Terms

Data Processing Terms

Part of the Kapi Works Terms: the contract that Article 28 of the UK GDPR requires when we process personal data for your organisation.

Version 1, 4 November 2026

1. These terms

1.1 These terms are part of the Kapi Works Terms (the "Online Terms") between KAPILEARN LIMITED, company 17333142, registered in England and Wales at 4th Floor Office, 205 Regent Street, London, England, W1B 4HB ("Kapi", "we", "us"), and the organisation that accepted them ("you"). They are the contract that Article 28 of the UK GDPR requires between you, as controller, and us, as your processor.

1.2 They apply whenever we process personal data for you in Kapi Works, on any plan, including Kapi Forms and Kapi Works training.

1.3 You accept these terms when you accept the Online Terms, when your organisation is created or when you first buy something in Plan & billing. The person who accepts does so for you, as clause 1.3 of the Online Terms says.

1.4 These terms are in writing, in electronic form. When someone accepts them, we record their account, your organisation, the time, and the version of the Online Terms and of these terms.

1.5 On personal data, these terms win over the Online Terms. If you sign a data processing agreement with us, it replaces these terms from the day it starts.

1.6 If the EU GDPR applies to your processing, these terms are also the contract that its Article 28 requires, and each reference to UK law includes the matching EU law.

2. Words we use

• Your Personal Data: personal data we process for you as your processor. Annex 1 describes it.
• Data Protection Law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended, including by the Data (Use and Access) Act 2025.
• Commission: the Information Commission, the UK's data protection regulator, which took over from the Information Commissioner on 30 September 2026.
• Personal Data Breach, controller, processor, data subject, personal data and processing: as in the UK GDPR.
• Sub-processor: another processor we use to process Your Personal Data. Annex 2 lists them.
• Recipient: a person, organisation or system that you choose to receive Your Personal Data through a tool in Annex 4. A Recipient is not our Sub-processor.
• Owners and admins: the people in your organisation's Studio team with those roles.
• Your team: everyone you give a role in Kapi Works Studio, including form owners, editors, viewers, billing managers and check-in helpers.

3. Roles

3.1 You are the controller of Your Personal Data, and we process it as your processor. Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the people it is about.

3.2 We use Your Personal Data only to provide Kapi Works to you under the Online Terms and these terms. We do not sell it, use it for marketing or advertising, or use it to train AI models, and we do not allow our Sub-processors to do so.

3.3 To keep Kapi Works secure and to stop fraud and misuse across all organisations, we also use a small set of data on our own account:

(a) the spam check and the limits on requests, which use the network address and browser signals of each request;

(b) a one-way code made from each email address that a copy of answers goes to, kept for one day, so that no address receives more than three copies a day from all organisations' forms together;

(c) the card check, the sign-up limits and the rule of one free organisation for each person and each card; and

(d) reports about forms, and what we do about them, such as closing a form or pausing an organisation's forms.

For this processing we are a controller. We use these data only for these purposes, and our privacy notice at kapiworks.com/privacy explains them.

3.4 We are also a controller of the account each person uses to sign in to Kapi Works, of your billing details and billing contacts, and of the records the law requires us to keep.

4. Your responsibilities

4.1 You are responsible for:

(a) having a lawful basis for each purpose of your forms and your training and, for any special category or criminal offence data you ask for, a condition under Article 9 or 10 of the UK GDPR and the Data Protection Act 2018;

(b) telling people how you use their data, who receives it and where, in a privacy notice you publish. Kapi can draft one from your forms; you check it, complete it and publish it;

(c) making sure your instructions to us comply with Data Protection Law;

(d) having the right to send the emails you ask us to send, such as invitations and reminders, and adding people to your People list only through a form's tick to agree;

(e) choosing who is on your team, what role each person has, and who you name as a check-in helper;

(f) choosing keep times that fit each form's purpose;

(g) deciding whether Kapi's AI may read written answers. It reads them unless you turn it off for your organisation or for a form, and it leaves out answers to questions marked as asking for special category data unless you turn that on for the form (Annex 1, A.3 and A.6);

(h) where you use a quiz's automatic marking, or another rule in a form, to make a decision that has a legal or similarly significant effect on someone, giving the safeguards in Article 22C of the UK GDPR: telling them about it, letting them make representations, having a person in your organisation reconsider it, and letting them contest it. Kapi Works lets your team mark answers by hand and release scores later;

(i) not aiming forms at children. Kapi Forms is for adults. A booking may count children as tickets, but your forms must ask nothing about them;

(j) handling complaints about how you use people's data, as section 164A of the Data Protection Act 2018 requires; and

(k) the copies of Your Personal Data that your team takes out of Kapi Works, and what your Recipients do with it.

