This Data Processing Agreement (this "DPA") is entered into by and between:
Dovito® Business Solutions, Ltd., a Colorado limited liability company, with its principal place of business at 508 Main Street, Windsor, Colorado 80550 ("Dovito"); and
the customer that has entered into the Agreement with Dovito ("Customer").
Dovito and Customer are each a "Party" and together the "Parties."
This DPA forms part of the Agreement (defined below). It applies automatically, without a separate signature, when Customer signs or accepts an Order, the MSA, or the Systematics Terms of Service. Customers that want a countersigned copy may request one at legal@dovito.com.
Capitalized terms used but not defined in this DPA have the meanings given in the MSA, including "AI Services," "BAA," "Customer," "Customer Data," "Customer Systems," "Dovito," "Order," "Personal Data," "Platform," "Services," and "Users." In this DPA:
1.1 "Agreement" means the MSA and all Orders under it. If Customer uses the Platform without an MSA in effect, "Agreement" means the Systematics Terms of Service and any Order that references them, and Section 17.4 applies.
1.2 "Applicable Data Protection Law" means every law and regulation relating to privacy, data protection, or data security that applies to the processing of Customer Personal Data under the Agreement, including, as amended and to the extent applicable: (a) the U.S. State Privacy Laws; (b) the GDPR; (c) the UK GDPR and the UK Data Protection Act 2018; and (d) the Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances (the "FADP").
1.3 "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations, Cal. Code Regs. tit. 11, § 7000 et seq.
1.4 "Controller," "Processor," "Data Subject," "Processing," and "Supervisory Authority" have the meanings given in the GDPR. "Controller" includes a "business" and "controller," "Processor" includes a "service provider" and "processor," and "Data Subject" includes a "consumer," each as defined in the U.S. State Privacy Laws. "Process" and "processed" have corresponding meanings.
1.5 "Customer Personal Data" means Personal Data within Customer Data that Dovito processes on Customer's behalf as a Processor under the Agreement. Customer Personal Data does not include Dovito Controller Data or De-identified Data.
1.6 "De-identified Data" means data derived from Customer Data that does not identify, and cannot reasonably be used to infer information about or be linked to, Customer or any individual, and that meets the requirements for de-identified or anonymous data under Applicable Data Protection Law.
1.7 "Dovito Controller Data" has the meaning in Section 2.4.
1.8 "EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced.
1.9 "GDPR" means Regulation (EU) 2016/679 (the General Data Protection Regulation).
1.10 "MSA" means Dovito's Master Services Agreement between Dovito and Customer, including version v2026.10 published at dovito.com/legal/msa, or the version the Parties have signed.
1.11 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed by Dovito or its Sub-processors. It does not include: (a) unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, blocked login attempts, and denial-of-service attacks that do not result in access to data; or (b) events in Customer Systems, or caused by Customer, its Users, or credentials under Customer's control, unless caused by Dovito or its Sub-processors.
1.12 "Restricted Transfer" means a transfer of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that is not recognized by the competent authority as providing an adequate level of protection, where no other lawful transfer mechanism applies.
1.13 "SCCs" means the EU SCCs, together with the UK Addendum and the Swiss adaptations in Section 14.5, as applicable to a Restricted Transfer.
1.14 "Security Measures" means the technical and organizational measures described in Annex II.
1.15 "Self-Service Tools" means the features of the Platform and Services that allow Customer and its Users to access, correct, export, restrict, and delete Customer Personal Data without Dovito's help.
1.16 "Sub-processor" means any third party, including an independent contractor, that Dovito engages to process Customer Personal Data on Dovito's behalf. Dovito's employees are not Sub-processors.
1.17 "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, as amended or replaced.
1.18 "U.S. State Privacy Laws" means all U.S. state consumer data privacy laws of general application that apply to the processing of Customer Personal Data, including the CCPA; the Colorado Privacy Act, C.R.S. § 6-1-1301 et seq., and its rules; the Virginia Consumer Data Protection Act, Va. Code Ann. § 59.1-575 et seq.; the Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq.; and the Texas Data Privacy and Security Act, Tex. Bus. & Com. Code ch. 541.
2.1 Scope. This DPA applies to Dovito's processing of Customer Personal Data in providing the Services and the Platform, including when Dovito accesses Customer Systems at Customer's direction. Annex I describes the subject matter, nature, purpose, and duration of the processing, the types of Customer Personal Data, and the categories of Data Subjects.
2.2 Customer as Controller. As between the Parties, Customer is the Controller (or business) of Customer Personal Data, and Dovito is a Processor (or service provider) processing Customer Personal Data on Customer's behalf.
