Legal · Data processing agreement
Data processing agreement.
For business customers. Final version published before 1 July 2026.
If you're using Kando on behalf of a business customer — a property management company, a strata board, a construction principal — you may need a DPA in place between us.
Our DPA covers the standard things: the scope of processing (lodging certificates and the data needed to do that), where data lives (AWS Sydney), how long we keep it (30-day backups; 7 years for the audit trail to match NSW compliance law), and your rights as a controller (export, deletion, audit).
It plugs into the standard Australian Privacy Principles under the Privacy Act 1988 (Cth). It also covers sub-processors — we list them publicly and notify you before adding new ones.
We send a draft within a working day.