4.2 Do not ask people for passwords, sign-in codes, card or bank details, or identity documents. Kapi Works refuses forms that ask for them where it detects them.

5. Instructions

5.1 We process Your Personal Data only on your documented instructions, including about transfers outside the UK, unless UK law requires us to do otherwise. In that case we tell you before we process it, unless the law forbids telling you.

5.2 Your documented instructions are:

(a) the Online Terms and these terms, with their annexes;

(b) what your team does in Kapi Works within the roles you give them, such as publishing a form, choosing its questions and keep time, sending invitations, deciding and marking answers, turning Kapi's AI on or off, adding a webhook endpoint, a Slack channel, a results link, an API key or your own address, downloading, and deleting; and

(c) other written instructions from an owner or admin, sent from their sign-in address to support@kapiworks.com, which we accept.

5.3 We tell you at once if we believe an instruction breaks Data Protection Law. We may wait to act on it until you confirm or change it.

5.4 If a court, the police or another public authority asks us for Your Personal Data, we refer them to you where we can, tell you unless the law forbids it, and disclose only what the law requires.

6. Our people

6.1 We give access to Your Personal Data only to the people who need it to provide, secure or support Kapi Works, and only as far as they need it. Our staff look at Your Personal Data only to help you at your request, to look into a security incident or a report about a form, or to comply with the law.

6.2 Everyone we authorise to process Your Personal Data, employee or contractor, is bound by a duty of confidentiality, by contract or by law. The duty continues after they stop working for us.

7. Security

7.1 We take the technical and organisational measures in Annex 3. They are designed to meet Article 32 of the UK GDPR, taking into account the state of the art, the costs, the nature, scope, context and purposes of the processing, and the risks to people.

7.2 We may change the measures over time, but not so that the overall level of protection falls.

8. Requests and complaints from people

8.1 Kapi Works gives your team tools to answer people's requests. They can see, download and delete answers, which takes a booking made with an answer with it; change or cancel bookings; find, download and delete what your forms keep under one email address; take someone off your People list or stop contacting them; and, for training, use Studio's screens, CSV downloads, records packs and the API. A person can correct their own answer through the link in their copy email while your form allows changes. Annex 1, A.8, says what Find by email covers and what it does not.

8.2 If someone asks us directly about Your Personal Data, we pass the request to you within 5 business days. We do not answer it ourselves unless you instruct us to.

8.3 Where your tools do not cover a request, we help you on your written instruction within 10 business days, taking into account the nature of the processing.

8.4 We give you the information you reasonably need to handle a complaint, under section 164A of the Data Protection Act 2018, about how Kapi Works processes Your Personal Data.

9. Other help

9.1 Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 of the UK GDPR: security, Personal Data Breaches, data protection impact assessments and prior consultation with the Commission.

9.2 These terms, their annexes and our published sub-processor list are provided for that purpose.

10. Personal Data Breaches

10.1 We tell your owners and admins without undue delay, and in any event within 48 hours, after we become aware of a Personal Data Breach affecting Your Personal Data.

10.2 We tell you, as far as we know: what happened; the categories and approximate number of people and records concerned; the likely consequences; what we have done and propose to do about it; and who to contact for more information. If we do not know all of this at once, we tell you in stages without undue delay.

10.3 We take reasonable steps to contain the breach and reduce its effects, and we keep you informed.

10.4 You decide whether to notify the Commission and the people affected. We do not notify them for you unless you ask us to or the law requires it.

10.5 Telling you about a breach is not an admission of fault.

11. Sub-processors

11.1 You give us general written authorisation to use the Sub-processors in Annex 2.

11.2 We publish our current Sub-processors at kapiworks.com/sub-processors. At least 30 days before we add or replace one, we email your owners and admins and update that page. The notice says who the Sub-processor is, what it will do, which data it will handle, where, which transfer safeguard applies, and the date by which you may object.

11.3 You may object in writing during the notice period, on reasonable data protection grounds. We will try to resolve the objection in good faith, for example by not using that Sub-processor for you. If we do not resolve it, you may end the affected service, or the Online Terms, by written notice before the change takes effect, and we refund fees you paid in advance for the time after it ends.

