LEGAL
GDPR & Data Protection
Last updated 5 November 2026
Understand how Kasplo handles personal data and supports your data-protection responsibilities under the EU GDPR and UK GDPR, where applicable. This overview brings together the roles, safeguards and documents relevant to your use of Kasplo.
1 Kasplo’s role
When you use Kasplo to communicate with your customers, your organisation generally determines why and how their personal data is used and acts as controller. Kasplo processes that data on your behalf as processor. Where you act for another controller, Kasplo may act as subprocessor.
Kasplo’s separate handling of website, account, billing and business-contact information is explained in the Privacy Policy. Actual activities and applicable law determine each party’s responsibilities.
2 Your data and instructions
The Data Processing Addendum (DPA) sets out how Kasplo processes Customer Personal Data to provide, secure and support your subscribed services and follow your documented lawful instructions. It applies when incorporated into your accepted agreement or otherwise agreed in writing.
Kasplo does not sell Customer Personal Data or use client recipient lists for its own marketing. You remain responsible for a lawful basis, clear privacy notices, required marketing permissions and honouring opt-outs. Consent requirements also depend on the relevant channel and electronic-marketing rules.
3 Individual rights requests
Depending on applicable law, individuals may have rights to access, correct, erase, restrict or receive their data, object to processing, or withdraw consent where processing relies on it. Conditions and exceptions apply.
For information a Kasplo client processes about its recipients, requests should normally go to that client. Kasplo refers relevant requests to the client and provides reasonable assistance under the DPA, using available tools and support processes.
For information Kasplo handles for its own purposes, contact support@kasplo.com. We may verify identity or authority and respond within applicable legal timeframes.
4 Hosting and international transfers
Kasplo’s core application is hosted on AWS in India, subject to a different expressly agreed deployment. Service providers, integrations, support access and communication delivery may involve other countries.
The DPA sets out the applicable international-transfer arrangements, including EU Standard Contractual Clauses and the UK Addendum where required and available for the relevant transfer. Required transfer details, assessments and additional safeguards must be in place before a restricted transfer proceeds.
Contact us for information about the locations and safeguards applicable to your services.
5 Subprocessor oversight
The Subprocessor List identifies relevant service providers, their purposes and processing locations. Which providers process data depends on the services and features used.
Subprocessor authorisation, contractual safeguards, change notices and customer objection rights are governed by the DPA. The published list supports transparency and does not replace that process.
6 Security and incident handling
Kasplo’s technical and organisational safeguards are described in Schedule 2 of the DPA. They cover access controls, confidentiality, application and API transport, logging, backups, security review and incident handling. Encryption coverage and service-specific qualifications are documented there.
For a Security Incident affecting Customer Personal Data, the DPA requires notification without undue delay after awareness, with available information and follow-up as the investigation progresses. Kasplo assists with relevant obligations; each party remains responsible for notifications it is independently required to make.
7 Retention, export and deletion
In-service retention follows the subscribed module and agreed terms. Available export and deletion facilities, assisted requests and the post-termination process are described in the DPA and customer agreement.
Deletion remains subject to lawful retention exceptions and applicable retrieval or switching rights. Limited suppression records may be retained for justified purposes such as respecting communication preferences. Customers should plan exports before the applicable deletion deadline.
8 Documents and contact
Use these documents for the details relevant to your relationship with Kasplo:
Privacy Policy — Kasplo’s own handling of personal information and individual rights.
Data Processing Addendum — customer-data processing, security, assistance and transfer provisions.
Subprocessor List — relevant providers, purposes and locations.
Anti-Spam & Acceptable Use Policy — permitted use and sending requirements.
For privacy, GDPR or processing questions, email support@kasplo.com. Your customer agreement and applicable law govern processing commitments; this overview does not replace them.