GDPR & DPA

Our role

When you use Klimaro to manage your customers, technicians, quotes, and invoices, you are the data controller and we are the data processor. The GDPR obligations distribute accordingly.

Sub-processors

We use a small, auditable list of sub-processors:

• Cloudflare — CDN, WAF, and DNS (EU + global).
• Hetzner — application + database hosting (EU data centres).
• Resend — transactional email delivery.
• Stripe — billing (EU/US).
• Google — when you connect Google Calendar / Gmail integrations (your consent).

We update this list in advance when new processors are added. A current version always lives at this URL.

Data Processing Agreement (DPA)

Standard-contractual-clauses-based DPA is available at signup. Enterprise customers can execute a bespoke DPA. Email [email protected] to request.

International transfers

Default hosting is EU. If a sub-processor is outside the EEA (e.g., Stripe), we rely on SCCs and supplementary measures.

Data subject requests

If one of your customers exercises GDPR rights, you can fulfil it directly from the Klimaro admin (export / delete). We provide you with assistance on request.