA, which is the legally binding document, is appended to your Subscription Agreement and accepted upon subscription.

Who does what?

Under the DPA, roles are clear:

• Your company is the controller: it decides why and how its users' data is processed.‍
• Kraaft is the processor: we process this data solely on your instructions, in order to provide our Services.

The DPA covers only this scope (worksite data and end-user data). The processing of your commercial, marketing or prospecting data, where Kraaft acts as a controller, is described separately in our Privacy Policy.

Which data is concerned?

• End-user profile information: name, email and phone number
• Content created on the platform: photos, videos, text messages, and forms completed or uploaded

This data is processed for one purpose only: to provide the communication and worksite-tracking features.

Our key commitments

The DPA formalizes, in particular, Kraaft's commitment to:

• Process data solely on your documented instructions, never for other purposes.‍
• Secure the data through appropriate technical and organizational measures (Art. 32 GDPR).‍
• Ensure confidentiality: anyone authorized to process your data is bound by a confidentiality obligation.‍
• Assist you in responding to your users' rights requests, and with impact assessments where applicable.‍
• Notify you without delay of any data breach affecting your data.
• ‍Return or delete your data at the end of the contract, at your choice (within 30 days).‍
• Bind its sub-processors to the same obligations, with a right of objection on your part.‍
• Allow compliance audits, once a year, with 30 days' notice.

Where is the data hosted?

Your data is hosted exclusively within the European Union, on Google Cloud Platform infrastructure (Belgium and the Netherlands). Should we use a sub-processor involving a transfer outside the EU, it is governed by the European Commission's Standard Contractual Clauses (Module 3).

Our sub-processors

Partners processing application data (worksite and user data), here Kraaft acts as a processor on behalf of your company:

Partners processing commercial and marketing data (clients and prospects), here Kraaft acts as a controller:

We inform you of any new sub-processor, and you have 30 days to object.

Last update @25 août 2026

‍