Data processing agreement: Deal Approvals & Stage Gate

Version 1.0, 17 October 2026. Download as PDF

This data processing agreement (DPA) is part of the terms of service for Deal Approvals & Stage Gate (the App) and applies when the App processes personal data on behalf of a customer. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act. It takes effect when the customer installs the App; no signature is needed. A countersigned copy is available on request from support@kayabyte.dev.

1. Parties and roles

• Controller: the customer that installs the App in its HubSpot account (you).
• Processor: Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we).

2. Subject, duration, nature and purpose

• Subject: providing the App’s functions: checking deal stage changes against your approval policies, moving deals back or on, and recording approval requests and decisions.
• Duration: while the App is installed, plus the deletion periods in section 8.
• Nature: collection through HubSpot’s APIs, storage, evaluation against your policies, and transmission back to HubSpot (stage changes, notes, tasks, the Approval status property) at your instruction.
• Purpose: only to provide the App to you, to apply your plan and to give support.

3. Personal data and data subjects

• Data subjects: users of your HubSpot account (installing user, requesters, approvers, deal owners), and people whose names appear in deal names or comments you enter.
• Personal data: the installing user’s HubSpot user ID and email address; approvers’ and deal owners’ names, HubSpot user and owner IDs and email addresses; who requested, approved or rejected and when; comments and reasons entered in the App; deal names and IDs, deal amounts and the deal property values your policies use.
• The App does not read contacts, companies or tickets. No special categories of personal data are processed, unless you put them in a comment or a deal property your policy uses.

4. Our obligations

We will:

1. process personal data only on your documented instructions, which are these terms and your use of the App, unless the law requires otherwise, in which case we tell you first unless the law forbids it;
2. ensure that anyone authorised to process the data is bound by confidentiality;
3. take the security measures described on the security page and in section 5;
4. use sub-processors only as described in section 6;
5. help you, as far as possible and considering the nature of the processing, to answer requests from data subjects exercising their rights;
6. help you meet your obligations on security, breach notification, impact assessments and prior consultation, considering the information available to us;
7. delete the data at the end of the service as described in section 8;
8. make available the information needed to show compliance with Article 28, and allow and contribute to audits by you or an auditor you appoint, with reasonable notice, at most once a year unless there has been a breach.

5. Security

Measures include: encryption in transit (TLS) for all connections; OAuth refresh and access tokens encrypted at rest with AES-256-GCM and bound to your account ID; verification of HubSpot’s request signature on every request from the App’s card and pages, every webhook and every workflow action call; strict separation of data by HubSpot account ID; short-lived signed links for the history export and billing; only app admins can change settings and only named approvers can decide; logs without personal data beyond account and user IDs; access to the hosting account limited to Kayabyte.

6. Sub-processors

You give general authorisation to the sub-processors listed on the sub-processors page. We tell you about new sub-processors by updating that page at least 30 days before the change; you can object by email, and if we cannot resolve the objection, you can stop using the App and we refund any prepaid fees for the remaining period. We bind each sub-processor to data protection terms that are at least as protective as this DPA and remain responsible for them.

7. Transfers

Data is hosted by Cloudflare with the database in Europe. Where a sub-processor processes data outside the EEA, the transfer relies on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

8. Deletion and return

• When you disconnect the App in its settings, we delete tokens, policies, settings, approval requests, the history and cached lists immediately.
• When you uninstall the App in HubSpot, tokens are deleted when the uninstall reaches us (normally within an hour) and the remaining data within 30 days.
• Pro customers can export the approval history as CSV at any time before uninstalling. On request we delete your data sooner.
• Notes, tasks and the Approval status property the App wrote stay in your HubSpot account, under your control.
• Billing records that the law requires us to keep (invoices) are kept by Stripe and us for the period the law requires.

9. Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties. We also notify HubSpot within 24 hours of technical issues affecting the integration, as our HubSpot partner agreement requires.

10. Liability and precedence

Liability follows the terms of service. If this DPA and the terms conflict on personal data, this DPA prevails.

11. Contact

Data protection questions: support@kayabyte.dev.