11.4 In an emergency, such as a provider failing or putting data at risk, we may replace a Sub-processor with shorter notice. We tell you as soon as we can, and clause 11.3 still applies.

11.5 We choose Sub-processors that give sufficient guarantees, and bind each by written contract to data protection obligations that give the same protection as these terms.

11.6 We remain fully liable to you for each Sub-processor's performance of those obligations.

12. Transfers outside the UK

12.1 We transfer Your Personal Data outside the UK, or allow access to it from outside the UK, only:

(a) to the Sub-processors in Annex 2, with the safeguard named there;

(b) through a tool in Annex 4 that your team uses; or

(c) as you otherwise instruct in writing.

12.2 For transfers under clause 12.1(a) we rely on UK adequacy regulations, including the Data Protection (Adequacy) (United States of America) Regulations 2023 for US organisations in the UK Extension to the EU-US Data Privacy Framework, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Before we rely on those clauses, we consider, acting reasonably and proportionately, whether the data protection test in Article 46 of the UK GDPR is met: that the protection after the transfer would not be materially lower than in the UK.

12.3 We give you a summary of that assessment on request.

12.4 If a safeguard stops being valid, we tell you and either move to another lawful safeguard or stop the transfer.

12.5 For a Recipient outside the UK, under clause 12.1(b), you are responsible for the safeguard (Annex 4).

13. Tools that send data to Recipients

13.1 Annex 4 applies whenever your team uses one of the tools it lists.

14. When processing ends

14.1 Processing ends when the Online Terms end, including when you close your organisation (Online Terms, clause 10). Until then, each record follows the keep times in Annex 1.

14.2 Notice. We email your owners and admins the date processing ends and the other dates in this clause.

14.3 Export Period. For 30 days after the end, your owners and admins can still sign in to see when your data goes and to download your training records, and if an owner closed your organisation, an owner can reopen it in that time, and processing then carries on as before. During that time we process Your Personal Data only to let you download it, to follow your instructions under this clause and to keep it secure. Your forms take no answers, and we send no emails to your people and make no AI requests.

14.4 Return. Your team can download Your Personal Data with Kapi Works' tools. If you ask in writing during the Export Period, we also give you, within 10 business days, a copy of anything those tools do not cover, in a common machine-readable format.

14.5 Deletion. We start deleting Your Personal Data on the day after the Export Period ends, and finish in our live systems within 14 days. Our Sub-processors delete it as Annex 2 says. Deletion covers every record and file we hold for you. It does not cover copies that you or your Recipients already hold.

14.6 Earlier deletion. An owner may instruct us in writing to delete sooner. We confirm the instruction to all your owners, and start deleting 72 hours after we send that confirmation, unless an owner withdraws the instruction first.

14.7 Backups and logs. After deletion, Your Personal Data may remain in database backups and service logs until they expire, within 35 days. Until then we keep it beyond use: we do not use, change, disclose or restore it, except to restore the whole service after an incident, and in that case we delete it again before the restored service is used. A Sub-processor that keeps data for a fixed period, such as the AI provider's 55-day copy kept to detect abuse, deletes it at the end of that period.

14.8 When the law requires us to keep data. If UK law, a court or a regulator requires us to keep some of Your Personal Data, we tell you unless the law forbids it, keep only what is required for as long as it is required, and then delete it.

14.9 Confirmation. On request, we confirm in writing when deletion was complete and what it covered.

14.10 What we keep. We keep a record of the deletion that holds none of Your Personal Data, and our own records as a controller (clause 3.4).

14.11 These terms keep applying to Your Personal Data until it has been deleted.

15. Information and audits

15.1 We make available the information you need to show that we meet Article 28 of the UK GDPR: these terms and their annexes, our published sub-processor list, and answers to reasonable written questions about our controls.

15.2 If that information is not enough, we allow and contribute to an audit or inspection by you, or by an independent auditor you appoint, if:

(a) you give us at least 30 days' written notice;

(b) there is no more than one audit in any 12 months, unless there has been a Personal Data Breach or a regulator requires one;

(c) the auditor is bound by confidentiality; and

(d) the audit takes place in business hours, does not disrupt the service and does not expose other organisations' data.

You pay our reasonable costs of an audit, unless it finds that we materially broke these terms.

