Data Processing Addendum

This Addendum forms part of the Terms of Service between you (the Controller) and Docket Ltd. (the Processor), and applies where Docket processes personal data on your behalf in providing the service.

Where Docket Ltd. determines the purposes and means of processing in its own right, for example your account details as our customer, it acts as a controller and the privacy policy applies instead.

References to data protection law mean the UK GDPR and the Data Protection Act 2018, and the EU GDPR where applicable.

Docket Ltd. will process personal data only on your documented instructions, which comprise this Addendum, the Terms, and the actions you take in the product. It will not process it for its own purposes, and will not sell it or share it for anybody else's marketing.

Docket does not train models on your data. Content is transmitted to model providers solely to fulfil a request you have made, and their commercial API terms exclude the use of that data for training.

Where the law requires processing beyond your instructions, you will be informed first unless the law prohibits telling you.

Personnel authorised to process personal data are bound by confidentiality obligations. Access is limited to those who need it to operate or support the service.

Technical and organisational measures are described on the security page, and include separation enforced at the database level rather than by application filtering, encryption of third-party credentials at rest, encryption in transit, read-only scopes on connected analytics accounts, and an activity log of operations.

That page also states plainly what does not exist, including SOC 2 and ISO 27001. Please read it before relying on this section.

You give general authorisation for the engagement of sub-processors. The current list is published at /sub-processors and is the authoritative version.

Before a new sub-processor begins processing, account holders are notified. You may object on reasonable data protection grounds; if no alternative can be found, you may terminate the affected service without penalty for the remainder of the term.

Each sub-processor is engaged under terms imposing obligations equivalent to those in this Addendum, and Docket Ltd. remains liable for their performance.

Sub-processors may process data outside the UK and the EEA. Where they do, transfers are made under an approved mechanism, being the UK International Data Transfer Addendum or the EU Standard Contractual Clauses as applicable, together with any supplementary measures required.

[Confirm the primary hosting region and the transfer mechanism for each sub-processor before this document is relied upon.]

Taking into account the nature of the processing, Docket Ltd. will:

• Assist you in responding to requests from data subjects exercising their rights. Most such requests can be satisfied by you directly, since the data is visible and editable in the product.
• Assist with data protection impact assessments and with prior consultation with a supervisory authority, where required.
• Notify you without undue delay on becoming aware of a personal data breach affecting your data, with the information available at the time and updates as investigation proceeds.

You can delete data at any time in the product. Deleting a website removes its profile, topics, drafts, connections and generated images. Deleting your account removes your account data.

On termination, personal data is deleted within [insert period, typically 30 days], except where retention is required by law. Backups age out on their normal cycle and are not retained indefinitely.

Articles already published to your own WordPress site are on your infrastructure and are unaffected by anything that happens here.

Docket Ltd. will make available the information reasonably necessary to demonstrate compliance with this Addendum, and will contribute to audits conducted by you or an auditor you appoint, on reasonable notice, no more than once a year unless required by a supervisory authority, and subject to confidentiality.

This Addendum applies automatically to your use of Docket. If your organisation requires a countersigned copy, or needs it executed on your own paper, write to support@docket.ltd and we will arrange it.