2.3 Customer as Processor. If Customer processes Customer Personal Data as a Processor for a third-party Controller, Customer: (a) appoints Dovito as its sub-processor; (b) warrants that its instructions, including its appointment of Dovito and its agreement to this DPA, are authorized by that Controller; and (c) is the only point of contact for Dovito. Dovito has no obligation to communicate with, or take instructions from, the third-party Controller, except where Applicable Data Protection Law requires it or Customer has ceased to exist.
2.4 Dovito as Independent Controller. Dovito is an independent Controller, and not a Processor, of the following ("Dovito Controller Data"): (a) account and contact information of Customer and its Users that Dovito needs to create and manage accounts, authenticate Users, and communicate with Customer about the relationship; (b) billing, payment, tax, and transaction records; (c) data Dovito processes to secure its systems, detect and prevent fraud, abuse, and security incidents, and enforce the Agreement; (d) technical, usage, and performance data relating to the Services and Platform, as described in MSA Section 8.9; (e) De-identified Data under Section 2.5; and (f) data Dovito must process to comply with law or to establish, exercise, or defend legal claims. Dovito processes Dovito Controller Data under its Privacy Policy and Applicable Data Protection Law. This DPA does not apply to Dovito Controller Data.
2.5 De-identified and Aggregated Data. Customer instructs Dovito to create De-identified Data and aggregated data from Customer Data, as permitted by MSA Section 8.9, to operate, secure, benchmark, and improve Dovito's services and products. When Dovito creates or holds De-identified Data, Dovito will: (a) take reasonable measures to ensure it cannot be associated with an individual or household; (b) publicly commit to maintain and use it only in de-identified form and not attempt to re-identify it, except to test whether its de-identification processes meet this Section; and (c) contractually require any recipient to meet the same requirements. Once data meets this Section, it is no longer Customer Data or Customer Personal Data, and Dovito owns it under MSA Section 8.9.
2.6 Customer Affiliates. Customer enters into this DPA for itself and, to the extent Applicable Data Protection Law requires, on behalf of its Affiliates that are Controllers of Customer Personal Data and are permitted to use the Services ("Authorized Affiliates"). Customer is the sole point of contact for Authorized Affiliates, will exercise any rights under this DPA on their behalf, and is responsible for their compliance. Claims by Authorized Affiliates may be brought only by Customer, and they are subject to Section 17 in the aggregate with Customer's claims.
2.7 Customer Systems and Third-Party Platforms. Customer Systems, and third-party platforms that Customer or its Users connect to the Platform or instruct Dovito to use, are not Sub-processors. Customer's own agreements with those providers govern their processing. Dovito is not responsible for their processing, security, or compliance.
3.1 Documented Instructions. Dovito will process Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless law applicable to Dovito requires other processing. In that case, Dovito will inform Customer of the legal requirement before processing, unless the law prohibits Dovito from doing so on important grounds of public interest.
3.2 Complete Instructions. The Agreement (including this DPA and each Order) and Customer's configuration and use of the Platform and the Services, including the connections, integrations, AI Services, agent permissions, and User roles that Customer or its Users enable, are Customer's complete and final instructions to Dovito as of the date of this DPA. Customer's configuration choices are instructions even when a User makes them.
3.3 Additional Instructions. Any instruction outside the scope of Section 3.2 requires the Parties' prior written agreement, including on any additional Fees. Dovito may charge for carrying out additional instructions at its then-current rates, and may decline instructions that are not technically or commercially feasible. If Dovito declines, Customer may terminate the affected part of the Services under the Agreement.
3.4 Unlawful Instructions. Dovito will promptly inform Customer if, in Dovito's opinion, an instruction infringes Applicable Data Protection Law. Dovito may then suspend the processing that the instruction concerns until Customer confirms, modifies, or withdraws the instruction in writing. Dovito is not liable for any delay or failure to perform caused by that suspension. Dovito is not obligated to monitor or review Customer's instructions for legal compliance, and Customer remains responsible for the lawfulness of its instructions.
3.5 Instructions Remain Customer's Responsibility. Customer will ensure that its instructions comply with Applicable Data Protection Law and that Dovito's processing of Customer Personal Data under them will not cause Dovito to breach Applicable Data Protection Law.
4.1 Lawful Basis, Notices, and Consents. Customer is responsible for: (a) having and documenting a lawful basis for the processing of Customer Personal Data; (b) giving all notices to, and obtaining all consents and authorizations from, Data Subjects that Applicable Data Protection Law requires for Dovito to process Customer Personal Data under the Agreement; (c) honoring Data Subjects' choices, including opt-outs; and (d) the accuracy, quality, and legality of Customer Personal Data and the means by which Customer obtained it. These obligations are part of Customer's obligations under MSA Section 12.4.
4.2 Regulated and Special Category Data. Customer will not provide or give Dovito access to protected health information, payment card data, government identification numbers, biometric data, special categories of personal data under Article 9 of the GDPR, personal data relating to criminal convictions and offenses, or personal data of children under 16, except as permitted by MSA Section 5.6 and, for protected health information, Section 16. Where Customer uses Platform features designed to collect certain sensitive data, such as contractor tax forms or identity documents, Customer is responsible for determining that its collection and use of that data is lawful.