15.3 At the date of these terms we hold no SOC 2 report or ISO 27001 certificate, and we have had no independent penetration test. We will tell you when that changes.

15.4 We tell you at once if we believe an audit request breaks Data Protection Law.

15.5 We keep records of our processing as Article 30(2) of the UK GDPR requires, and we cooperate with the Commission.

16. Liability

16.1 Each party's liability under these terms is subject to the limits in the Online Terms (clause 11).

16.2 Nothing in these terms limits a party's liability to people under Article 82 of the UK GDPR, or a party's right to recover from the other the part of any compensation that matches the other's responsibility.

17. Changes, law and notices

17.1 We may change these terms. We email your owners at least 30 days before a change takes effect, and publish the new version with a summary of what changed. A change the law requires may take effect sooner. If you do not agree to a change, you may end the Online Terms before it takes effect, as clause 12.2 of the Online Terms says.

17.2 We change Annex 2 under clause 11, and Annex 3 under clause 7.2.

17.3 The law and courts that govern the Online Terms (clause 13.8) govern these terms.

17.4 We send notices to the email addresses of your owners and admins. Send notices to us at support@kapiworks.com.

Annex 1: The processing

Part A: Kapi Forms

A.1 Subject matter. The forms, surveys, quizzes, requests, bookings (with sessions, tickets and waitlists), walk-in queues and appointments that you publish on forms.kapiworks.com or on your own address, and what they collect; and Results, People, invitations, emails and Kapi's AI for your team in Studio.

A.2 Duration. While you use Kapi Works, then until deletion under clause 14. Within that time, each record follows the keep times in A.7.

A.3 Nature and purposes. We collect what people send through your forms; store and organise it; show it to your team; mark quizzes and count results; send the emails and notifications your forms need, such as copies of answers, booking confirmations with tickets, waitlist offers, reminders and queue calls; send data to the Recipients you choose (Annex 4); and delete it when its keep time ends or when your team deletes it.

Unless you turn Kapi's AI off for your organisation or for a form, Kapi's AI reads written answers to short and long questions to find common themes for your team. It reads the newest 300 answers to each such question, each cut to 500 characters, and only once a question has at least 5 answers. It does not read answers to contact, organisation, job title, website, file, document, signature, recording or location questions, nor, unless you turn it on for the form, answers to a question marked as asking for special category data (A.6). When your team asks, Kapi's AI also drafts and translates forms, matches your look, and answers questions about your results from question titles and counts. People who answer your forms do not talk to Kapi's AI.

A.4 People.

(a) People who answer your forms, including quizzes and requests.

(b) People who book, and people named on a booking's tickets.

(c) People on a waitlist.

(d) People who join a walk-in queue.

(e) People you invite by email.

(f) People on your People list, and people who asked you to stop emailing them.

(g) People who save their answers to finish later, and people whose unfinished answers a form keeps.

(h) Check-in helpers you name.

(i) Your team.

(j) People named in answers, files or notes.

(k) People who receive a certificate from a quiz.

A.5 Types of personal data.

(a) Contact and identity: name, email address, phone number, postal address, organisation, job title and website.

(b) Answers to your questions, including choices, numbers, dates and times, ratings, grids, rankings, prices, a location that the phone gives with permission or that the person types, and a drawn signature (its pen strokes, with the typed name). With each answer: the form version, hidden fields from the form's link (names that look personal are refused), where the person came from, the language, whether a phone or a computer was used, the time taken, whether it looks like spam or is a test, and earlier versions after a change.

(c) Files, recordings and documents, on paid plans only.

(d) Your team's work on answers: decisions and their reasons, notes, tags, payment status, a request's owner, status and due date, quiz marks and certificates.

(e) Bookings: session, tickets, places, total, payment status, reference, QR ticket code, change link and check-ins; answers asked for each adult on a ticket; and your messages to everyone in a session.

(f) Waitlist places and offers. Queue tickets: number, name, optional email, language, a key kept on the person's phone (we keep a one-way code of it) and, if the person asks for notifications, their browser's push address.

(g) Invitations: email address, name, state, reminders, due date and your note.

(h) People list: email address, name, when they agreed and on which form, and whether they withdrew. Stop list: email addresses that asked to stop your emails.

(i) Answers saved to finish later, and unfinished answers.

(j) Codes that confirm an email address, for forms that take one answer from each person.

(k) Records of the emails sent and of their delivery.

