Data Processing Addendum
Last Updated: 8/10/2026 | Version 2.0
This Data Processing Addendum ("DPA") forms part of the agreement between Kashu, Inc. ("Kashu") and a business customer ("Customer") and describes how each party handles personal data in connection with the Kashu services. Where this DPA conflicts with the underlying agreement as to the handling of personal data, this DPA controls.
1. Definitions
"Personal Data," "Controller," "Processor," "Processing," "Data Subject," and "Personal Data Breach" have the meanings given under applicable data-protection law. "Applicable Data Protection Law" means the privacy and data-protection laws applicable to the processing of Personal Data under the agreement.
2. Roles of the Parties
Kashu acts as an independent Controller, not as the Customer's Processor. Kashu determines the purposes and means of its own processing of Personal Data in connection with the services, including account provisioning, identity verification, Know Your Business and Know Your Customer checks, anti-money-laundering and sanctions screening, fraud and risk monitoring, transaction intelligence, service delivery and support, security, recordkeeping, and compliance with its own legal, regulatory, and partner-institution obligations. Kashu does not process Personal Data on the Customer's documented instructions and is not engaged by the Customer to do so.
The Customer is an independent Controller with respect to the Personal Data it holds and the purposes for which it uses the services. The parties are not joint Controllers, and neither party acts as the agent or Processor of the other. Each party independently determines its own lawful basis for processing.
Kashu's role reflects the nature of the services: Kashu is a software and program-administration provider operating on regulated payment and banking rails, and a substantial part of its processing is required of Kashu directly by law, by regulators, and by the licensed institutions that hold and move funds. That processing cannot be performed on another party's instructions.
3. Each Party's Responsibilities
Each party is responsible for its own compliance with Applicable Data Protection Law in respect of the Personal Data it processes, including establishing a lawful basis, providing any required notices to Data Subjects, and honoring Data Subject rights that apply to it. The Customer is responsible for ensuring it may lawfully provide Personal Data to Kashu for the purposes described in this DPA and in the Privacy Policy.
4. Purpose Limitation
Kashu processes Personal Data received in connection with the services only for the purposes described in Section 2, in Annex A, and in the Privacy Policy, and as otherwise required or permitted by law. Kashu does not sell Personal Data.
5. De-identified and Aggregated Data
Kashu may de-identify, anonymize, or aggregate Personal Data and may use and retain the resulting data, which is no longer Personal Data, to operate, secure, and improve the services, to produce industry analytics, and to support regulatory compliance, including after termination. Kashu will not attempt to re-identify such data except to test the effectiveness of its de-identification.
6. Confidentiality
Kashu ensures that persons authorized to process Personal Data are bound by appropriate confidentiality obligations.
7. Security Measures
Kashu implements and maintains appropriate technical and organizational measures designed to protect Personal Data against a Personal Data Breach, taking into account the state of the art, the costs of implementation, and the nature, scope, and purposes of processing.
8. Recipients and Service Providers
Kashu discloses Personal Data to the categories of recipients described in Annex B, including its licensed partners, service providers engaged by Kashu, and, where the services are accessed through a branded, co-branded, or white-labeled interface, the applicable Brand Partner. Service providers engaged by Kashu act on Kashu's instructions and are bound by data-protection obligations substantially similar to those in this DPA. Licensed partners and Brand Partners act as independent Controllers for their own purposes and under their own privacy notices. Kashu maintains a current list of the service providers it engages, available to the Customer on request.
9. Data Subject Requests
Each party handles the Data Subject requests directed to it. Where a request relates to processing carried out by the other party, the receiving party will refer the Data Subject to that party. Each party will provide the other with reasonable cooperation and information necessary to respond to a request, to the extent it is able to do so consistent with its own legal and regulatory obligations.
10. Personal Data Breach
Kashu will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data relating to the Customer, and will provide the information reasonably available to it to assist the Customer in meeting its own notification obligations. The Customer will notify Kashu of a Personal Data Breach affecting the services or the program account in accordance with the Software and Technology Services Agreement.
11. International Transfers
Where processing involves the transfer of Personal Data across borders, each party will put in place an appropriate transfer mechanism required by Applicable Data Protection Law for the transfers it makes.
12. Retention and Deletion
Kashu retains Personal Data for the periods described in the Privacy Policy and for as long as required to satisfy its legal, regulatory, recordkeeping, and partner-institution obligations, including obligations under the Bank Secrecy Act and applicable anti-money-laundering rules, and for the establishment, exercise, or defense of legal claims. Because Kashu is an independent Controller with its own retention obligations, it cannot return or delete Personal Data on the Customer's instruction where retention is required. Following the applicable retention period, Personal Data is securely deleted, destroyed, or de-identified. Data de-identified or aggregated under Section 5 may be retained.
13. Records and Cooperation
Kashu will make available to the Customer the information reasonably necessary to demonstrate its compliance with this DPA, subject to appropriate confidentiality and security conditions and reasonable notice. This DPA does not grant the Customer an audit right over Kashu's systems or premises.
14. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the underlying agreement.
Annex A: Details of Processing
Subject matter and duration: processing of Personal Data for the term of the agreement and for the retention periods described in Section 12. Nature and purposes: account provisioning, identity verification, KYB and KYC, AML and sanctions screening, fraud and risk monitoring, transaction administration and intelligence, support, security, recordkeeping, service improvement, and legal and regulatory compliance. Types of Personal Data: identifiers and contact details, business and ownership information, transaction and account data, and verification data. Categories of Data Subjects: the Customer's authorized individuals and representatives and, where applicable, the Customer's own customers.
Annex B: Recipients
Kashu discloses Personal Data to a limited set of recipients in the following categories: money-movement and custody partners; card processing and settlement providers; identity-verification providers; hosting, security, analytics, and communications providers; professional advisers; Brand Partners operating a branded, co-branded, or white-labeled interface through which the Customer accesses the services; and regulators, courts, and law-enforcement authorities where required. Kashu maintains a current list identifying the service providers it engages and their purpose, available to the Customer on request by contacting Kashu at the address below.
13. Contact Information
For questions or legal notices, you may contact us as follows:
Kashu, Inc.
Attn: Legal Department
1603 Capitol Ave, Ste 415 #674380
Cheyenne, WY 82001
Email: help@kashupay.com