4.3 Customer Security Responsibilities. Customer is responsible for: (a) configuring the Platform, its account, integrations, and User permissions appropriately for the Customer Personal Data it processes; (b) managing its Users, their access, and their credentials, including enabling available multi-factor authentication; (c) the security of Customer Systems and of Customer Personal Data while it is outside Dovito's and its Sub-processors' systems; (d) keeping current backups of Customer Data and Customer Systems, as required by MSA Section 5.1(e); and (e) providing credentials to Dovito only through secure methods Dovito designates, as required by MSA Section 5.5.
4.4 Customer's Security Assessment. Customer has reviewed the Security Measures and agrees that, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, they provide a level of security appropriate to the risk for the Customer Personal Data that Customer intends to process.
4.5 Consumer Requests. Customer will inform Dovito of any Data Subject request made under Applicable Data Protection Law with which Dovito must comply, and will give Dovito the information Dovito needs to comply with it.
5.1 Service Provider and Processor. For the CCPA, Dovito is a service provider, and Customer discloses Customer Personal Data to Dovito only for the limited and specified business purposes described in Annex I, Part B. For the other U.S. State Privacy Laws, Dovito is a processor. The terms of this DPA on instructions, confidentiality, security, Sub-processors, assistance, deletion and return, and compliance information and assessments are intended to meet the processor contract requirements of those laws, including C.R.S. § 6-1-1305.
5.2 CCPA Prohibitions. Dovito will not:
(a) sell or share Customer Personal Data, as "sell" and "share" are defined in the CCPA;
(b) retain, use, or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in Annex I, Part B, or as otherwise permitted by the CCPA;
(c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Dovito and Customer;
(d) combine Customer Personal Data with personal information that Dovito receives from or on behalf of another person, or collects from its own interactions with a consumer, except as permitted by the CCPA and Cal. Code Regs. tit. 11, § 7050; or
(e) use sensitive personal information within Customer Personal Data to infer characteristics about any consumer, or for any purpose other than those permitted without a right to limit under Cal. Code Regs. tit. 11, § 7027(m).
5.3 Permitted Business Purposes. Consistent with Cal. Code Regs. tit. 11, § 7050, Dovito may retain, use, and disclose Customer Personal Data to: (a) perform the Services and provide the Platform under the Agreement; (b) engage Sub-processors under Section 8; (c) build or improve the quality of the Services and Platform, provided Dovito does not use Customer Personal Data to build or modify a household or individual profile for use in providing services to another business, or to correct or augment data obtained from another source; (d) detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity; (e) comply with law, legal process, and requests from government authorities; (f) establish, exercise, or defend legal claims; and (g) create De-identified Data under Section 2.5.
5.4 Same Level of Protection. Dovito will comply with the obligations that apply to it as a service provider or processor under the U.S. State Privacy Laws and will provide the same level of privacy protection they require, including by cooperating with Customer in responding to consumer requests under Section 10 and by maintaining the Security Measures.
5.5 Customer's Right to Ensure Compliant Use. Customer may take reasonable and appropriate steps to help ensure that Dovito uses Customer Personal Data consistently with Customer's obligations under the U.S. State Privacy Laws. The Parties agree that the compliance information and assessment process in Section 13 is a reasonable and appropriate step for that purpose.
5.6 Right to Stop and Remediate. If Customer reasonably believes that Dovito is using Customer Personal Data in a manner not authorized by this DPA, Customer may notify Dovito in writing, and Dovito will work with Customer in good faith to stop the unauthorized use and remediate its effects, including by suspending the affected processing where appropriate.
5.7 Notice If Unable to Comply. Dovito will notify Customer within five business days after determining that it can no longer meet its obligations under the U.S. State Privacy Laws or this Section 5. Customer may then take the steps described in Section 5.6.
5.8 Sub-processor Flow-Down. Dovito will bind each Sub-processor that processes Customer Personal Data by a written contract that imposes the restrictions in this Section 5, and will notify Customer of each Sub-processor under Section 8.
5.9 Certification. Dovito certifies that it understands the restrictions in this Section 5 and will comply with them.
6.1 Confidentiality. Dovito will ensure that each person it authorizes to process Customer Personal Data, including employees and independent contractors, is subject to a written duty of confidentiality or an appropriate statutory duty of confidentiality.
6.2 Need to Know. Dovito will limit access to Customer Personal Data to personnel who need it to perform the Services, provide the Platform, or meet Dovito's obligations under the Agreement, as described in Annex II.
