Data Processing Agreement

This Data Processing Agreement ("DPA") is between [Company legal name], trading as Docutize, a company registered in [country] (company number [number]), registered office [address] ("Docutize", "we", "us"), and the business that holds a Docutize organisation - the legal entity named when the Terms of Service were accepted, as updated in Settings → Company ("you").

• It forms part of the Terms of Service and is accepted with them when an organisation is created, or when an owner or admin accepts a new version. The version accepted is recorded.
• It applies whenever we process personal data on your behalf in providing the service, from the time your organisation is created until that data is deleted.
• Words defined in the Terms have the same meaning here. If you've signed a separate data processing agreement with us, that one applies instead.

• Data protection law - the UK GDPR and the Data Protection Act 2018; the EU GDPR (Regulation (EU) 2016/679) and the laws of EU and EEA member states supplementing it, where they apply to the processing; each as amended or replaced.
• Customer personal data - personal data we process on your behalf in providing the service, as described in Annex 1.
• Subprocessor - another processor we engage to process customer personal data.
• Personal data breach - a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, customer personal data processed by us or our subprocessors.
• Supervisory authority - the UK Information Commissioner's Office, or another authority responsible for data protection law that has jurisdiction.
• Controller, processor, data subject, personal data, processing and data protection impact assessment have the meanings they have in data protection law.

• For customer personal data, you're the controller and we're your processor. If you act as a processor for another controller (for example, a brand you run a help center for), we're your subprocessor: you confirm that controller has authorised our appointment, our subprocessors and this DPA, you pass its instructions to us, and we deal only with you.
• This DPA doesn't cover personal data we process for our own purposes as a controller - team members' accounts and security records, billing and company details, records of accepting the Terms, enquiries and our website. Our Privacy Policy covers those.
• Annex 1 describes the processing: its subject matter, duration, nature and purpose, and the types of personal data and data subjects.

You're responsible for:

• your compliance with data protection law as controller, including having a lawful basis for all customer personal data and for each feature and setting you use (signals, for example, are on by default);
• giving your end users the information data protection law requires, in a privacy notice (see The help-center privacy notice), and getting any consent it requires;
• making sure your instructions to us are lawful, and that we can lawfully process the data you give us;
• the accuracy and quality of customer personal data, and how you acquired it (orders you import, for example);
• not giving us special category data, criminal offence data, children's data, payment card numbers or government ID numbers unless it's necessary and lawful and you've put the required safeguards in place;
• answering data subjects' requests, using the tools the service provides (see Data subjects' requests);
• the security of your own systems and choices: who you give access to and with what role, keeping sign-in details safe, which documents you make Public, and removing people who leave;
• any processing you do outside the service, including by services you connect to it (such as your shipping provider), which are yours, under your own agreements with them.

• We process customer personal data only on your documented instructions, including about international transfers. Your instructions are: the Terms and this DPA; the settings you choose; and your team's and your end users' use of the service's features. Together these are your complete instructions.
• We may process customer personal data otherwise only where UK law, or EU or member state law that applies to us, requires it. We'll tell you before we do, unless that law forbids it on important grounds of public interest.
• We'll tell you straight away if, in our opinion, an instruction infringes data protection law. We aren't obliged to check whether your instructions are lawful, and may decline or suspend an instruction we reasonably believe is unlawful.
• Further instructions outside what the service does need our agreement in writing, and we may charge for them.
• We don't sell customer personal data, use it for advertising, or use it to train AI models. We use it for our own purposes only as far as needed to bill, secure and maintain the service and to produce aggregated or de-identified usage data (as the Terms describe), and as the law requires.

• Everyone we authorise to process customer personal data is bound by a duty of confidentiality, by contract or by law.
• Our staff access customer personal data only as needed to provide the service, give support you ask for, keep the service secure, fix problems, or meet a legal obligation.

• We keep appropriate technical and organisational measures in place to protect customer personal data, as Article 32 of the UK GDPR and EU GDPR requires, taking into account the state of the art, the costs, the nature, scope, context and purposes of the processing, and the risks to people. They're described in Annex 2.
• We may change these measures as technology and risks change, as long as we don't materially reduce the overall level of protection.
• You're responsible for deciding that these measures are appropriate for the data you choose to put into the service, and for the security choices that are yours (see Your obligations as controller).

