---
title: Data Processing Agreement | Kitiquette
description: "Kitiquette's Data Processing Agreement: how we process personal data in your HubSpot account on your behalf, under GDPR, UK GDPR and CCPA."
image: https://www.kitiquette.com/hubfs/raw_assets/public/kitiquette-theme/images/social-card.e4374264.png
---

[Skip to content](https://www.kitiquette.com/dpa#main)

[![](https://www.kitiquette.com/hubfs/raw_assets/public/kitiquette-theme/images/logo.a96e9f7a.svg) Kitiquette](https://www.kitiquette.com/?hsLang=en)

Menu

[Pricing](https://www.kitiquette.com/pricing?hsLang=en) [Setup guide](https://www.kitiquette.com/setup-guide?hsLang=en) [FAQ](https://www.kitiquette.com/faq?hsLang=en) [Support](https://www.kitiquette.com/support?hsLang=en) [Start free trial](https://www.kitiquette.com/trial?hsLang=en) 

[Start free trial](https://www.kitiquette.com/trial?hsLang=en)

# Data Processing Agreement

Effective date: 25 October 2026

This Data Processing Agreement ("DPA") forms part of the [Terms of service](https://www.kitiquette.com/terms?hsLang=en) between Kitiquette, 1617 Laura Rd, River Oaks, TX 76114, USA ("Processor", "we"), and the customer that installs or subscribes to the Kitiquette app for HubSpot ("Customer", "you"). It applies whenever we process personal data on your behalf in providing the App, and it takes effect automatically when you accept the Terms. If you need a signed copy, email [support@kitiquette.com](mailto:support@kitiquette.com).

## 1. Definitions

"Data Protection Law" means the laws that apply to the processing of Customer Personal Data, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended ("CCPA"). "Customer Personal Data" means personal data in your HubSpot account that we process to provide the App. "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR.

## 2. Roles and instructions

You are the controller (or a processor acting for your controller), and we are your processor. We process Customer Personal Data only on your documented instructions, which are these Terms, this DPA and your use of the App's features. If we believe an instruction breaks Data Protection Law, we will tell you. Annex 1 describes the processing.

## 3. Confidentiality

Anyone we authorize to process Customer Personal Data is bound by confidentiality.

## 4. Security

We keep the technical and organizational measures in Annex 2 in place, appropriate to the risk. We may improve them over time but will not reduce the overall level of protection.

## 5. Subprocessors

You authorize the subprocessors listed in Annex 3. We will tell you at least 30 days before adding or replacing a subprocessor, by email or on this page. You may object on reasonable data protection grounds within that period; if we can't resolve the objection, you may end your subscription and we will refund any prepaid fees for the remaining period. We impose data protection terms on each subprocessor that are no less protective than this DPA, and we remain responsible for them.

## 6. Helping you

Taking into account the nature of the processing, we will help you answer data subjects' requests to exercise their rights and meet your obligations on security, breach notification, data protection impact assessments and prior consultation. Most Customer Personal Data stays in your HubSpot account, where you can access, correct and delete it yourself. If a data subject contacts us directly about Customer Personal Data, we will pass the request to you.

## 7. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information we reasonably can about its nature, likely consequences and the measures taken, and update you as we learn more.

## 8. Deletion

When the App is uninstalled or your subscription ends, we delete the stored HubSpot access tokens for your account at once (or, if the App is removed from HubSpot directly, the next time the token is used), server logs within 3 days, and the monthly rep counts within about 70 days. The App does not keep copies of your CRM records. Data in your HubSpot account remains under your control.

## 9. Audits

On request, we will provide the information reasonably needed to show compliance with this DPA, including answers to your security questionnaire. If that isn't enough to meet a requirement of Data Protection Law or a supervisory authority, you may audit our compliance once a year, at your cost, with at least 30 days' notice, during business hours, under confidentiality, and without access to other customers' data. We do not currently hold third-party certifications such as SOC 2 or ISO 27001.

## 10. International transfers

Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 apply, Module Two (controller to processor) or Module Three (processor to processor) as relevant, and are incorporated by reference: Clause 7 (docking clause) applies; in Clause 9 option 2 applies with the notice period in section 5; in Clause 11 the optional language does not apply; in Clauses 17 and 18 the law and courts of Ireland apply; Annexes I to III are completed by Annexes 1 to 3 of this DPA. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to those Clauses applies; for Swiss transfers, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection. Where a subprocessor is certified under the EU-US Data Privacy Framework, we may rely on that certification instead.