6.3 Responsibility. Dovito is responsible for its personnel's compliance with this DPA, as provided in MSA Section 4.2.
7.1 Security Measures. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks to individuals, Dovito will implement and maintain the Security Measures described in Annex II, which are designed to protect Customer Personal Data against Personal Data Breaches.
7.2 Updates. Security threats and technology change over time. Dovito may update the Security Measures, provided the updates do not materially reduce the overall level of protection of Customer Personal Data.
7.3 Customer Responsibilities. Dovito's obligations under this Section 7 do not extend to the matters for which Customer is responsible under Section 4.3, or to Customer Systems.
8.1 General Authorization. Customer gives Dovito general written authorization to engage Sub-processors to process Customer Personal Data, including the Sub-processors listed in Annex III and the categories of independent contractors described there.
8.2 Current List. Dovito publishes its current list of Sub-processors at dovito.com/legal/subprocessors. The names of individual independent contractors who process Customer Personal Data are available to Customer on written request, and Customer will treat them as Dovito's Confidential Information.
8.3 Sub-processor Obligations. Before a Sub-processor processes Customer Personal Data, Dovito will: (a) take reasonable steps to assess the Sub-processor's security and data protection practices; and (b) enter into a written agreement with the Sub-processor that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, including, where the GDPR or UK GDPR applies, the same data protection obligations as set out in this DPA as required by Article 28(4). Dovito remains responsible to Customer for each Sub-processor's performance of its data protection obligations, subject to Section 17.
8.4 Notice of New Sub-processors. Dovito will give Customer at least 15 days' notice before a new Sub-processor begins processing Customer Personal Data (the "Objection Period"). Dovito will give notice either by email to Customer's notice contact or by updating the list at dovito.com/legal/subprocessors, where Dovito offers a way for Customer to subscribe to updates. Customer is responsible for subscribing and for keeping its notice contact current.
8.5 Objections. Customer may object to a new Sub-processor by written notice to legal@dovito.com within the Objection Period, stating reasonable grounds relating to the protection of Customer Personal Data. If Customer does not object within the Objection Period, Customer is deemed to have authorized the new Sub-processor. If Customer objects, the Parties will discuss the objection in good faith, and Dovito may, at its option, propose a change to the Services or Customer's configuration that avoids use of the Sub-processor for Customer Personal Data. If the Parties do not resolve the objection within 30 days after Dovito receives it, Customer may terminate the Order or Orders that cannot be performed without the new Sub-processor by written notice given within the following 15 days, and Dovito will refund any prepaid Fees for the terminated Services covering the period after termination. That termination and refund are Customer's sole and exclusive remedy for its objection.
8.6 Emergency Replacement. Dovito may replace a Sub-processor without advance notice where the replacement is reasonably needed to address a security or data protection risk, a Sub-processor's material breach or discontinuation of service, or a threat to the availability of the Services. Dovito will notify Customer of the replacement as soon as reasonably practicable, and the Objection Period will run from that notice.
8.7 Copies of Sub-processor Agreements. Where the SCCs require Dovito to provide a copy of a Sub-processor agreement, Dovito may remove commercial information and terms unrelated to data protection first, and may provide a summary where the Sub-processor's confidentiality terms prohibit disclosure.
9.1 AI Processing Is Instructed Processing. When Customer or its Users use AI Services in the Platform, or an Order provides for AI-assisted work, Customer instructs Dovito to send the relevant Customer Personal Data, such as prompts, messages, files, voice notes, and data retrieved from connected Customer Systems, to the AI providers listed in Annex III to generate output and perform the requested tasks.
9.2 No Training. Consistent with MSA Section 10.4, Dovito will not use Customer Data, including Customer Personal Data, to train or fine-tune AI models that are made available to anyone other than Customer. De-identified Data is governed by Section 2.5.
9.3 Provider Terms. Dovito will use Customer Personal Data with third-party AI providers only under commercial terms that prohibit the provider from training its models on that data. Customer acknowledges that AI providers may retain submitted data for a limited period to monitor for abuse and misuse, as described in their terms, and then delete it. Dovito does not control those retention periods.
9.4 Changes to AI Providers. Dovito may change AI providers or models under MSA Section 10.5. A new AI provider that processes Customer Personal Data is a new Sub-processor subject to Section 8 and must meet Sections 9.2 and 9.3.
9.5 Human Review. Dovito personnel will review AI conversations and related content containing Customer Personal Data only to provide support Customer requests, to investigate a security or abuse concern, or to comply with law.
9.6 Decisions About Individuals. Customer decides whether and how to use AI Services and their output, as described in MSA Sections 10.2 and 10.3. If Customer uses AI Services in making decisions that produce legal or similarly significant effects on individuals, including decisions about employment, contracting, or access to services, Customer is responsible for meeting the requirements of Applicable Data Protection Law and other laws that govern automated decision-making, profiling, and high-risk artificial intelligence, including any required notices, human review, opt-outs, and assessments. Dovito does not use Customer Personal Data to make those decisions on its own behalf.
