‹ Kaizen Grow

Data Processing Addendum

Version 1.1 · October 22, 2026

Kaizen is built for individuals. If a business (for example a coach, school or employer) uses Kaizen in a way that makes us process personal data on its behalf, this addendum applies on request. Email hello@kaizengrow.app with your organization’s name and we will send a countersigned copy.

Terms

  1. Roles. The business is the controller and Kaizen is the processor of personal data the business provides (“Customer Data”).
  2. Instructions. We process Customer Data only to provide Kaizen and on the business’s documented instructions, unless the law requires otherwise (and then we tell the business first where allowed).
  3. Confidentiality. Anyone we authorize to process Customer Data is bound to keep it confidential.
  4. Security. We keep appropriate technical and organizational measures: access limited to what is needed, providers with recognized security programs, and data minimization (the iPhone app keeps users’ data on their own devices and does not send it to us).
  5. Subprocessors. The business authorizes the providers on our Subprocessors page. We give at least 30 days’ notice of a new one, and the business may object on reasonable grounds. We bind each one to data-protection terms at least as protective as these.
  6. Help with requests. We help the business answer people exercising their data rights, and with security, breach notices and impact assessments where relevant to our processing.
  7. Breaches. We notify the business without undue delay, and within 72 hours where possible, after becoming aware of a personal-data breach affecting Customer Data.
  8. Deletion. When the service ends, we delete or return Customer Data at the business’s choice, unless the law requires us to keep it.
  9. Audits. We make available the information reasonably needed to show compliance with this addendum.
  10. Transfers. Where Customer Data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 or 3 as applicable, with the UK Addendum where relevant) are incorporated by reference.
  11. Precedence. If this addendum conflicts with our Terms of Service about Customer Data, this addendum wins.

Kaizen does not hold SOC 2, ISO 27001 or similar certifications.