Data Processing Agreement

Version: 1.1 · Effective date: 22 October 2026

This Data Processing Agreement ("DPA") forms part of the LadderKit Terms of Service or other agreement (the "Agreement") between the organisation that uses LadderKit (the "Customer") and LadderKit OÜ, registry code 17619531, registered address J. Poska 14a-2, Tallinn, 10126, Estonia, VAT number EE103039897 ("LadderKit"). It applies whenever LadderKit processes personal data on the Customer's behalf in providing the Service ("Customer Personal Data"). Terms such as "controller", "processor" and "personal data breach" have their meaning in Regulation (EU) 2016/679 ("GDPR"). If this DPA conflicts with the Agreement, this DPA prevails as regards personal data.

1. Roles

1.1 The Customer is the controller of Customer Personal Data and LadderKit is its processor. The Customer is responsible for having a legal basis for the processing and for informing its users.

1.2 The Service is not designed for special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR), such as health information. The Customer shall not enter such data into the Service unless LadderKit has agreed to it in writing. If such data is entered by mistake, the Customer removes it, and LadderKit helps on request.

1.3 LadderKit is an independent controller, outside this DPA, only for the data it processes for its own purposes — the security of accounts and of the Service, records of what was agreed with the Customer, billing and its website — as described in its Privacy Policy. All other processing of the Customer's users' accounts and data is carried out on the Customer's behalf under this DPA.

2. Instructions and confidentiality

2.1 LadderKit processes Customer Personal Data only on the Customer's documented instructions — the Agreement, this DPA and the Customer's configuration of the Service — including with regard to transfers to third countries, unless EU or Member State law requires otherwise; LadderKit will then inform the Customer first, unless that law prohibits it. LadderKit will tell the Customer if it believes an instruction infringes data protection law.

2.2 LadderKit does not sell Customer Personal Data, use it for advertising, or use it to train machine-learning models.

2.3 Everyone LadderKit authorises to process Customer Personal Data is bound by confidentiality.

3. Security

LadderKit implements the technical and organisational measures in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR). It may update them, provided the overall level of security is not reduced.

4. Sub-processors

4.1 The Customer authorises LadderKit to engage the sub-processors listed in Annex 3, and further sub-processors under this clause.

4.2 LadderKit will notify the Customer's administrators at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds by writing to privacy@ladderkit.com; if the parties cannot resolve the objection, the Customer may terminate the Agreement and receive a pro-rata refund of prepaid fees.

4.3 LadderKit binds each sub-processor by written contract to data-protection obligations equivalent to this DPA and remains liable to the Customer for its sub-processors.

5. Assistance

5.1 LadderKit will assist the Customer, taking into account the nature of the processing, in responding to data subjects' requests (Chapter III GDPR) and in meeting its obligations under Articles 32–36 GDPR. Requests LadderKit receives directly from data subjects are forwarded to the Customer without undue delay.

5.2 Assistance covers data the Service does not show to the data subject — for example a promotion request about them, or feedback the Customer's settings keep from them. The Service's visibility settings do not limit data subjects' rights. On the Customer's request LadderKit exports such data for the Customer, which decides what to disclose, taking into account the rights and freedoms of others.

5.3 Users can view and correct their own data in the Service. Permanent erasure or export of a user's data is carried out by hand by LadderKit on the Customer's request to privacy@ladderkit.com within 14 days, free of charge.

6. Personal data breaches

LadderKit will notify the Customer's administrators without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information required by Article 33(3) GDPR as it becomes available, and will take reasonable steps to contain and mitigate it.

7. Return and deletion

7.1 On the Customer's request, LadderKit will provide an export of Customer Personal Data in a machine-readable format and/or delete it from its live systems within 30 days. When the Customer is switching to another provider, the switching clause of the Terms of Service applies instead, including its transitional and retrieval periods. Exports and deletions are carried out by hand by LadderKit, free of charge.

7.2 If no request is made, LadderKit deletes Customer Personal Data within 90 days after the Agreement ends, unless the law requires it to be kept.

7.3 Deleted data disappears from LadderKit's rolling backups within a further 30 days. LadderKit confirms the deletion in writing on request.

8. Audits

LadderKit will make available the information necessary to demonstrate compliance with Article 28 GDPR, including answers to reasonable security questionnaires. Where that is not sufficient, LadderKit will allow audits by the Customer or an auditor it mandates, bound by confidentiality, on 30 days' written notice and at the Customer's cost. No such notice period applies — reasonable notice is enough — where a supervisory authority requires the audit, after a personal data breach affecting Customer Personal Data, or where the Customer has reasonable grounds to suspect a breach of this DPA.

9. International transfers

Customer Personal Data is stored in the European Union. Where a sub-processor processes it outside the EEA, the transfer relies on an adequacy decision (including the EU–U.S. Data Privacy Framework) or on the European Commission's standard contractual clauses, as listed for each sub-processor in Annex 3. A copy of the safeguards is available from privacy@ladderkit.com.

10. Term and general

This DPA lasts as long as LadderKit processes Customer Personal Data. Liability is governed by the Agreement, except where data protection law does not allow it to be limited. This DPA is governed by the law that governs the Agreement, failing which by Estonian law. LadderKit may amend it to reflect changes in law or in the Service, provided protection is not reduced, with 30 days' notice of material changes.

Annex 1 — Details of the processing

Annex 2 — Security measures

• Encryption in transit: HTTPS (TLS) everywhere, with HSTS; the database is reachable only on a private network.
• Tenant isolation: each organisation's data is kept apart by an organisation identifier taken from the authenticated session, never from the request, and queries for customer data are scoped to it; tests check the separation.
• Access control: role- and reporting-line-based permissions; passwords stored as bcrypt hashes; short-lived sessions with rotated, hashed refresh tokens; rate limits on sign-in and verification; optional mandatory Sign in with Google or Microsoft.
• Infrastructure: default-deny firewall; key-only SSH; secrets kept out of source code; production access limited to LadderKit's founder, who is bound by confidentiality.
• Payment data: card details go directly to the payment provider and never reach LadderKit's servers.
• Resilience: nightly database backups, the latest 30 kept, each checked automatically to be complete and to read back in full; a test restore at least every six months; health checks, automatic restarts and error monitoring.
• Privacy by design: no advertising or behavioural analytics tools and no session recording; the server and security logs needed to run the Service are kept. Error reports are filtered before they are sent: request bodies, query strings, cookies, identifying headers and tokens in addresses are removed, and reports are not linked to a user account.
• Change control: version control; every change is checked by the developer, and automated linters and tests run before it is merged and deployed.

Annex 3 — Sub-processors

Slack is not a sub-processor of LadderKit. Where the Customer connects its own Slack workspace, LadderKit delivers notifications into it on the Customer's instruction, and Slack processes them under the Customer's own agreement with Slack.