Data Processing Addendum

This data processing addendum (the “DPA”) forms part of the terms of service (the “agreement”) between Cyberdune Technologies Private Limited, trading as Docket (“Docket”, the processor), and the customer (the controller). It applies whenever Docket processes personal data on the customer’s behalf in providing the service, and it takes effect when the customer accepts the agreement.

Data protection law means the UK GDPR and the Data Protection Act 2018, the EU General Data Protection Regulation (EU) 2016/679 (the “GDPR”), and any other data protection law that applies to the processing. Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given in the GDPR. Other terms have the meanings in the terms of service.

This DPA does not cover personal data that Docket processes as a controller, such as account details, enquiries and service security records. That is covered by the privacy policy.

The customer is responsible for having a lawful basis for the personal data it puts into or asks Docket to process, for giving data subjects any required information, and for making sure its instructions comply with data protection law. The customer is responsible for the content it publishes through the service.

Docket will process personal data only on the customer’s documented instructions. The agreement, this DPA and the customer’s use and configuration of the service (for example, adding a website, uploading to the Vault, connecting Google or pressing Publish) are the customer’s complete instructions. Other instructions must be agreed in writing.

Docket will not sell the personal data, use it for its own purposes, or use it to train AI models. If Docket is required by law to process personal data in another way, it will tell the customer first, unless the law prohibits this. Docket will tell the customer if it believes an instruction infringes data protection law.

Docket will make sure that the people it authorises to process the personal data are bound by a duty of confidentiality, and that access is limited to those who need it to provide, secure or support the service.

Docket will implement appropriate technical and organisational measures to protect the personal data, as required by Article 32 of the GDPR. The current measures are described on the security page, which forms part of this DPA. They include:

• separation of each workspace’s data, enforced at the data layer and tested automatically;
• encryption of WordPress application passwords and Google tokens at rest with AES-256, and no browser access to them;
• encryption in transit over HTTPS;
• read-only permissions for Google Search Console and Google Analytics;
• server-only use of privileged keys and service credentials; and
• an activity log of AI operations, publishing and connection changes.

Docket may update these measures, but will not reduce the overall level of protection. The security page also describes Docket’s certification status.

The customer gives Docket general authorisation to engage sub-processors. The categories of sub-processor are published on the sub-processor list, and Docket will give the customer the name, location and transfer safeguards of each sub-processor on request.

Docket will tell the customer, by email to the account owner or in the product, at least sub-processor notice periodTBC (to be confirmed) before a new sub-processor starts processing personal data. The customer may object on reasonable data protection grounds within that period. If Docket cannot reasonably address the objection, the customer may end the affected part of the service and will not be charged for it after that date.

Docket will impose data protection obligations on each sub-processor that give at least the same level of protection as this DPA, and remains responsible to the customer for its sub-processors’ performance.

When the customer connects its own Google account or WordPress site, those providers act under the customer’s own agreements with them. They are not Docket’s sub-processors.

Data subject requests. Taking into account the nature of the processing, Docket will help the customer respond to requests from data subjects exercising their rights. Much of this can be done in the product (editing or deleting content, deleting a website, disconnecting a connection). If Docket receives a request directly, it will pass it to the customer and will not respond itself unless the customer asks it to.

Other assistance. Docket will give reasonable help, using the information available to it, with the customer’s security obligations, data protection impact assessments and consultations with supervisory authorities.

Docket will notify the customer without undue delay, and in any event within breach notice periodTBC (to be confirmed), after becoming aware of a personal data breach affecting the customer’s personal data.

The notice will describe, as far as is known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where information is not yet available, Docket will provide it in stages as it becomes available. Docket will take reasonable steps to contain the breach and reduce its effects, and will help the customer meet its own notification duties. A notice is not an admission of fault.

When the agreement ends, Docket will, at the customer’s choice, return the personal data (on request made before the end of the agreement) or delete it, within deletion periodTBC (to be confirmed) of the end of the agreement. Copies in backups are overwritten within backup retention periodTBC (to be confirmed) and remain protected by this DPA until then. Docket may keep personal data where the law requires it, and will keep it confidential and process it only for that purpose. During the agreement, the customer can delete websites and content itself.

Docket will make available to the customer the information reasonably needed to show that it meets Article 28 of the GDPR, including by answering security questionnaires.

If that information is not enough, or a supervisory authority requires it, the customer may carry out an audit, itself or through an independent auditor bound by confidentiality, on at least 30 days’ written notice, during normal business hours, no more than once in any 12-month period (except after a personal data breach), and in a way that does not disrupt the service or expose other customers’ data. Each party bears its own costs. Docket does not currently hold SOC 2 or ISO 27001 certifications.

Docket’s database and file storage are hosted in hosting regionTBC (to be confirmed). Some sub-processors process personal data in other countries, including the United States; locations are shown on the sub-processor list.

Docket will transfer personal data out of the UK or the European Economic Area only where the transfer complies with data protection law, for example to a country covered by an adequacy decision (or, for the United States, to a provider certified under the EU-US Data Privacy Framework and its UK extension), or under the European Commission’s Standard Contractual Clauses (Module 2 or Module 3 as applicable) and the UK International Data Transfer Addendum. The mechanism used for each sub-processor is transfer mechanismsTBC (to be confirmed).

Where the Standard Contractual Clauses apply between the customer and Docket, they are incorporated by reference, with the information in section 2 as their annexes, the security page as the description of technical and organisational measures, and the law and courts of the EU member state in which the customer (the data exporter) is established, as the clauses allow. The rest of this addendum follows the governing law and courts of the agreement.

Each party’s liability under this DPA is subject to the limits in the terms of service, except where data protection law does not allow this. If this DPA conflicts with the terms of service, this DPA wins for matters of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the clauses win.

Requests under this DPA, including for a signed copy: support@docket.ltd.