Data Processing Agreement
Effective 30 July 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“Customer”) and Content Shifu Co., Ltd., 2529/163 Trok Nok Khet, Bangkok 10120, Thailand (“Kudokit”). It applies automatically whenever Kudokit processes personal data on your behalf. You do not need to sign or request it, and nothing here needs to be countersigned to take effect.
1. Roles
For testimonial content — everything a reviewer submits through a form you configure, and everything you import from another platform — you are the controller and Kudokit is your processor. You decide what to ask, whose review to publish and where it appears. Kudokit stores, processes and displays it on your instructions.
Kudokit is a separate and independent controller for its own account data: who signed up, their billing record and how they use the product. That processing is governed by the Privacy Policy, not by this DPA.
Where this DPA and the Terms of Service conflict on the handling of personal data, this DPA prevails.
2. What is processed
| Subject matter | Collecting, storing, moderating and publishing customer testimonials. |
| Duration | For as long as your account is open, plus the deletion windows in section 10. |
| Nature and purpose | Storage, transcoding of video, automated transcription, translation, AI-assisted quote extraction and ranking, and public display through the widgets and walls you publish. |
| Types of personal data | Name, email address, job title, employer, photograph or avatar, star rating, the written review, and — where a video or audio testimonial is recorded or uploaded — the reviewer’s image and voice and a machine transcript of it. Technical data collected to prevent abuse: IP address and a bot check. |
| Categories of data subject | Your customers and any other person you invite to leave a review. |
| Special category data | Not requested by Kudokit and not required by the service. A reviewer writes or records in their own words, so you must not solicit special category or sensitive data, and should moderate it out if it arrives unprompted. |
3. Your instructions
Kudokit processes testimonial personal data only on your documented instructions. Your use of the product is itself an instruction: configuring a form, approving a review, publishing a wall, enabling translation or an AI helper, or importing from a connected platform.
Kudokit will tell you if an instruction appears to breach the GDPR, the PDPA or another applicable data protection law, and may decline to act on it. Kudokit will not process testimonial personal data for its own purposes, and does not use it to train machine learning models.
4. Your obligations as controller
You are responsible for having a lawful basis to collect and publish every testimonial. In practice that means the reviewer’s consent, obtained before you publish their name, words and — where applicable — their face and voice, together with a route for them to withdraw it. You are also responsible for confirming that anything you import from another platform may lawfully be republished.
5. Confidentiality
Kudokit ensures that anyone authorised to process testimonial personal data is bound by an obligation of confidentiality and is granted access only to the extent their role requires.
6. Security
Kudokit maintains technical and organisational measures appropriate to the risk, including encryption of personal data in transit and at rest, hashing of passwords, isolation between customer workspaces enforced at the database layer as well as in the application, access control limited to staff who need it, and logging of administrative access.
7. Sub-processors
You give Kudokit general authorisation to engage sub-processors to deliver the service. Kudokit remains fully liable to you for their performance.
The categories of sub-processor currently engaged, what each handles and the country each operates from are listed in section 5 of the Privacy Policy. Kudokit will identify the specific providers behind those categories on request to hello@kudokit.co.
Kudokit will give you at least 30 days’ noticebefore adding or replacing a sub-processor that will process testimonial personal data. Notice is given by email to the account’s registered address. You may object on reasonable data protection grounds within that period. If the objection cannot be resolved, you may terminate the affected part of the service and receive a pro-rata refund of any prepaid fees for the unused remainder of the term, as your sole remedy.
8. Assisting you with data subject requests
The product gives you direct control over most requests: you can edit, unpublish, export and delete any testimonial yourself, at any time, without asking Kudokit. Where a request needs more than that, Kudokit will assist you within a reasonable period, taking into account the nature of the processing.
If a reviewer contacts Kudokit directly, Kudokit will not respond on your behalf beyond telling them to contact you, and will pass the request on.
9. Personal data breaches
Kudokit will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting testimonial personal data. The notification will describe what happened, the categories and approximate number of records involved so far as known, the likely consequences and the measures taken. Kudokit will assist you with your own notification duties — to a supervisory authority in the EEA or UK, to the Office of the Personal Data Protection Committee in Thailand, and to affected individuals.
10. Deletion and return
You can export testimonials to CSV at any time while your account is open. On termination, Kudokit deletes testimonial personal data: account deletion is scheduled 14 days ahead so an accidental or malicious request can be reversed, after which deletion is permanent. Video is deleted from the video platform along with the testimonial it belongs to. Backup copies age out on the normal backup schedule. Kudokit retains only what law requires it to keep, such as billing records.
11. Audit and information
Kudokit will make available the information reasonably necessary to demonstrate compliance with this DPA, and will respond to a reasonable security questionnaire no more than once a year. Where an on-site audit is genuinely required by a supervisory authority or by law, the parties will agree scope, timing and cost in advance, and it will be conducted so as not to disrupt the service for other customers.
12. International transfers
Kudokit’s primary database is in Singapore and several sub-processors operate in the United States and the EU. Where testimonial personal data is transferred out of the EEA, the UK or Thailand, Kudokit relies on the European Commission’s Standard Contractual Clauses or the equivalent safeguards the relevant provider offers, together with encryption in transit and at rest. The UK International Data Transfer Addendum applies to transfers from the United Kingdom. Transfers from Thailand are made on the bases permitted by sections 28 and 29 of the PDPA.
13. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this DPA limits any liability that cannot lawfully be limited, or affects a data subject’s rights against either party under applicable data protection law.
14. Term
This DPA takes effect when you first use Kudokit and continues for as long as Kudokit processes testimonial personal data on your behalf. Sections 5, 6, 9, 10, 12 and 13 survive termination to the extent processing continues or obligations remain outstanding.
15. Changes
Kudokit may update this DPA where a change in law or in the service requires it. For a change that materially reduces your rights, Kudokit will give at least 30 days’ notice by email or in the app.
See also our Privacy Policy and Terms of Service. Questions: hello@kudokit.co.