Data processing agreement (dpa) — Kinsta

Cited by

Facts read from this source

• DPA exists Report an error

  “This Data Processing Addendum (“DPA”) is an addendum to the Terms of Service (“Terms”) or Master Services Agreement (“MSA”), as applicable, and is part of the Agreement.”

• DPA updated on Report an error

  “Updated on: September 23, 2026”

• DPA roles Report an error

  “Customer is the Controller or Business (or Processor or Service Provider, as applicable) and Kinsta is the Processor or Service Provider with respect to Customer Personal Data.”

• DPA scope laws Report an error

  ““European Data Protection Laws” means the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), as implemented and supplemented by the domestic legislation of each Member State, the UK Data Protection Act 2018 and the UK GDPR, and the Swiss Federal Act on Data Protection Act (FADP), and in each case, as amended, replaced, or superseded from time to time.”

• DPA breach notification Report an error

  “If Kinsta discovers a Personal Data Breach, Kinsta shall, without undue delay, provide written notice of the Personal Data Breach to the Customer.”

• Scc transfers Report an error

  “International Transfers are subject to MODULE TWO (controller to processor) or MODULE THREE (processor to processor) of the SCCs, as applicable. For International Transfers from Switzerland, the parties agree that all adaptations and amendments to the SCCs required by the Swiss Federal Data Protection and Information Commissioner are incorporated into the SCCs (the “Swiss Amendments”). For International Transfers from the United Kingdom, the parties agree to the UK Addendum.”

• List URL Report an error

  “Customer authorizes Kinsta to engage the Subprocessors listed at https://kinsta.com/legal/subprocessors/ (the “Subprocessor List”).”

• Change notice Report an error

  “Prior to adding or replacing any Subprocessors, Kinsta will provide written notice of such changes to the Customer. Customer’s failure to object in writing to a new Subprocessor within 14 days of Kinsta’s notification of the new Subprocessor shall constitute Customer’s authorization of the new Subprocessor.”

• Audit rights Report an error

  “Customer may conduct an audit, on its own behalf or on behalf of the relevant Controller, only if specific compliance concerns remain unaddressed after reviewing the Security Documentation. Any audit shall be (i) conditioned on reasonable advance written notice, not less than thirty (30) days, to Kinsta; (ii) conditioned on a written confidentiality and non-disclosure agreement and a detailed written audit plan reviewed and pre-approved by Kinsta; (iii) limited to once every twelve (12) month period; (iv) at Customer’s sole cost and expense;”

• Deletion or return Report an error

  “Upon proper termination of the Agreement and at the written direction of the Customer, Kinsta shall take reasonable measures to delete Customer Personal Data or return Customer Personal Data and copies thereof to the Customer, subject to applicable laws or other Kinsta obligations requiring the continued storage of the Customer Personal Data by Kinsta.”

• Security documentation Report an error

  “Customer may request and review Kinsta’s current information security governance documentation, available at https://trust.kinsta.com/ (“Security Documentation”).”

• Region selection Report an error

  “Customer may select the data center regions where its Customer Applications will be hosted.”

• Privacy contact Report an error

  “Contact name, position, and contact details: Kinsta Data Privacy team privacy@kinsta.com or by mail at address above”

• Supervisory authority Report an error

  “Identify the competent supervisory authority/ies in accordance with Clause 13 Ireland”

• DPA change rights Report an error

  “Kinsta may make changes to this DPA at any time in its sole discretion.”

• Trust center badges Report an error

  “Trust Center Privacy Policy Your Privacy Choices SOC 2 Type II ISO 27001 GDPR CCPA”

9 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Lead Scaling, migration & exit
• The Agency Lead European sovereignty
• The Freelance App Developer Scaling, migration & exit
• The Freelance App Developer European sovereignty
• The Data Protection Officer Security, backups & recovery
• The Data Protection Officer Scaling, migration & exit
• The Data Protection Officer European sovereignty
• The Shop Operator Scaling, migration & exit
• The Shop Operator European sovereignty
• The Skeptic Security, backups & recovery
• The Skeptic Scaling, migration & exit
• The Skeptic European sovereignty
• The Small-Business Owner Scaling, migration & exit
• The Small-Business Owner European sovereignty