## 11. California (CCPA)

For the CCPA, we are your service provider. We will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the App, or combine it with personal data from other sources except as the CCPA allows. We will tell you if we can no longer meet our CCPA obligations.

## 12. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow such limits. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; the Standard Contractual Clauses prevail over both.

## Annex 1: Description of the processing

| Data subjects | The Customer's HubSpot users (sales reps and admins); deal owners; any individuals whose names appear in the Customer's products or deals. |
| --- | --- |
| Categories of data | HubSpot user IDs, names and email addresses of users and deal owners (read to check permissions, and to email discount approvers and requesters); product, deal and line-item records, which may contain personal data the Customer chose to put in them. No special categories of data are intended. |
| Nature and purpose | Reading products and deals, checking permissions and rules, creating line items, saving unfinished carts, the builds added and discount approval requests on the deal (with the HubSpot user IDs of the requester and approver), keeping the customer's named discount approvers, emailing approvers and requesters about approval requests, and counting monthly reps for plan limits, to provide the App. |
| Frequency and duration | Continuous, for each request a user makes, during the subscription. |
| Retention | Request data is processed in memory, with a product list cached for up to 30 seconds; server logs 3 days; monthly rep counts (keyed one-way hashes of user IDs) about 70 days; access tokens until uninstall. See section 8. |

## Annex 2: Security measures

- Every request from the App's cards must carry a valid HubSpot signature (HMAC-SHA256) made in the last 5 minutes; others are refused.
- HTTPS (TLS) for all traffic; HubSpot access tokens encrypted at rest with AES-256-GCM.
- Each request runs with the requesting customer's own token only; customers' data is kept separate.
- No storage of CRM records; data minimized to what each request needs; logs limited to the account ID and errors, kept 3 days.
- Permissions (deal owner or team, super admin for settings) and discount limits checked on the server.
- Least-privilege HubSpot permissions: no access to contacts, companies, emails, tickets or files.
- Hosting on Cloudflare's infrastructure, which maintains its own security certifications.
- Access to production systems limited to Kitiquette personnel who need it, with two-factor sign-in on every account that runs the App (HubSpot, Cloudflare, GitHub, email).

More detail is on our [Security](https://www.kitiquette.com/security?hsLang=en) page.

## Annex 3: Subprocessors

| Subprocessor | Purpose | Location |
| --- | --- | --- |
| Cloudflare, Inc. | Runs the App's server; stores encrypted access tokens and monthly rep counts; holds server logs; sends approval emails | Global network; company in the United States |

HubSpot, Inc. hosts your HubSpot account under your own agreement with HubSpot; it is not our subprocessor. Our own email (Google) and billing (Stripe) providers are covered by our [Privacy policy](https://www.kitiquette.com/privacy?hsLang=en); they receive Customer Personal Data only if you send it to us, for example in a support email.

**Kitiquette**: good manners for your product kits. Product configurator for HubSpot Sales Hub Starter, Professional and Enterprise.

- [Start a trial](https://www.kitiquette.com/trial?hsLang=en)
- [Pricing](https://www.kitiquette.com/pricing?hsLang=en)
- [Setup guide](https://www.kitiquette.com/setup-guide?hsLang=en)
- [FAQ](https://www.kitiquette.com/faq?hsLang=en)
- [Support](https://www.kitiquette.com/support?hsLang=en)
- [Compare with HubSpot quote rules](https://www.kitiquette.com/compare/hubspot-quote-rules?hsLang=en)
- [Privacy](https://www.kitiquette.com/privacy?hsLang=en)
- [Terms](https://www.kitiquette.com/terms?hsLang=en)
- [Security](https://www.kitiquette.com/security?hsLang=en)
- [DPA](https://www.kitiquette.com/dpa?hsLang=en)
- Cookie settings
- [support@kitiquette.com](mailto:support@kitiquette.com)

© 2026 Kitiquette. HubSpot is a trademark of HubSpot, Inc. Kitiquette is an independent app and is not affiliated with HubSpot.