GDPR

This page is for the person at your company who has to sign off on new software. It sets out what KaBoon does with personal data, where that data lives, who else touches it, and how we handle access and deletion requests, without requiring you to read the full Privacy Policy first.

If your company has anyone in the European Economic Area using KaBoon, the GDPR applies to you as their employer. This page is written to help you meet that obligation rather than to explain the regulation to you.

Who does what

Getting this right determines who is answerable for what, so it is worth being precise.

For everything in the first row, you decidewhy recognition is collected and on what legal basis, and we process it on your instructions. We do not use your members' data for our own purposes, do not sell or share it, and do not train machine learning models on it.

What we collect about your members

• Name and display name, email address, and profile picture, all from Slack.
• Slack user and team identifiers.
• Recognition activity: the award, any note attached, the value tagged, who gave and received it, the channel, and the timestamp.
• Team and season membership, role, and account status.
• Point balances, reward claims, and fulfilment records.

We do not read your Slack messages. Only interactions addressed to the KaBoon app are received. General channel conversation never reaches us.

Recognition notes are free text, so please make sure your people know not to put special category data (health, beliefs, and the other Article 9 categories) into them. KaBoon is not designed to receive that data and applies no additional Article 9 safeguards.

Where your data is stored

KaBoon is operated from the Netherlands by Tales For Two. Our hosting providers process data in the United States.

Transfers out of the EEA rely on appropriate safeguards under Chapter V of the GDPR, including Standard Contractual Clauses. We have data processing agreements in place with every provider listed below.

Who else touches your data

Our subprocessors, and what each one actually receives:

We will give you at least 30 days' notice before adding or replacing a subprocessor, and you may object on reasonable data protection grounds.

How we protect it

• Encryption. TLS in transit with HSTS enforced across all hosts, and encryption at rest.
• Authentication. Sign-in is delegated to Slack, so your own Slack access policies apply and we never handle passwords. Session cookies are HttpOnly and same-site.
• Workspace separation. Every query is scoped to a single workspace, the database rejects direct client access outright, and an automated check in our build fails any new query written without workspace scoping.
• Access revocation. Deactivating or removing someone takes effect on their next request, not when their session happens to expire.
• Credentials. Your Slack token is held in an encrypted vault, never in application tables, and is destroyed when you disconnect KaBoon.
• Audit trail. Sign-ins, changes to who is an admin, member additions and removals, reward transactions, and every data export or deletion are recorded in an append-only log that cannot be edited or deleted. Kept for 12 months.
• Application hardening. CSRF protection on state-changing requests, rate limiting, signature verification on inbound webhooks, and a security test suite that runs on every change.

Access, export, and deletion

Your admins can act directly. Removing a member from your workspace deletes their records immediately, without contacting us.

For anything broader, email us at support@kaboon.io. We action requests within 30 days and usually much sooner.

• Access and portability. We send one JSON file containing every record we hold for your workspace: members, recognition history, values, teams, seasons, rewards, and billing. It is structured and machine-readable, so you can load it into another system rather than only read it.
• Erasure. We irreversibly delete every member record, all recognition, teams, seasons, rewards, and uploaded images.

If one of your employees contacts us directly, we will not act on their data without your instruction. We will refer them to you and let you know they got in touch.

How long we keep it

• Workspace data is kept while you are a customer. If you remove KaBoon from Slack we disconnect immediately and revoke our access token, but retain your history so a reinstall does not lose it. Ask us to erase it and we will.
• Invoices are kept for seven years. Dutch tax law requires it, and Article 17(3)(b) means the right to erasure does not reach them. They hold billing details, not recognition content.
• Security logs are kept for 12 months and survive an erasure request, because a record of who deleted data is worthless if the person who acted can remove it.

If something goes wrong

We will notify you without undue delay if a breach affects your data, so you have time to meet your own 72-hour obligation under Article 33. We will tell you what happened, which categories of data and roughly how many people were affected, the likely consequences, and what we have done about it.

Data processing agreement

If your compliance process requires a written processor agreement under Article 28, contact us at support@kaboon.io and we will work through it with you.

Certifications

KaBoon does not currently hold SOC 2 or ISO 27001. We would rather say so than imply otherwise. Our infrastructure providers hold their own certifications, but that covers their platforms rather than our application.

If a certification is a requirement for your organisation, tell us. It is a question of timing rather than intent, and knowing there is demand changes when we start.

Complaints

You can complain to a supervisory authority at any time. Because Tales For Two is established in the Netherlands, ours is the Autoriteit Persoonsgegevens. If you are elsewhere in the EEA you may go to the authority where you live or work. We would appreciate the chance to sort it out first.

Contact

Tales For Two, trading as KaBoon
Joan Melchior Kemperstraat 62-2
1051 TT Amsterdam, Netherlands
KVK 99322021 · VAT NL005378832B84
support@kaboon.io

For the complete picture, see our Privacy Policy and Terms of Service.