GDPR Compliance

1. Roles

For Recipient accounts, verification data and website data, Kudvi acts as data controller. Our payment provider and payout partners act as independent controllers for the processing they perform under their own regulatory obligations. Infrastructure and verification vendors act as our processors under written data processing agreements.

2. Legal bases

We process personal data on the bases of contract performance, compliance with legal obligations including identity verification and record keeping duties, and legitimate interests in fraud prevention and platform security. Consent is used only for optional features and can be withdrawn at any time.

3. Data protection principles

• Lawfulness, fairness and transparency: this policy suite explains every processing purpose in plain language.
• Purpose limitation and data minimisation: the tipping flow requires no account and stores no Tipper profile; we collect from Recipients only what verification and payouts require.
• Accuracy: Recipients can correct their details at any time.
• Storage limitation: retention periods are defined in the Privacy Policy and enforced by scheduled deletion.
• Integrity and confidentiality: measures are described on our Security page.
• Accountability: processing activities are recorded and data protection impact assessments are performed for new high risk processing.

4. Individual rights

Requests under articles 15 to 22, including access, rectification, erasure, portability, restriction and objection, can be sent to hello@kudvi.com and are answered within one month. Identity is verified before disclosure. Where a legal retention duty prevents erasure, we explain which records must be kept and until when.

5. International transfers

Transfers outside the UK and the EEA rely on adequacy regulations where available and otherwise on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with supplementary measures where needed.

6. Personal data breaches

We maintain an incident response procedure. Where a breach is likely to result in a risk to individuals, we notify the Information Commissioner's Office within 72 hours of becoming aware, and affected individuals without undue delay where the risk is high.

7. Supervisory authority

Our lead supervisory authority is the Information Commissioner's Office in the United Kingdom. EU residents may also contact the supervisory authority of their member state.