Parties and effect
This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other agreement (“Agreement”) between Happen Software Limited, company number 736470, of Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland (“Kanera”), and the organisation using hosted Kanera (“Customer”). It applies automatically to the extent Kanera processes personal data in customer workspace content on Customer’s behalf.
Customer acts as controller or as a processor for another controller. Kanera acts as Customer’s processor or subprocessor accordingly. If this DPA conflicts with the Agreement on processing customer personal data, this DPA controls. The Agreement’s liability terms apply to this DPA except where applicable law or binding transfer terms provide otherwise.
Processing details
| Item | Details |
|---|
| Subject matter and purpose | Hosting and operating Kanera’s project-management, collaboration, file, automation, integration, support, security, backup, export, and deletion features as Customer uses and configures them |
|---|
| Duration | For the term of the Agreement and the documented deletion and backup periods after it ends |
|---|
| Nature of processing | Collection, recording, organisation, storage, retrieval, consultation, transmission, restriction, deletion, backup, restoration, and other operations needed to provide hosted Kanera |
|---|
| Data subjects | Customer personnel, contractors, board guests, invitees, clients, suppliers, and other people whose information Customer or its users place in Kanera |
|---|
| Personal data | Names, email addresses, profile and membership data, work assignments, comments, notes, files, activity, custom-field values, integration data, device and audit information, and any other personal data Customer submits |
|---|
| Sensitive data | Not intentionally required. Customer must not submit special-category, criminal-offence, payment-card, government-identifier, health, biometric, or similarly restricted data without prior written agreement and suitable safeguards |
|---|
| Frequency | Ongoing, as initiated by Customer and its authorised users |
|---|
Customer instructions and responsibilities
- Kanera will process customer personal data only on Customer’s documented instructions, including the Agreement, this DPA, Customer’s configuration and authorised use, unless Union or Member State law requires otherwise. Where lawful, Kanera will notify Customer before legally required processing.
- Kanera will promptly inform Customer if an instruction appears to infringe applicable data-protection law and may suspend the affected processing while the parties resolve it.
- Customer is responsible for the lawfulness of its instructions, the data it submits, the notices and lawful bases it provides, its users and permissions, and responding to data subjects as controller.
Confidentiality and security
Kanera ensures that personnel authorised to process customer personal data are bound by appropriate confidentiality obligations and receive access only as needed for their responsibilities.
Kanera maintains technical and organisational measures appropriate to the risk, including tenant and permission enforcement, encryption of configured secrets, hashed credentials and tokens where plaintext is not required, MFA controls, logging and audit trails, rate limits, transport security, protected backups, vulnerability management, access review, incident response, and business-continuity procedures. Kanera may update measures without materially reducing overall protection.
Personal-data breaches
Kanera will notify Customer without undue delay after becoming aware of a confirmed personal-data breach affecting customer personal data. The notice will describe, as information becomes reasonably available, the nature of the breach, affected data and people, likely consequences, mitigation taken or proposed, and a contact for follow-up.
Kanera will reasonably cooperate with Customer’s investigation and legally required notifications. Notification is not an admission of fault or liability. Customer remains responsible for deciding whether and how to notify its supervisory authority, data subjects, or others, unless applicable law assigns that duty to Kanera.
Data-subject and compliance assistance
Taking account of the nature of processing, Kanera will provide reasonable and technically feasible assistance for Customer to respond to requests for access, correction, deletion, restriction, portability, objection, and rights concerning automated decision-making. If Kanera receives a request concerning customer workspace content, it will direct the requester to Customer and notify Customer where appropriate and lawful.
Kanera will provide reasonable assistance with security, breach notification, data-protection impact assessments, and prior consultation obligations, taking account of the processing and information available to Kanera. Material work outside the hosted service may require an agreed professional-services fee.
Subprocessors
Customer gives general written authorisation for Kanera to use the subprocessors listed on the Subprocessors page. Kanera imposes written data-protection obligations appropriate to each subprocessor’s services and remains responsible for the performance of its processor obligations.
Kanera will give at least 30 days’ notice before a new subprocessor begins processing customer personal data where reasonably practicable. Customer may object during that period on reasonable data-protection grounds. The parties will work in good faith on a solution; if none is reasonably available, Customer may terminate the affected hosted service before the new subprocessor begins and receive a pro-rata refund of prepaid fees for the unused terminated period.
International transfers
Hosted workspace data is kept in Ireland and Germany. Kanera will not transfer customer personal data outside the EEA except in accordance with applicable data-protection law and an adequacy decision, approved Standard Contractual Clauses, or another lawful transfer mechanism.
If a restricted transfer from the EEA requires Standard Contractual Clauses, the then-current European Commission controller-to-processor or processor-to-processor module, as appropriate, is incorporated into this DPA. The optional docking clause applies; Ireland is the governing Member State; the Irish Data Protection Commission is the competent supervisory authority where the clauses permit that selection. For a restricted UK transfer, the UK International Data Transfer Addendum applies to those clauses. The binding transfer terms prevail over conflicting terms for the affected transfer.
Return and deletion
During the service term, Customer can delete content and use available exports. On termination, Customer should export accessible data before access ends. Where technically available and lawful, Customer may request an export within 30 days after termination.
After that period, Kanera will delete or anonymise customer personal data in accordance with the Privacy Policy’s retention schedule, including deletion of residual encrypted backup copies through the normal backup cycle within 14 days. Kanera may retain affected records only where law, a legal hold, fraud prevention, security, or the establishment or defence of claims requires it, and will isolate and protect retained data from other processing.
Information and audits
Kanera will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may request a compliance review no more than once per year, or more often where required by a supervisory authority or following a material personal-data breach.
The parties will first use current policies, security information and independent reports if available. If those are insufficient and an audit is legally necessary, the parties will agree a proportionate scope, timing, confidentiality protections, qualified independent auditor, cost allocation, and controls that avoid exposing other customers’ data or creating security risk. Kanera will promptly address substantiated material non-compliance.
Government requests
Unless prohibited by law, Kanera will notify Customer of a binding request from a public authority for customer personal data before disclosure. Kanera will review the request, challenge it where there are reasonable grounds, and disclose only the minimum data legally required.
Artificial intelligence
Kanera will not use customer personal data to train, fine-tune, develop, or improve a general-purpose artificial-intelligence or machine-learning model, and will contractually prohibit subprocessors from doing so for their own purposes, unless Customer expressly authorises the specific use in writing.
Kanera does not use customer personal data for solely automated decisions that produce legal or similarly significant effects. If that changes for an optional Customer-directed feature, Kanera will provide information and assistance reasonably required for Customer to meet applicable obligations before enabling it.
Contact and changes
Data-protection notices and requests under this DPA may be sent to [email protected]. Kanera may update this DPA to reflect law or service changes, but will not materially reduce protection during a paid term without notice and a lawful basis. This is DPA version 1, effective August 20, 2026.