Parties and Roles
Customer: the organization or person using Klara for its own planning data.
Provider: Jasper Zimmerling, Leubnitzer Straße 28, 01069 Dresden, Germany.
This DPA becomes binding when the identified Customer and Klara agree to it in writing or electronically, including its dated TOMs and subprocessor disclosures. Publishing this document alone does not conclude a customer agreement. Contact jasper@zimmerl.ing to arrange acceptance and retain a copy of the agreed version.
For business customers, Customer acts as controller and Klara acts as processor for workspace content processed on Customer instructions.
Klara acts as an independent controller for its own account administration, service security, support, and separately requested mailing-list processing, as described in the Privacy Policy. These independent-controller purposes are outside Customer processing instructions.
For direct consumer accounts, Klara acts as controller for the consumer account and workspace data. This DPA applies to B2B customer processing unless a separate agreement states otherwise.
Subject Matter, Duration, and TOMs
Klara processes personal data to provide planning, task, calendar, goal, encryption, synchronization, optional Google Calendar and AI features, transactional email, feedback, export, and deletion functionality.
Processing continues for the account or subscription term and ends after deletion or return of data, subject to applicable legal obligations. Live-account deletion does not establish that all backup copies have been erased. Levo Studio reports no fixed deletion period for older backups; no maximum backup-erasure deadline can currently be confirmed. This operating limitation does not amend existing deletion duties or authorize indefinite retention.
The Technical and Organizational Measures published by Klara form part of this DPA.
Documented Processing Instructions
Customer instructs Klara to store user content and account data necessary to provide the service.
Customer instructs Klara to sync account and workspace data across authenticated devices.
Customer instructs Klara to support browser-side encryption and decryption workflows for the encrypted fields described in the Privacy Policy and TOMs.
Customer instructs Klara to provide self-service data export and deletion functions.
If Customer or an authorized user activates an optional integration, Customer instructs Klara to exchange the minimum feature data with Google Calendar, OpenAI, or Resend as described in the Privacy Policy and subprocessor section.
Klara processes personal data only on documented Customer instructions, including instructions about international transfers, unless Union or Member State law requires processing. Klara informs Customer of such legal requirement unless prohibited by law.
Klara immediately informs Customer if, in its opinion, an instruction infringes GDPR or other Union or Member State data-protection provisions. Klara pauses the affected processing while the instruction is clarified unless a legal obligation requires otherwise.
Categories of Data and Data Subjects
Data subjects include account users, people named in tasks or events, event attendees entered by users, and other individuals whose personal data is entered into Customer workspace content.
Personal data includes email address, identifiers, task/event/project content, calendar day highlight labels, week template content, notes, goals, timestamps, focus preferences, recurrence settings, relationship metadata, technical metadata, Google account and calendar data when connected, AI feature inputs and outputs, transactional email content, and user-submitted feedback or attachments.
Processor Obligations
Klara ensures that persons authorized to process personal data are bound by confidentiality obligations.
Klara implements the TOMs described in the Technical and Organizational Measures document.
Klara assists Customer, taking into account the nature of processing and available information, with data subject requests, security obligations, breach notification duties, data protection impact assessments, and prior consultation obligations.
Breach Notification
Klara notifies Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data.
The notification includes available information reasonably required for Customer to meet its GDPR breach notification obligations, including the nature of the breach, affected data categories, likely consequences, and measures taken or proposed.
Subprocessors
Levo Studio, operated by Julius Grimm, Europaplatz 2/1, 72072 Tübingen, Germany, processes data for Klara under a signed Article 28 GDPR agreement and provides deployment, Docker Swarm and Dokploy administration, server and PostgreSQL operation, backups, monitoring, maintenance, security support, and technical troubleshooting.
Levo Studio’s operating statement dated 19 October 2026 confirms four EU nodes: one Hetzner Online GmbH node in Falkenstein, Germany; one DataLix node in Frankfurt am Main, Germany; and two physically separate Wordbase / SkyLink Data Center servers in Eygelshoven, the Netherlands. Levo reports that all infrastructure servers, replicas, and backups remain in the EU, with the current additional backup copies held by Julius Grimm in Germany. The provider list is unchanged from the signed infrastructure agreement of 23 June 2026. The application runs as a containerized Next.js service with PostgreSQL. Vercel and hosted Supabase are not part of the current production runtime.
Optional or feature-specific providers are Google Ireland Limited / Google LLC for Google Calendar synchronization; OpenAI Ireland Ltd. and OpenAI affiliates for requested transcription and goal drafting; Plus Five Five, Inc. (Resend) for account-verification, password-reset, and mailing-list email.
By entering into this DPA, Customer gives general written authorization for the subprocessors identified in the agreed version. Klara gives at least 30 days notice of intended additions or replacements, allowing Customer to object on reasonable data-protection grounds before processing by the new provider begins.
Klara and Customer seek a reasonable alternative for a timely objection. If no compliant alternative can be agreed, Customer may terminate the affected service without penalty before the change takes effect. An optional provider is used only for the feature requested by Customer or its authorized user.
Klara imposes data protection obligations on subprocessors that are equivalent in substance to this DPA and remains responsible for subprocessor performance.
International Transfers
Where personal data is transferred outside the EU/EEA, Klara relies on an applicable transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, and supplementary measures where required.
Core hosting and database processing is documented in Germany and the Netherlands. Optional Google, OpenAI, and Resend processing can occur outside the EU/EEA. The relevant provider DPA, adequacy or Data Privacy Framework coverage, and/or EU Standard Contractual Clauses apply as documented by the provider.
Klara updates its subprocessor and transfer disclosures when a provider, purpose, or material processing location changes.
Return and Deletion
At the end of the processing services, Klara deletes or returns Customer personal data at Customer choice and deletes existing copies unless Union or Member State law requires storage. Self-service export and account deletion are available; Customer may contact Klara for assistance or a return format not available through self-service.
Customer can also choose deletion through the account deletion flow. Deletion removes the application account and associated app data from live systems, subject to the documented infrastructure-backup cycle, provider-specific deletion processes, and legal obligations.
Audit and Information
Klara provides information reasonably necessary to demonstrate compliance with this DPA, including TOMs, subprocessor information, and relevant security summaries.
Klara allows and contributes to audits, including inspections, by Customer or an auditor mandated by Customer. The parties coordinate reasonable notice, scope, confidentiality, and measures to protect other customers. These arrangements do not exclude mandatory audit rights or prevent urgent checks after a material incident or a supervisory-authority request.