KlervexKlervex
← Back to Home

Data Processing Agreement

Last updated: April 1, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Delivstat Technology Solutions ("Klervex", "we") and the customer ("you", "Controller") and governs the processing of personal data by Klervex as a Data Processor on your behalf.

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", and "Data Subject" have the meanings given in the EU General Data Protection Regulation (GDPR) 2016/679.

2. Scope of Processing

Klervex processes the following categories of personal data on your behalf:

  • Exporter and importer party details (names, addresses, contact information, tax identifiers)
  • Document content uploaded for AI extraction
  • Shipment metadata (references, routes, goods descriptions)
  • User account information (email, name)

Processing is performed solely for the purpose of providing the Klervex service: document extraction, validation, and generation.

3. Processor Obligations

  • Process personal data only on documented instructions from the Controller.
  • Ensure personnel authorized to process personal data are bound by confidentiality obligations.
  • Implement appropriate technical and organizational security measures.
  • Assist the Controller in responding to data subject requests.
  • Notify the Controller without undue delay of any personal data breach.
  • Delete or return all personal data upon termination of the service, at the Controller's choice.

4. Security Measures

  • Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
  • Row-level security (RLS) in the database ensuring tenant isolation
  • API key and JWT authentication for all access
  • Automated audit logging of all data access and modifications
  • Regular security reviews and vulnerability scanning

5. Sub-processors

Klervex uses approved sub-processors to deliver the service. A current list is maintained at klervex.com/subprocessors. We will notify you of any changes to sub-processors and provide an opportunity to object.

6. Data Retention

Uploaded documents and extraction results are retained for the duration needed to provide the service, typically 5 days for temporary processing data. Validation records and document hashes are retained permanently for verification purposes. Account data is retained until account deletion is requested.

7. International Transfers

Data may be processed in the United States and India where our infrastructure providers operate. All transfers are subject to appropriate safeguards including standard contractual clauses.

8. Contact

For DPA-related inquiries, contact privacy@klervex.com.