Data processing agreement (DPA)

This data processing agreement (Article 28 GDPR) forms part of the terms of service. It applies as soon as the customer (the controller) sends personal data to Ksar (the processor) through the API, the dashboard or a file audit.

1. Subject matter and duration

Ksar analyses the email addresses sent by the customer during signups on its services, to detect disposable addresses, duplicate accounts and promo abuse (discount codes, free trials, free credits). The agreement lasts as long as the customer’s account.

2. Data and data subjects

• Data subjects: users signing up on the customer’s services.
• Data: email address and, where applicable, technical identifiers sent by the customer (external identifier, signup events).
• No sensitive data is requested or processed.

3. How data is processed

• The address received is analysed in memory; only fingerprints (HMAC-SHA256 with a server secret and a per-customer salt) and the domain name are kept. The address is never stored in clear text, neither in the database nor in logs.
• Each customer’s data is isolated and never used for another customer.
• Fingerprint retention: 395 days by default, configurable by the customer, with automatic daily purge.

4. Ksar’s obligations

Ksar undertakes to:

• process data only on the customer’s documented instructions (API calls and the customer’s settings constitute instructions);
• ensure confidentiality and train authorised persons;
• implement appropriate security measures: encrypted transport (TLS), hashed API keys, restricted and logged access, encrypted backups, logs without clear-text personal data;
• help the customer answer data subject requests: the API allows erasure of all fingerprints linked to an address (DELETE /v1/subjects);
• notify the customer of any personal data breach affecting it without undue delay and within 48 hours of becoming aware of it;
• assist the customer with impact assessments and dealings with the supervisory authority;
• at the end of the agreement, delete all customer data within 30 days (unless retention is legally required);
• make available the information needed to demonstrate compliance with these obligations.

5. Sub-processors

The customer authorises the following sub-processors:

Sub-processor	Role	Data location
OVH SAS	API and database hosting	European Union (France)
Cloudflare, Inc.	Website hosting, bot protection, cookieless analytics	Global network (standard contractual clauses, Data Privacy Framework)
Brevo (Sendinblue SAS)	Transactional emails	European Union (France)
Stripe Payments Europe, Ltd.	Payment and invoicing	European Union (Ireland)

Ksar informs the customer by email of any addition or replacement at least 30 days in advance; the customer may object by cancelling its subscription. Each sub-processor is bound by obligations equivalent to this agreement.

6. Location and transfers

The API and the database are hosted in the European Union (France). Any transfer outside the European Union is covered by the European Commission’s standard contractual clauses or an adequacy decision.

7. Customer’s obligations

The customer informs data subjects of the processing (for example in its own privacy policy), has a legal basis (usually the legitimate interest of fraud prevention) and only sends Ksar the data that is necessary.

8. Audit

The customer may request the information needed to verify compliance with this agreement. An on-site audit is possible once a year, at the customer’s expense, with 30 days’ notice and under a confidentiality undertaking.

Contact: [email protected].

The French version of this agreement prevails.