• You give us general written authorisation to engage subprocessors. The subprocessors we use now are listed in Annex 3, and you authorise them.
• We'll tell you at least [30] days before adding or replacing a subprocessor, by email to your owners and admins or in the dashboard, and update Annex 3. If we have to replace one urgently - for security, or because it stops providing its service - we'll tell you as soon as we reasonably can.
• You can object to a new subprocessor on reasonable data protection grounds, in writing to hello@docutize.io, within that notice period. We'll discuss your concerns in good faith. If we can't resolve them within a reasonable time, you can end the affected service - in practice, by switching off the feature concerned where that's possible, or by deleting your organisation - and we'll refund fees prepaid for the unused period. That's your only remedy for an objection. If you don't object within the notice period, you're treated as authorising the subprocessor.
• We put data protection obligations on each subprocessor, by written contract, that give at least the protection Article 28(3) requires - in practice, through each provider's data processing terms. We stay responsible to you for each subprocessor's performance of those obligations.

• Our database and file storage run in the United States (Amazon Web Services us-east-1, through Supabase), and so does our application (through Vercel) - though requests also pass through Vercel's global edge network, so some of that processing happens in other locations. Our other subprocessors process data in the United States - though Cloudflare's bot checks run across its global network - and Supabase processes its service logs in the EU (see Annex 3). So customer personal data is transferred from the UK and the European Economic Area to the United States, and elsewhere. You instruct and authorise these transfers.

We protect them as follows. Each subprocessor's data processing agreement is part of its terms, which we've accepted, and you can ask us at hello@docutize.io for a copy of the relevant terms, with commercial details removed.

• Transfers of customer personal data from the EEA to us in the United Kingdom rely on the European Commission's adequacy decision for the United Kingdom [confirm the adequacy decision is in force, or add the EU Standard Contractual Clauses].
• If a transfer mechanism we rely on stops being valid, we'll work with you to put a lawful alternative in place, and you agree to sign what that reasonably requires.

• We help you answer requests from data subjects exercising their rights, taking into account the nature of the processing - mainly through tools in the service. Your team can export a customer's data (JSON), correct their details or email, delete their account, see and act on deletion requests they make from My account, switch signals off, and delete AI chat conversations. End users can update their own details and delete their saved chats from My account.
• If a data subject contacts us directly about customer personal data, we'll pass the request to you without undue delay and won't answer it ourselves, other than to say we've passed it on, unless you ask us to or the law requires.
• If you need help beyond the tools, we'll give reasonable help. We may charge our reasonable costs for it, unless the request arises from our breach of this DPA.

• Taking into account the nature of the processing and the information available to us, we'll give you reasonable help with your obligations under Articles 32 to 36 of the UK GDPR and EU GDPR: security, personal data breaches, data protection impact assessments (for example, for AI chat or signals) and prior consultation with a supervisory authority. Most of what you need is in this DPA and its annexes.
• We keep the records of processing that Article 30(2) requires of a processor, and cooperate with supervisory authorities when they ask.
• We may charge our reasonable costs for help beyond the information in this DPA.

• We'll tell you without undue delay after becoming aware of a personal data breach, and aim to do so within [48] hours, by email to your owners and admins.
• As the information becomes available - in phases if needed - we'll tell you what Article 33(3) requires: the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; a contact for more information; its likely consequences; and the measures taken or proposed to deal with it and reduce its possible adverse effects.
• We'll take reasonable steps to contain and investigate the breach, and to reduce its harm, and give you reasonable help with your own obligations.
• You decide whether to notify supervisory authorities and data subjects about customer personal data, and do so yourself. We won't notify them on your behalf unless you ask us to or the law requires.
• Telling you about a breach isn't an admission of fault or liability. Unsuccessful attempts or activity that don't compromise customer personal data - such as blocked sign-in attempts, port scans or denial of service attacks - aren't personal data breaches.

