Data processing agreement: Bulk Property Import & Export

Version 1.0, 16 October 2026. Download as PDF

This data processing agreement (DPA) is part of the terms of service for Bulk Property Import & Export (the App) and applies when the App processes personal data on behalf of a customer. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act. It takes effect when the customer installs the App; no signature is needed. A countersigned copy is available on request from support@kayabyte.dev.

1. Parties and roles

• Controller: the customer that installs the App in its HubSpot account (you).
• Processor: Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we).

2. Subject, duration, nature and purpose

• Subject: providing the App’s functions: importing, exporting and copying property settings, and keeping a change log of them.
• Duration: while the App is installed, plus the deletion periods in section 8.
• Nature: collection through HubSpot’s APIs, storage, comparison, and transmission back to HubSpot at your instruction.
• Purpose: only to provide the App to you, to apply your plan and to give support.

3. Personal data and data subjects

• Data subjects: users of your HubSpot account, and people you name as digest recipients.
• Personal data: the installing user’s HubSpot user ID and email address; HubSpot user IDs that HubSpot attaches to property changes (created by, updated by); digest recipients’ email addresses; the content of property labels, descriptions and options, if you put personal data there.
• The App does not process CRM records (contacts, companies, deals, tickets) and requests no permission to read them. No special categories of personal data are processed.

4. Our obligations

We will:

1. process personal data only on your documented instructions, which are these terms and your use of the App, unless the law requires otherwise, in which case we tell you first unless the law forbids it;
2. ensure that anyone authorised to process the data is bound by confidentiality;
3. take the security measures described on the security page and in section 5;
4. use sub-processors only as described in section 6;
5. help you, as far as possible and considering the nature of the processing, to answer requests from data subjects exercising their rights;
6. help you meet your obligations on security, breach notification, impact assessments and prior consultation, considering the information available to us;
7. delete the data at the end of the service as described in section 8;
8. make available the information needed to show compliance with Article 28, and allow and contribute to audits by you or an auditor you appoint, with reasonable notice, at most once a year unless there has been a breach.

5. Security

Measures include: encryption in transit (TLS) for all connections; OAuth refresh and access tokens encrypted at rest with AES-256-GCM and bound to your account ID; verification of HubSpot’s request signature on every request from the App’s pages; strict separation of data by HubSpot account ID; short-lived signed links for downloads and uploads; no access to CRM records; logs without personal data beyond account and user IDs; access to the hosting account limited to Kayabyte.

6. Sub-processors

You give general authorisation to the sub-processors listed on the sub-processors page. We tell you about new sub-processors by updating that page at least 30 days before the change; you can object by email, and if we cannot resolve the objection, you can stop using the App and we refund any prepaid fees for the remaining period. We bind each sub-processor to data protection terms that are at least as protective as this DPA and remain responsible for them.

7. Transfers

Data is hosted by Cloudflare with the database in Europe. Where a sub-processor processes data outside the EEA, the transfer relies on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

8. Deletion and return

• When you disconnect the App in its settings, we delete tokens, snapshots, the change log, previews, uploads and account links immediately.
• When you uninstall the App in HubSpot, tokens are deleted when the uninstall reaches us (normally within an hour) and the remaining data within 30 days.
• You can export your property setup with the App at any time before uninstalling. On request we delete your data sooner.
• Billing records that the law requires us to keep (invoices) are kept by Stripe and us for the period the law requires.

9. Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties. We also notify HubSpot within 24 hours of technical issues affecting the integration, as our HubSpot partner agreement requires.

10. Liability and precedence

Liability follows the terms of service. If this DPA and the terms conflict on personal data, this DPA prevails.

11. Contact

Data protection questions: support@kayabyte.dev.