Data Processing Addendum

These pages are provided for transparency and are a starting point only — they are not legal advice. Merchants remain responsible for their own store policies and for compliance with the laws that apply to them. Have a qualified lawyer review them before you rely on them.

Controller & processor

When a merchant collects personal data from its customers through a Kayroo store, the merchant is the data controller and Kayroo is the processor. Kayroo processes that data only to provide the Services and on the merchant's documented instructions, consistent with Law 18-07.

Merchant obligations

The merchant must have a lawful basis to collect customer data, provide its own privacy notice, respond to customer rights requests, and only instruct lawful processing.

Kayroo obligations

Kayroo keeps customer data confidential, applies appropriate security measures, uses only vetted sub-processors under equivalent obligations, assists the merchant with rights requests and security incidents within reason, and deletes or returns customer data on termination subject to legal retention.

Sub-processors & transfers

Kayroo may engage sub-processors (hosting, email, delivery, AI) bound by data-protection terms. Where processing occurs outside Algeria, safeguards consistent with Law 18-07 are applied.

Last updated: September 2026