(l) Webhook and Slack records (Annex 4).

(m) For AI themes: each written answer's theme and tone, and two short quotes for each theme.

(n) Your team's activity: who did what and when, including each search, download and deletion by email, which is kept with a one-way code made from the address instead of the address.

We keep no network address with answers, bookings or queue tickets.

A.6 Special category data and children. Some forms need special category data, such as access needs or first aid given. When a form's words mention health, medical, medication, disability, diagnosis, pregnancy, religion or faith, ethnic or racial origin, sexual orientation, sex life, trade union, political, criminal, conviction, offence or dietary topics, Publish warns your team; it does not refuse. Your team can mark a question as asking about health, disability or access needs, religion or belief, ethnicity, sexuality, politics or union membership; Kapi marks such questions when it writes them, and in its templates. Clause 4.1(a) and (g) apply. Kapi Forms is for adults: a ticket for children asks nothing about each child (clause 4.1(i)).

A.7 How long we keep it. Each record goes at the time below, or sooner when your team deletes it. Most deletions run each night; queue details, quiz sittings, held places and webhook records go when their own scheduled job runs.

A.8 Find by email. Find by email finds, downloads and deletes what your forms keep under one email address, whether or not it is on your People list: answers, with their notes, decisions, files, marks and earlier versions; bookings made with that address, with each ticket's answers; waitlist places; queue tickets, whose name, email, phone key and push address are cleared; answers saved to finish later; unfinished answers and quiz sittings that hold the address as a whole answer; invitations; codes; and the person's People list entry. Deleting them also deletes the webhook events of their bookings, check-ins, queue tickets and unfinished answers, with each delivery and try, and the AI theme quotes taken from their answers. An "answer erased" event still goes to the endpoints that listen for it, so your own systems can delete their copies. The stop list keeps the address, so that it stays stopped. Find by email does not reach: answers that give no email; an address written inside a longer answer or a note; answers for other people on someone else's booking; emails already sent; and copies held by your team or your Recipients. Its download gives each answer in words, but leaves out answers to address, location, signature, grid, ranking, price and "Other" questions. Where Find by email falls short, clause 8.3 applies.

A.9 On people's own devices. A form asks the person's browser to keep their answers so far, so they can come back. They are removed when the person sends, starts again, or opens the form again more than 7 days after their last change. A form that works offline keeps the answers and files waiting to send on the device until they are sent. A queue keeps a random key on the person's phone, to find their ticket and to give one ticket a day. The forms site keeps a copy of the form's page and pictures on the device, for offline use. People can clear all of these in their browser.

Part B: Kapi Works training

B.1 Subject matter. Training for your employees, partners and customers: assignments with deadlines, progress and completion records, certificates, reminders, reports and records packs; sign-in and sign-in rules; your doors' pages, policies and forms; live sessions in Kapi's room, recorded when you turn recording on; the Kapi Works API; and the people systems you connect.

B.2 Duration. As in A.2.

B.3 Nature and purposes. We collect, record, organise, store, show and erase data; send the emails the service needs; make it available through downloads, records packs and the API; carry sound and video between the people in a live session and record it when you choose; and, when your team asks Kapi's AI, draft courses, policies, pages and looks from your material and set up a door. When you record a session, Kapi's AI writes its captions from its sound. All of this is to provide, secure and support Kapi Works as you direct.

B.4 People. Your employees and the people you invite as employees; your Studio team; your partner and customer learners; people named in course material or files you upload; the hosts of your live sessions and anyone a camera or microphone catches in them; instructors you invite; and your contacts who give us instructions or receive notices.

B.5 Types of personal data. Name, work email and account ids; how people sign in, single sign-on ids, whether two-step sign-in is on, and sign-in times; role, audience, teams and invitations; courses, requirements, deadlines, progress and completion records, answers and assessment results, including what SCORM courses record; certificates (a public check page shows the holder's name and the certificate's status); activity records with a hashed IP address; API key and call records with shortened IP addresses; files you upload; messages you send to our support address; people's details from systems you connect, such as Microsoft Entra ID, Google Workspace, Okta and other SCIM directories, BambooHR, Personio and HiBob; and for live sessions, each person's place id and role, arrivals and leavings, the register, chat, typed captions, connection details that Cloudflare keeps as call analytics and, when you record, the recording, its captions and each person's choice whether to be shown in it.

B.6 How long we keep it.

