Klaviyo procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Partner DPA - This DPA describes the obligations Klaviyo and its Partners have as “controllers” of customer personal data.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ 7.4. Customer Personal Data. Klaviyo shall collect, use, disclose and otherwise process Customer Personal Data (as defined in the [Data Processing Agreement](https://www.klaviyo.com/legal/data-processing-agreement)), and safeguard the privacy, confidentiality and security of Customer Personal Data in accordance with the requirements set forth in the [Data Processing Agreement](https://www.klaviyo.com/legal/data-processing-agreement), which is hereby incorporated into this Agreement by reference. The [Data Processing Agreement](https://www.klaviyo.com/legal/data-processing-agreement) does not apply to Account Information.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Data Processing Agreement - The DPA describes how Klaviyo processes personal data sent by customers through the platform and in connection with providing the services.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Klaviyo is a global company headquartered in Boston, Massachusetts with offices in the US, UK and Australia. The Klaviyo platform and customer data are hosted in AWS data centers located in the US. Klaviyo also uses Sub-processors to assist in providing its services to customers. Information on Sub-processors’ processing locations are described in https://www.klaviyo.com/legal/subprocessors .” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Additionally, Klaviyo may collect and review Communications Content for other development, diagnostic and corrective purposes. 7.4. Customer Personal Data. Klaviyo shall collect, use, disclose and otherwise process Customer Personal Data (as defined in the Data Processing Agreement ), and safeguard the privacy, confidentiality and security of Customer Personal Data in accordance with the requirements set forth in the Data Processing Agreement , which is hereby incorporated into this Agreement by reference. The Data Processing Agreement does not apply to Account Information. 7.5. Customer Account Information. Klaviyo’s use of Account Information shall be in accordance with the Privacy Notice, and Customer consents to such usage. “Account Information” means information about Customer that Customer provides to Klaviyo in the creation or administration of its Klaviyo account. For example, Account Information includes names, usernames, login credentials, phone numbers, email addresses and billing information associated with a Klaviyo account. 7.6. Customer Responsibilities for Data and Security. Customer and its Authorized Users shall have access to the Customer Data and shall be responsible for all changes to and/or deletions of Customer Data and the security of all passwords and other account information required in order to access and use the Services. Customer shall have the ability to retrieve or export Customer Data out of the Services using the self-service tools Klaviyo makes available to the Customer. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 7.6. Customer Responsibilities for Data and Security. Customer and its Authorized Users shall have access to the Customer Data and shall be responsible for all changes to and/or deletions of Customer Data and the security of all passwords and other account information required in order to access and use the Services. Customer shall have the ability to retrieve or export Customer Data out of the Services using the self-service tools Klaviyo makes available to the Customer. Customer is encouraged to make its own back-ups of the Customer Data. Customer shall have the sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all Customer Data and the means by which Customer acquired Customer Data, and for the adequate security, protection and backup of Customer’s Data.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 13.3. Effect of Termination. Upon termination or expiration of this Agreement for any reason: (a) all rights and obligations of both parties, including all licenses granted hereunder, shall immediately terminate (except that all payment obligations accrued prior to termination or expiration shall survive); and (b) each party shall comply with the obligations to return or destroy all Confidential Information of the other party, as set forth in Section 11.2. Additionally, Klaviyo shall have no obligation to retain any Customer Data after any termination or expiration of this Agreement and may delete all Customer Data, unless required by applicable law. All liabilities accrued under this Agreement prior to the effective date of termination and the following Sections will survive expiration or termination of this Agreement for any reason: 1 (Definitions), 2 (Modification of the Agreement), 4.3 (Suspension, Limitation and Termination of Access), 5 (Intellectual Property), 6 (Fees and Expenses; Payments), 8 (AI Features), 9.4 (Disclaimer), 10 (Limitation of Liability), 11 (Confidentiality), 12 (Indemnification), 13.3 (Effect of Termination) and 14 (Miscellaneous).” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Further, some Non-Klaviyo Services may require Customer or Klaviyo to provide certain Customer Data that Klaviyo is processing on Customer’s behalf back to the Provider. In these cases, Klaviyo considers Customer’s request to integrate with the Non-Klaviyo Services as instruction to provide this data to the Provider according to the Provider’s terms and conditions. If Customer does not want this data to be provided to the Provider, Customer will immediately request the suspension of the integration with the respective Provider.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Business Partner Code of Conduct - Klaviyo requires all of our business partners to comply with our code of conduct because we expect our partners to uphold the highest standards of conduct and to be aligned with our values.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.