Kindnod

Data processing agreement

Version 0.1, draft of 21 October 2026. This agreement forms part of the Kindnod terms of service and applies to every account.

1. Parties and roles

The customer (the holder of a Kindnod account) is the controller of personal data relating to visitors of the websites they add to Kindnod. Kindnod (the operator of kindnod.com) is the processor, acting only on the customer's documented instructions, which are: to display the consent banner, to block and release scripts according to the visitor's choice, to record each consent decision so the customer can demonstrate consent under Article 7(1) GDPR, and to report on those records in the dashboard.

2. Subject matter and duration

Processing lasts for as long as the customer's site uses the Kindnod tag and for the retention period of the plan afterwards (30 days on Free, 5 years on Pro and Agency), after which records are deleted.

3. Nature and purpose

Recording and reporting consent decisions made by website visitors, so that the customer can prove consent and honour its withdrawal.

4. Categories of data and data subjects

Data subjects: visitors to the customer's websites. Data: the consent decision (four category booleans), the method of decision, a timestamp, a two-letter country code, and a one-way hash of a truncated IP address and browser user agent. No names, email addresses, full IP addresses, or page URLs are processed. The one first-party cookie set by the banner, kindnod_consent, contains the decision and a random stamp.

5. Obligations of the processor

Kindnod will:

  1. process the data only on the customer's instructions set out in section 1, unless required by EU or member-state law, in which case Kindnod informs the customer before processing unless the law forbids it;
  2. ensure persons authorised to process the data are bound by confidentiality;
  3. implement the technical and organisational measures described at kindnod.com/security, including encryption in transit and at rest, EU hosting, truncation and hashing of IP addresses, access limited to named staff with two-factor authentication, and retention limits enforced by a scheduled job;
  4. engage sub-processors only under the conditions of section 6;
  5. assist the customer, by appropriate technical measures and insofar as possible, in responding to requests from data subjects (the visitor hash is not reversible, so requests are usually satisfied by the visitor withdrawing consent through the banner, which the customer can point them to);
  6. assist the customer with its obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to Kindnod;
  7. at the customer's choice, delete or return the data at the end of the service, and delete existing copies unless EU or member-state law requires storage;
  8. make available the information needed to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the customer or an auditor mandated by the customer, on 30 days' notice, at most once a year, and at the customer's cost unless the audit reveals a material breach;
  9. notify the customer without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting the customer's data.

6. Sub-processors

The customer gives general authorisation for the sub-processors listed at kindnod.com/security (currently Vercel for hosting, Neon for the database, Resend for email, and Stripe for payments). Kindnod gives 30 days' notice by email of any intended addition or replacement, during which the customer may object. If the objection cannot be resolved the customer may terminate the service and Kindnod will refund any prepaid fees for the remaining term.

7. International transfers

Consent records are stored in Frankfurt, Germany. Where a sub-processor processes data outside the EEA (email delivery and payment processing may involve US entities), the transfer relies on the EU-US Data Privacy Framework where the sub-processor is certified, or on the European Commission's standard contractual clauses.

8. Liability

Each party's liability under this agreement is subject to the limitations in the Kindnod terms of service, except that nothing limits liability that cannot be limited under applicable law.

9. Term and termination

This agreement applies for as long as Kindnod processes personal data for the customer and ends when the data has been deleted under section 5(7).

10. Governing law

This agreement is governed by the law that governs the Kindnod terms of service.

This document is a draft pending review by a qualified data protection lawyer and may change before the service leaves beta.