Annex 2: Sub-processors

We use these Sub-processors for Your Personal Data. The current list is at kapiworks.com/sub-processors.

Sub-processor

Supabase Pte. Ltd., Singapore

What it does

Database, sign-in, storage for logos and pictures, server functions (the forms site's calls, emails, notifications, webhooks, Slack, billing and own addresses), scheduled jobs and secret storage.

Your Personal Data it handles

All of it at rest; and the network address of a browser that loads your logo or pictures from Supabase's storage.

Where

London, United Kingdom (AWS eu-west-2), for the database, sign-in and storage. The forms site's calls ask for functions to run in eu-west-2. Supabase does not publish where it keeps backups and logs.

Transfer safeguard

The UK Addendum in Supabase's data processing terms, for any access from outside the UK.

Sub-processor

Cloudflare, Inc., United States

What it does

Runs Studio, Learn and the API, the forms site and the Works website (Cloudflare Workers); the forms site's line for busy sales (a Durable Object for each busy booking form) and its limits on requests; your own address, with its certificate (Cloudflare for SaaS); file storage (R2) behind our file gateway, for files sent to your forms, course files, records packs and recordings; the AI Gateway, which carries Kapi's AI requests with its logs and cache turned off; jobs for Kapi's AI (Workflows); live sessions (RealtimeKit, its recorder, our live room and, for large webinars, Stream); and the services' logs.

Your Personal Data it handles

Data shown in or sent through these services while it is processed; files and recordings; for each place in a busy sale's line, a one-way code made from the visitor's network address, deleted with the place; request logs, kept up to 7 days.

Where

Requests enter Cloudflare at the location nearest the person. Studio, Learn and the API then run in London (AWS eu-west-2); the forms site and the website run at the nearest location. The busy-sale line and the live room: Western Europe (a location hint). Files: Cloudflare's Western Europe region. Where RealtimeKit keeps its records is not published.

Transfer safeguard

The UK Extension to the EU-US Data Privacy Framework, and the UK Addendum in Cloudflare's data processing terms.

Sub-processor

Amazon Web Services EMEA SARL, Luxembourg (Amazon SES)

What it does

Sends Kapi Works email: invitations and reminders, copies of answers, links to finish later, codes, booking confirmations with tickets and calendar files, waitlist offers, reminders, queue emails, quiz results, notices to your team and sign-in codes.

Your Personal Data it handles

Names, email addresses and the content of those emails, including the answers in a copy of answers.

Where

US East (N. Virginia), us-east-1.

Transfer safeguard

The UK GDPR Addendum to AWS's data processing terms: the UK Addendum to the EU Standard Contractual Clauses.

Sub-processor

Google Cloud EMEA Limited, Ireland (Gemini API, paid tier)

What it does

Kapi's AI, while it is on for your organisation: themes in written answers, drafting and translating forms, matching your look, answering questions about your results, drafting courses, policies and pages, setting up doors, and writing captions of recorded sessions.

Your Personal Data it handles

What your team gives Kapi's AI, which holds personal data only if your material does; written answers as Annex 1, A.3 says; for Set it up with Kapi, the names of your Studio team and of your door's teams and firms; and the sound of recorded sessions. Requests pass through Cloudflare's AI Gateway, except the sound for captions, which goes to Google directly and which we delete after each part.

Where

No location commitment for this service.

Transfer safeguard

Google's processor terms: the UK Extension to the EU-US Data Privacy Framework (Google LLC), with the Standard Contractual Clauses and the UK Addendum as fallback. On the paid tier Google does not use the data to train its models; it keeps prompts and outputs for 55 days to detect abuse.

Sub-processor

Google Cloud EMEA Limited, Ireland (Google Workspace)

What it does

Our mailboxes, including support@kapiworks.com.

Your Personal Data it handles

Messages you or your people send us.

Where

Google's infrastructure, which can be outside the UK.

Transfer safeguard

Google's Cloud data processing terms: UK adequacy regulations for the European Economic Area, the UK Extension (Google LLC), and the Standard Contractual Clauses with the UK Addendum as fallback.