10.1 Self-Service Tools. Customer will use the Self-Service Tools to respond to Data Subject requests where they allow it.
10.2 Requests Received by Dovito. If Dovito receives a request from a Data Subject to exercise rights under Applicable Data Protection Law relating to Customer Personal Data, and the request identifies Customer, Dovito will promptly forward the request to Customer or direct the Data Subject to Customer. Dovito will not respond to the request itself, other than to acknowledge it and redirect the Data Subject, unless Customer authorizes it or law requires it.
10.3 Assistance with Data Subject Requests. Taking into account the nature of the processing, Dovito will provide reasonable assistance, through appropriate technical and organizational measures, to help Customer respond to Data Subject requests, to the extent Customer cannot do so through the Self-Service Tools. Customer will pay for assistance beyond the Self-Service Tools at Dovito's then-current rates, unless the request arises from Dovito's breach of this DPA.
10.4 Assessments and Prior Consultation. Taking into account the nature of the processing and the information available to Dovito, Dovito will provide reasonable information and assistance to help Customer carry out data protection impact assessments under Article 35 of the GDPR, prior consultations with Supervisory Authorities under Article 36 of the GDPR, and data protection assessments required by the U.S. State Privacy Laws, to the extent Customer does not otherwise have access to the relevant information. Customer will pay Dovito's reasonable costs for this assistance.
10.5 Other Assistance. Dovito will provide reasonable assistance to Customer in meeting its obligations under Articles 32 through 34 of the GDPR, taking into account the nature of the processing and the information available to Dovito, through the Security Measures and Sections 7 and 11.
10.6 Records and Regulators. Dovito will maintain the records of processing that Applicable Data Protection Law requires of it as a Processor and will cooperate with Supervisory Authorities as that law requires.
11.1 Notification. Dovito will notify Customer without undue delay after becoming aware of a Personal Data Breach, and in any event within 72 hours after confirming it, consistent with MSA Section 12.3. Dovito will investigate suspected Personal Data Breaches promptly under its incident response plan. Dovito will send notice to Customer's notice contact under the Agreement and to any security contact Customer designates in writing.
11.2 Contents. Dovito's notice will describe, to the extent then known: (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and records concerned; (b) the name and contact details of Dovito's point of contact; (c) the likely consequences of the Personal Data Breach; and (d) the measures Dovito has taken or proposes to take to address the Personal Data Breach and mitigate its possible adverse effects. Where Dovito cannot provide all of this information at once, it will provide it in phases as it becomes available.
11.3 Response and Cooperation. Dovito will take reasonable steps to contain, investigate, and remediate each Personal Data Breach and to mitigate its effects, will keep Customer reasonably informed of material developments, and will provide reasonable cooperation to help Customer meet its own notification obligations.
11.4 No Admission. Dovito's notification of or response to a Personal Data Breach is not an acknowledgment by Dovito of any fault or liability.
11.5 Notices to Individuals and Regulators. Customer will decide whether to notify, and will control the content and timing of notices to, affected individuals, Supervisory Authorities, other regulators, and the public, unless law requires Dovito to give a notice itself. Dovito will not name Customer in any public statement about a Personal Data Breach without Customer's prior written consent, unless law requires it. Customer will give Dovito a reasonable opportunity to review any notice that names or describes Dovito before it is sent, unless law or a regulator's deadline makes that impractical.
11.6 Costs. Each Party will bear its own costs of responding to a Personal Data Breach, except that, to the extent a Personal Data Breach was caused by Dovito's breach of this DPA or the MSA, Dovito will reimburse Customer's reasonable, documented out-of-pocket costs of notices to individuals and regulators that law requires. Dovito's reimbursement obligation is subject to the limitations and exclusions in MSA Section 15, including the Data Cap.
11.7 Customer-Caused Events. If Dovito assists Customer with an event that is excluded from the definition of Personal Data Breach, such as a compromise of Customer's credentials or Customer Systems, Customer will pay for that assistance at Dovito's then-current rates.
12.1 During the Term. Customer may use the Self-Service Tools to export and delete Customer Personal Data during the term of the Agreement.
12.2 After Termination. Customer Personal Data will be returned and deleted as provided in MSA Section 12.5. Within 30 days after termination of the applicable Order, and on Customer's written request made during that period, Dovito will make Customer Personal Data in its possession available for export in a standard format. Dovito will then delete Customer Personal Data within 90 days after termination.
12.3 Exceptions. Dovito may retain Customer Personal Data: (a) in backups, until the backups are overwritten in the ordinary course of Dovito's backup rotation; and (b) where law requires Dovito to retain it. Dovito will continue to protect retained Customer Personal Data under this DPA and will not actively process it except as needed for storage, deletion, or compliance with the law requiring its retention.
