GDPR compliance

1. Roles

Open Digital WEB LTD trading as Klarvo is the data controller for marketing-site visitors, account holders, and billing records. It is the data processor for the personal data within your organisation's workspace (the systems, evidence, policies you create).

2. Lawful bases

We rely on the following Article 6 bases:

• Contract — operating your account.
• Legal obligation — tax, accounting, fraud-prevention.
• Legitimate interests — security, abuse prevention, aggregated product analytics, balanced against your rights.

3. Data subject rights

GDPR gives you the right to access, rectify, erase, restrict, object to, and port your personal data. Account holders can self-serve most of these via Settings; for anything that needs us, email hello@klarvo.io. We respond within 30 days.

4. Sub-processors

See the Data Processing Agreement for the current list. We give 30 days' notice of any new sub-processor and provide the right to object on reasonable grounds.

5. International transfers

Klarvo hosts primary data in the European Union (Supabase EU region). Where personal data leaves the EEA via a sub-processor, we rely on the European Commission's Standard Contractual Clauses and run a transfer-impact assessment.

6. Security

Row-level security on every database table; encryption in transit and at rest; least-privilege access; quarterly access review; per-environment isolation. Full security measures listed in the DPA.

7. Breach notification

We notify affected customers and (where required) the relevant supervisory authority within 72 hours of becoming aware of a personal-data breach, per Article 33 / 34.

8. Data Protection Officer

Klarvo does not currently meet the GDPR Article 37 thresholds requiring a DPO. The named privacy contact is the founder; email hello@klarvo.io.

9. Complaints

If you believe Klarvo has handled your data unlawfully, please contact us first so we can address it. You also have the right to lodge a complaint with your local supervisory authority (e.g. the UK ICO; the data protection authority of your Member State).