• Returning your data: before the end, export what you need - download your documents, export claims and your customer list as CSV, and export any customer's data as JSON. There's no single export of everything.
• Deleting it: when you delete your organisation, or we delete it because a trial or plan has ended (30 days after a trial, or 90 days after a paid plan, with emails before, as the Terms set out), we delete customer personal data from the live service, empty its file storage and delete your end users' logins. If the agreement ends some other way, we delete it within [30] days. You choose deletion, rather than return, by deleting your organisation or letting it be deleted.
• Backups: copies in our database provider's backups are deleted as the backups expire, within [backup retention period - depends on the Supabase plan (Pro keeps daily backups 7 days, Team 14)]. Until then they stay protected by this DPA and are used only to restore the service after a failure; if a restore brings deleted data back, we delete it again.
• We keep customer personal data after the end only where UK law, or EU or member state law that applies to us, requires it, and protect it under this DPA while we do.
• If you ask, we'll confirm in writing that deletion has happened.

• We'll make available the information you reasonably need to show that the obligations in Article 28 are met, and allow and contribute to audits, including inspections, by you or an independent auditor you appoint, as this section sets out.
• Information first. We'll first answer your audit request with written information: this DPA and its annexes, answers to reasonable security questionnaires, and our subprocessors' own security reports and certifications where they make them available. You agree to rely on these where they reasonably answer your questions.
• Inspections. If that information isn't enough to show compliance, or a supervisory authority requires it, you may carry out an inspection - remotely where that's practical - on at least [30] days' written notice, no more than [once in any 12 months] unless there's been a personal data breach affecting your data or a supervisory authority requires it. We'll agree its scope, timing and duration in advance; it takes place during business hours and without unreasonably disrupting our business.
• Confidentiality. You and any auditor must keep everything learned confidential. An auditor must not be our competitor and must sign a confidentiality agreement with us first.
• Limits. No audit may access other customers' data, information that would put the security of the service at risk, or information we're bound to keep confidential. We can't give access to our subprocessors' premises or systems; their own audit reports stand in for that.
• Costs. You pay for audits, including our reasonable costs of supporting them [e.g. at a stated daily rate], unless an audit shows that we've materially breached this DPA, in which case we bear our own costs. We'll fix any material breach an audit finds.

• Unless you link your own notice, we generate a privacy notice for your help center at your-brand.docutize.io/privacy, from your settings and company details (see the Terms' Help-center privacy notice).
• It's a tool to help you meet your transparency obligations as controller (Articles 13 and 14). It's your notice, and you remain responsible for transparency to your end users: for the notice's accuracy, completeness and lawful bases, for its meeting the law everywhere you operate, and for covering any processing outside the service. Review it before relying on it.
• As your processor, we aren't responsible for its content. Providing it isn't legal advice and isn't an instruction from us about how you should process personal data.
• We may update the template, and will tell you about material changes. If you link your own notice instead, make sure it tells your end users about our processing and our subprocessors where the law requires.

This DPA is written for the UK GDPR and EU GDPR. If other privacy laws apply to your processing, you're responsible for deciding whether the service and this DPA meet them, and for telling us about any extra terms you need, which we'll consider in good faith. [decide whether to add US state privacy law (e.g. CCPA) service-provider terms for US customers]

• Each party's liability arising out of or in connection with this DPA is subject to the limitation of liability in the Terms (Limitation of liability), and counts towards the same overall limit - this DPA doesn't create a separate one.
• Your indemnity in the Terms covers claims arising from your compliance as controller and from the help-center privacy notice (Indemnities).
• Nothing in this DPA limits either party's liability to data subjects or supervisory authorities where data protection law doesn't allow it to be limited. If either party pays compensation to a data subject for damage the other party caused, it may claim back the share that corresponds to the other party's responsibility, subject to the Terms' limits.

• This DPA lasts as long as we process customer personal data, and its obligations continue for as long as we hold any of it, including in backups.
• We may update this DPA as the Terms' Changes to these terms describe: owners and admins must accept a material change before using the dashboard again. We may also make changes that data protection law, a supervisory authority or a court requires.