12.4 Certification. On Customer's written request, Dovito will confirm in writing that it has deleted Customer Personal Data as required by this Section 12.
12.5 Customer Systems. Customer Personal Data in Customer Systems remains Customer's responsibility, as provided in MSA Section 12.5. At the end of the Services, Customer will revoke or rotate the credentials it provided to Dovito, as required by MSA Section 5.5.
13.1 Documentation First. Dovito will make available to Customer the information reasonably necessary to demonstrate Dovito's compliance with this DPA. Customer will first seek to satisfy any audit or information right under this DPA or Applicable Data Protection Law through the following, each provided as Dovito's Confidential Information:
(a) summaries or copies of Dovito's relevant information security policies;
(b) Dovito's written responses to one reasonable security or privacy questionnaire per 12-month period, such as a standard industry questionnaire; and
(c) any third-party audit report, certification, or assessment that Dovito holds at the time of the request. Dovito does not represent that it holds any particular report or certification.
13.2 When an Audit Is Permitted. Customer may conduct an audit of Dovito's processing of Customer Personal Data, including an inspection, only if: (a) a Supervisory Authority or other regulator with jurisdiction over Customer requires it; or (b) a Personal Data Breach caused by Dovito has occurred, and the audit is limited to the matters related to it.
13.3 Audit Conditions. Each audit permitted under Section 13.2 or 13.5 is subject to the following:
(a) Customer will give Dovito at least 30 days' written notice, with a proposed scope, and the Parties will agree on the scope, timing, and duration before it begins;
(b) the audit will take place during Dovito's normal business hours, will last no longer than reasonably necessary, and will not unreasonably interfere with Dovito's operations. Because Dovito's operations are conducted remotely using cloud infrastructure, Dovito may hold the audit by video conference and remote document review;
(c) no more than one audit may take place in any 12-month period, unless a regulator requires more;
(d) the audit will be carried out by an independent auditor that is not a competitor of Dovito and that has signed a confidentiality agreement reasonably acceptable to Dovito, or by the regulator;
(e) Customer will bear all costs of the audit, including Dovito's reasonable time at its then-current rates;
(f) the audit will not give Customer or its auditor access to data of Dovito's other customers, information subject to legal privilege, Dovito's trade secrets or pricing, or systems or facilities of Sub-processors, whose compliance Dovito will address by providing available reports or summaries; and
(g) the audit results are Dovito's Confidential Information, and Customer will give Dovito a copy of any audit report without charge.
13.4 Remediation. If an audit identifies a material failure by Dovito to comply with this DPA, Dovito will take reasonable steps to remediate it.
13.5 Mandatory Rights. To the extent Applicable Data Protection Law or the SCCs give Customer an audit or assessment right that Sections 13.1 and 13.2 do not satisfy, Customer may exercise that right under the conditions in Section 13.3. For the U.S. State Privacy Laws, Dovito may instead, at its option, arrange for a qualified and independent assessor to assess Dovito's policies and technical and organizational measures using an appropriate and accepted control standard or framework, and provide the report to Customer on request, at Customer's cost unless law requires otherwise.
14.1 Transfer Locations. Dovito and its Sub-processors may process Customer Personal Data in the United States and in the other countries identified in Annex I and Annex III. Customer authorizes these transfers, subject to this Section 14.
14.2 EU SCCs. For Restricted Transfers from the European Economic Area, the EU SCCs are incorporated into this DPA by reference and are deemed signed by the Parties on the date this DPA takes effect, with Customer as data exporter and Dovito as data importer. Module 2 (controller to processor) applies where Customer is a Controller, and Module 3 (processor to processor) applies where Customer is a Processor. The Parties make the following elections:
(a) Clause 7 (Docking Clause): the optional docking clause is included;
(b) Clause 9(a) (Sub-processors): Option 2 (general written authorization) applies, and the time period for prior notice is the Objection Period in Section 8.4;
(c) Clause 11(a) (Redress): the optional language permitting Data Subjects to lodge complaints with an independent dispute resolution body is not included;
(d) Clause 13(a) (Supervision): the competent Supervisory Authority is determined by Customer's establishment, as described in Annex I, Part C;
(e) Clause 17 (Governing Law): Option 1 applies, and the EU SCCs are governed by the law of Ireland;
(f) Clause 18(b) (Forum): disputes will be resolved by the courts of Ireland; and
(g) Annexes: Annex I.A, I.B, and I.C of the EU SCCs are completed by Annex I of this DPA, Annex II of the EU SCCs by Annex II of this DPA, and Annex III of the EU SCCs by Annex III of this DPA.