Not our Sub-processors:

• Cloudflare Turnstile and our other own checks (clause 3.3). We are the controller. Cloudflare runs Turnstile for us and uses its signals, as its own controller, to improve it.
• Stripe. Our payment provider for the plans you buy and for the card check. It receives your billing details and the card typed into its form. It receives no answers and nothing about your people, because Kapi takes no payments for your forms.
• Browser push services (Google, Mozilla, Apple and Microsoft). When someone in your queue asks to be told when it is their turn, their own browser chooses its push service and gives us an address there. We send the call to that address sealed so that only their browser can read it. The push service carries it for the person's browser, under the person's own arrangement with that browser, not for us. We send only to these four services.
• Your Recipients (Annex 4), and the identity providers and people systems that you or your people choose.
• People's own email providers and devices.

Annex 3: Security measures

We take these measures.

For Kapi Forms

1. The forms site holds no database service key, keeps no sign-in session and sets no cookies. It reaches the database only through one server function, and signs each call with a secret and the time; the function refuses a call older than 60 seconds.
2. Sending an answer, saving to finish later, asking for a code, reporting a form, holding places, joining a waitlist, booking, joining a queue and trying a results link's password each pass Cloudflare Turnstile first, checked for that form and that site.
3. Each network address has limits: 600 calls a minute in all, and on one form 60 quiz starts, 60 file starts, 120 saves, 30 holds and 30 queue joins a minute. On a busy sale, one visitor holds at most 4 places in the line for a form.
4. Publishing refuses words that ask for passwords, sign-in codes, card or bank details, or passport, driving licence, National Insurance or social security numbers, in the form's languages and English. The same check covers invitation notes and how-to-pay text. Typed answers that hold a card number are refused.
5. Files are taken only on paid plans. Each goes from the person's browser straight to our file gateway, under a plan signed for that visit; no file passes through our Workers. Files are stored in private storage with no public address. Your team opens each through a pass that lasts 5 minutes. Limits: 10 MB a file and 50 MB a recording; 30 files a visit a day; 2,000 files an hour, 5 GB a day and 50 uploads in progress for each form.
6. A results link is off until a form owner makes one. It does not show answers to name, email, phone, address, file, document, signature, recording or location questions, or a quiz's right answers. It can have a password, kept hashed, and an end date, and can be removed at once. Its address is kept hashed.
7. Anonymous forms refuse questions that name a person, keep no device type or language, send no single answer to a webhook or Slack, and hide groups of fewer than 5 answers in results and downloads.
8. Webhook endpoints must use https and are signed with a secret kept in Supabase Vault. An endpoint that fails for 5 days turns off, and owners and admins are told. Slack tokens are kept in Supabase Vault.
9. Queue notifications are sealed so that only the person's browser can read them (RFC 8291).
10. A copy of answers goes to one address at most three times a day across all organisations, and at most 200 times an hour from one form.
11. Your own address is used only after a DNS record you add shows that you control it.
12. A form we remove for phishing or abuse sends no more email in your name.
13. The activity log records each search, download and deletion by email, each download of answers and files, each file opened, each results link made or removed, Kapi's AI turned on or off, and each form we close or organisation we pause.
14. Cloudflare's request logs are turned off for the forms site, and its own log lines hold no query strings, where hidden fields travel.

For all of Kapi Works

15. Works Studio, Works Learn and the API run on Cloudflare Workers placed in London (AWS eu-west-2), beside the database.
16. Staging and production are separate: separate Supabase projects, R2 buckets, Cloudflare Workers and gateway secrets.
17. Each organisation is separate. Database row-level security limits each signed-in user to the organisations and relationships they hold.
18. Only your owners and admins manage Works settings, API keys and records packs.
19. Creating an API key requires two-step sign-in, used in the current session, and a sign-in within the last 15 minutes.
20. The API is read-only and answers only GET and HEAD requests.
21. Keys hold 256 random bits and a checksum, which is checked before any database call. We store only a SHA-256 hash, the prefix and the last four characters. Keys are shown once, expire within one year, and an organisation can have at most ten active keys.
22. Keys are accepted only in the Authorization header. A key sent in a web address is revoked at once, and your owners and admins are told.
23. A key can be limited to up to 20 network ranges. Revocation is checked on every call.
24. Call records keep shortened IP addresses (/24 for IPv4, /48 for IPv6) and are deleted after 13 months.
25. Files are stored in private R2 buckets with no public address. Our file gateway serves a file only against a signed pass.
26. The activity log is append-only: database triggers block changes and deletions. It records the actor, target, time and request ID, a hashed IP address when there is one (raw IP addresses are not stored) and redacted details.
27. Works email is sent from kapiworks.com through Amazon SES over TLS.
28. Database changes ship as migrations through our release workflow. Automated tests and checks run before code is pushed.
29. We publish a security.txt file at www.kapiworks.com naming support@kapiworks.com as the contact for security reports.