On anything about personal data, this DPA takes precedence over the Terms. Otherwise the Terms apply, including their general terms, governing law and jurisdiction. A separate agreement signed by both of us takes precedence over both.

The technical and organisational measures in place at the date of this DPA:

Separation between customers

• Row-level security in the database on every table holding customer data. Team members' access is checked against their membership of the organisation; end users can reach only their own data.
• Privileged (service-role) database access happens only on our servers - never in a browser - after an explicit membership or ownership check, and always filtered to one organisation.
• AI features answer only from the organisation's own documents (on a help center, only its Public documents). They can't reach other organisations' data or the web.
• The database ties each chat photo and video to the end user who sent it, in their own organisation, and lets it join only their own message in their own conversation.

Access and accounts

• Role-based team access (owner, admin, member). Billing, company details, branding, team management and deleting the organisation are limited to owners and admins; only owners can make or change owners.
• End users have their own sign-in session, separate from team sign-in.
• Two-step sign-in with an authenticator app for team members, which an organisation can require of everyone; while it's on, the database refuses that account's data to a session that hasn't completed it.
• Bot checks (Cloudflare Turnstile) on sign-in, sign-up, password reset and contact forms.
• Passwords are stored hashed by our sign-in provider. Changing a password needs the current one; changing an email needs confirmation from both the old and the new inbox, through single-use links that expire after 24 hours; we email the account holder about these changes.

Encryption and files

• Data is encrypted in transit (HTTPS) and, by our database provider, at rest.
• Files are kept in private storage and opened only through short-lived signed links (1 to 5 minutes; an hour for images in guide comments, which anyone who can open the guide sees).
• Uploads are checked for their real type (from the file's contents) and size before they're kept; unfinished uploads are deleted after 24 hours. Uploads aren't virus-scanned.
• Only signed-in end users can send photos and videos in the help center's chat, and only they and your team can see them. Chat photos, and images in guide comments, are decoded and made again on our servers, with all their metadata (including location) dropped, and the originals deleted. Videos are never decoded on our servers: the location and device metadata phones record is removed in the browser before upload, and the server refuses a video that still has it and checks its structure. Sizes, pixels and lengths are limited.
• Web pages added by link are fetched with protections against reaching internal addresses, and with size and time limits.
• The warranty and customer-list CSV exports neutralise spreadsheet formulas.

Minimising data

• Rate limits on help centers use a one-way hash of the visitor's IP address combined with the help center, so a visitor can't be linked across companies; the counters are deleted after 10 minutes to 2 days.
• Signed-in end users' own limits (on requests, messages, claims, product registrations, uploads, chat photos and videos, and guide comments) are counted from what they've already sent, or with a counter under their account ID that's deleted within 2 days.
• Signals can be switched off by each customer and are deleted after 12 months.
• AI providers receive only what a task needs - never passwords or payment details. AI drafts are never sent by themselves, and claim amendments need a person's approval. Two exceptions: parts extraction in Automatic mode adds the parts it finds to a claim, marked as AI, without approval; and, on Growth and Scale, a new help-center request without a subject of its own is given one written by AI.
• A photo sent in your help center's AI chat reaches the AI provider, without its metadata, only on the turn it's sent - described for search (the model is told not to describe people) and, when your documents have an answer, answered from; later turns carry only the short description. Videos are never sent to AI.

Resilience

• Our database provider keeps backups of the service [backup frequency and retention].
• Access to our provider accounts and production systems: [describe, e.g. limited to named staff, with multi-factor authentication].
• Incident response: [describe the breach procedure, including ICO notification within 72 hours].

Docutize doesn't hold an independent security certification (such as ISO 27001 or SOC 2) at the date of this DPA. No system is perfectly secure.

Stripe handles our billing of you. For that data we're the controller (see our Privacy Policy), and it doesn't receive your end users' data; it's listed for completeness. Our subprocessors' own infrastructure providers (such as Amazon Web Services, beneath Supabase and Vercel) are covered by those subprocessors' terms.

We'll tell you before adding or replacing a subprocessor (see Subprocessors).

For anything about this DPA - including objections, audit requests and copies of transfer terms - email hello@docutize.io, or write to us at [registered office address].