14.3 Interpretation of the EU SCCs. To the extent consistent with the EU SCCs: (a) Section 3 describes Customer's instructions under Clause 8.1; (b) the certification of deletion under Clauses 8.5 and 16(d) will be provided only on Customer's written request; (c) audits under Clause 8.9 will be carried out under Section 13; (d) Sub-processor agreements under Clause 9(c) will be provided under Section 8.7; (e) notice of a Personal Data Breach under Clause 8.6 will be given under Section 11; and (f) under Module 3, Dovito will provide any information or notice intended for the third-party Controller to Customer, and Customer will pass it on. Nothing in this DPA varies or modifies the EU SCCs or prejudices the fundamental rights or freedoms of Data Subjects.
14.4 UK Transfers. For Restricted Transfers from the United Kingdom, the UK Addendum is incorporated into this DPA by reference and is deemed signed by the Parties. Table 1 of the UK Addendum is completed by Annex I, Part A of this DPA. Table 2 is completed by the modules and elections in Section 14.2. Table 3 is completed by Annexes I, II, and III of this DPA. For Table 4, the Importer may end the UK Addendum as described in its Section 19, in which case the Parties will cooperate in good faith to put an alternative transfer mechanism in place. The Mandatory Clauses of the UK Addendum apply.
14.5 Swiss Transfers. For Restricted Transfers from Switzerland, the EU SCCs apply as elected in Section 14.2, with these adaptations: (a) references to the GDPR are to the FADP, to the extent the transfer is subject to the FADP; (b) the Swiss Federal Data Protection and Information Commissioner is the competent Supervisory Authority for transfers subject to the FADP; and (c) the term "Member State" in the EU SCCs will not be interpreted to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence under Clause 18(c).
14.6 Onward Transfers. Dovito will ensure that any onward transfer of Customer Personal Data subject to a Restricted Transfer to a Sub-processor is protected by the SCCs or another transfer mechanism recognized under Applicable Data Protection Law.
14.7 Transfer Impact Assessments. Dovito will provide reasonable information about the laws and practices in the destination countries, and about its safeguards, that Customer reasonably requests to complete an assessment under Clause 14 of the EU SCCs.
14.8 Alternative Mechanisms. If Dovito adopts an alternative lawful transfer mechanism recognized under Applicable Data Protection Law, such as certification under the EU-U.S. Data Privacy Framework or its UK or Swiss extensions, Dovito may rely on it for Restricted Transfers it covers. If the SCCs are amended, replaced, or invalidated, the Parties will cooperate in good faith to put a lawful replacement in place, and Customer will sign any updated clauses reasonably needed for that purpose.
14.9 Other Jurisdictions. Where Applicable Data Protection Law of another jurisdiction requires a transfer mechanism for Customer Personal Data, the Parties will cooperate in good faith to implement one, and the EU SCCs will apply with the adaptations that law requires, to the extent the law accepts them.
15.1 Notice. If Dovito receives a legally binding request from a public authority for access to Customer Personal Data, Dovito will, unless law prohibits it: (a) promptly notify Customer; and (b) where reasonable, ask the authority to direct the request to Customer.
15.2 Review and Minimization. Dovito will review the legality of each such request, will challenge it where, after careful assessment, Dovito concludes there are reasonable grounds to do so under applicable law, and will disclose only the minimum Customer Personal Data needed to comply.
15.3 No Voluntary Disclosure. Dovito will not voluntarily disclose Customer Personal Data to a public authority except as permitted by this Section 15, and has not intentionally created back doors or similar programming to give public authorities access to Customer Personal Data.
16.1 BAA Required. Customer will not provide Dovito with, or give Dovito access to, protected health information as defined under the Health Insurance Portability and Accountability Act of 1996 and its regulations ("PHI") unless the Parties have signed a BAA that covers the Services involved. Dovito may decline to sign a BAA.
16.2 BAA Controls. If the Parties have signed a BAA, the BAA controls over this DPA as to PHI.
16.3 No BAA. If Customer provides PHI without a signed BAA, Dovito has no obligations under HIPAA for that PHI, and Customer is responsible for the consequences as provided in MSA Sections 5.6 and 16.2.
17.1 Subject to the MSA. Each Party's liability arising out of or relating to this DPA, including under the SCCs and the UK Addendum as between the Parties, and including all claims by Authorized Affiliates, is subject to the exclusions and limitations in MSA Section 15, including the Data Cap in MSA Section 15.3. All such liability counts toward the aggregate caps in MSA Section 15.6.
17.2 No Expansion. Nothing in this DPA creates a separate or additional limitation of liability, increases any cap in the MSA, creates uncapped liability, or creates any indemnity obligation that the MSA does not state.
17.3 Data Subjects and Non-Excludable Liability. Nothing in this DPA limits: (a) either Party's liability to Data Subjects under Clause 12 of the EU SCCs or any third-party beneficiary rights Data Subjects have under the SCCs; or (b) liability that cannot be limited under Applicable Data Protection Law. Each Party retains its right under Clause 12 of the EU SCCs to claim back from the other Party the part of any compensation paid to a Data Subject that corresponds to the other Party's responsibility for the damage.