Annex 4: Tools that send data to Recipients

4.1 What this annex is for. Some tools send Your Personal Data to people or systems you choose. Using one is your documented instruction (clause 5.2(b)). Its Recipients are yours, not our Sub-processors.

4.2 The tools.

Tool

Results links, and Present

Who can use it

Form owners

What it sends

A summary of results, and written answers only to the questions the owner chooses, to anyone with the link. Present shows results on your team's screen.

Our controls

As Annex 3, item 6.

Record of your instruction

Who made or removed each link, and when.

Tool

Webhook endpoints

Who can use it

Owners and admins

What it sends

The events you choose, with their bodies: answers sent, decided and deleted; bookings made, changed and cancelled, with the booker's name and email but not the answers asked for each person on a ticket; check-ins; queue tickets served, with the person's name and email; unfinished answers, with the answers so far and who the person is; members joining a door; training completed; certificates issued and expired.

Our controls

Signed, https only, retries for up to 72 hours. Nothing from anonymous forms.

Record of your instruction

Each endpoint's address, receiving organisation, purpose and country, who added it and when.

Tool

Slack

Who can use it

Owners and admins install Kapi's Slack app; each form names its channel

What it sends

For each answer: the form, the person's name, organisation and email domain, the firm their domain matches, when it was sent, up to 6 choice, number or date answers, and the decision and who made it. No typed answers, no full email, no bookings or queues, nothing from anonymous forms.

Our controls

Posts deleted when their answer goes. Tokens in Supabase Vault.

Record of your instruction

The installation, and each form's channel.

Tool

Works API keys

Who can use it

Owners and admins, with two-step sign-in in the current session and a sign-in in the last 15 minutes

What it sends

Training data within each key's scopes, as the Kapi Works API documentation says. Not Kapi Forms answers.

Our controls

Annex 4 of the signable agreement applies to keys.

Record of your instruction

Each key's receiving company, purpose, country, scopes and expiry, who made it and when.

Tool

Downloads

Who can use it

Your team, within their roles

What it sends

CSV and Excel of answers, single answers as PDF, files as a zip your browser builds, your People list, Find by email, training CSVs and records packs.

Our controls

Recorded in the activity log.

Record of your instruction

The activity log.

Tool

Your own address

Who can use it

Owners and admins, from your organisation's eighth day

What it sends

Your forms and your privacy notice under a web address you control. Bookings, tickets, queue tickets and Report this form stay on forms.kapiworks.com.

Our controls

Used only after a DNS record you add shows that you control the address.

Record of your instruction

Who added the address, and when its DNS record was found.

Tool

Emails to people you choose

Who can use it

Your team

What it sends

Invitations and reminders to the addresses you give.

Our controls

One-click "Stop these emails" in each; at most 300 a day on the free plan and 5,000 on a paid plan; none while your forms are paused.

Record of your instruction

Each invitation and its sending.

Tool

Connected people systems and file pickers

Who can use it

Owners and admins

What it sends

Data comes into Kapi Works from the systems you connect. We send them only sign-in requests and the searches your team makes.

Our controls

As each system's own terms allow.

Record of your instruction

The connection in Settings.

4.3 What we do not do. We do not check the receiving organisation, purpose or country you record, and we do not control what a Recipient does with the data. Once a webhook is delivered, a link is opened, a post is read or a file is downloaded, we have no way to recall it.

4.4 Your responsibilities. For each Recipient, you are responsible for:

(a) a lawful basis, and telling people about the Recipient in your privacy notice;

(b) a contract: terms meeting Article 28 of the UK GDPR if the Recipient is your processor, or data sharing terms if it is a separate controller;

(c) a transfer safeguard if the Recipient is outside the UK or reaches the data from outside the UK;

(d) sending only what the Recipient needs, and removing links, endpoints, channels and keys you no longer need; and

(e) telling Recipients about corrections and erasures, as Article 19 of the UK GDPR requires. We send an "answer erased" event to endpoints that listen for it, and delete our Slack posts when their answer goes.

4.5 Pausing. We may pause a tool if we reasonably believe it is compromised, or that what it sends breaks Data Protection Law. We tell your owners and admins promptly.