17.4 Agreements Without an MSA. If Customer uses the Platform without an MSA in effect, the limitation of liability, dispute resolution, and governing law terms of the Systematics Terms of Service (Sections 21 through 23) apply to this DPA.
18.1 Precedence. If the documents that make up the Agreement conflict as to the processing of Personal Data, the following order controls: (a) as to PHI, the BAA; (b) the SCCs, as to Restricted Transfers; (c) this DPA; (d) the MSA, or if there is no MSA, the Systematics Terms of Service; (e) the Order; and (f) any other incorporated document. This is consistent with MSA Section 2.4.
18.2 Orders. An Order may change a specific section of this DPA only if the Order expressly identifies the section and states that it overrides it, and then only for that Order. No Order may reduce the protections of the SCCs.
18.3 No Other Effect. Except as this DPA states, the Agreement remains unchanged and in full effect.
19.1 Term. This DPA takes effect on the earliest of the date Customer signs or accepts the MSA, an Order, or the Systematics Terms of Service, or first provides Customer Personal Data to Dovito. It continues until the later of the termination of the Agreement or the deletion of all Customer Personal Data under Section 12.
19.2 Survival. Sections 2.4, 2.5, 11, 12, 13 (as to processing before deletion), 17, 18, 19, and 20, and any other terms that by their nature should survive, survive termination of this DPA for as long as Dovito retains any Customer Personal Data or as needed to give them effect.
19.3 Updates. Dovito may update this DPA by posting a new version at dovito.com/legal/dpa, as follows:
(a) updates required by Applicable Data Protection Law, a regulator, or a court, or needed to adopt new or amended SCCs or another transfer mechanism, take effect on the date stated in the updated DPA;
(b) other updates that do not materially reduce the protection of Customer Personal Data take effect 30 days after Dovito posts them and gives notice to Customer; and
(c) updates that would materially reduce the protection of Customer Personal Data apply to Customer only with Customer's written agreement.
If Customer has a countersigned copy of this DPA, only updates under Section 19.3(a) apply to Customer without its written agreement. Updates to the Sub-processor list are governed by Section 8, not this Section 19.3.
20.1 Disputes. Any Dispute arising out of or relating to this DPA will be resolved under MSA Section 18 (Dispute Resolution), and this DPA is governed by the law stated in MSA Section 19 (Governing Law and Venue), except as provided in Section 20.2.
20.2 Exceptions. The EU SCCs are governed by the law and forum elected in Section 14.2, the UK Addendum by the law and forum stated in it, and the Swiss adaptations by Section 14.5. Nothing in this DPA limits a Data Subject's rights under the SCCs or Applicable Data Protection Law to bring a claim or complaint in a particular forum.
20.3 Third Parties. Except for Data Subjects' third-party beneficiary rights under the SCCs, this DPA does not create rights for any third party.
Questions about this DPA, notices of objection under Section 8, and requests under Sections 10 and 13 should be sent to:
Dovito® Business Solutions, Ltd. 508 Main Street Windsor, Colorado 80550 Email: legal@dovito.com
Formal notices under this DPA follow MSA Section 20.3.
Data exporter
| Item | Detail |
|---|---|
| Name | Customer, as identified in the Order or a signed copy of this DPA |
| Address | Customer's address in the Order or a signed copy of this DPA |
| Contact person | Customer's notice contact under the Agreement |
| Activities relevant to the transfer | Use of the Services and Platform under the Agreement |
| Role | Controller (Module 2) or Processor (Module 3) |
| Signature and date | By signing or accepting the Agreement, which incorporates this DPA and the SCCs, or by signing a countersigned copy of this DPA |
Data importer
| Item | Detail |
|---|---|
| Name | Dovito® Business Solutions, Ltd. |
| Address | 508 Main Street, Windsor, Colorado 80550, United States |
| Contact person | Privacy and legal, legal@dovito.com |
| EU or UK representative | None appointed |
| Activities relevant to the transfer | Providing the Services and Platform under the Agreement |
| Role | Processor |
| Signature and date | By signing or accepting the Agreement, which incorporates this DPA and the SCCs, or by signing a countersigned copy of this DPA |
Categories of Data Subjects. Depending on how Customer uses the Services and Platform:
Categories of Personal Data. Depending on how Customer uses the Services and Platform:
Sensitive data. Customer Personal Data may include the following only where Customer uploads it or directs Dovito to access it, and only as permitted by Section 4.2 and MSA Section 5.6:
Safeguards applied to sensitive data: the Security Measures in Annex II, access limited to personnel with a need to know, processing only to provide the Services and Platform to Customer, no use to infer characteristics about any individual, and no advertising use. Credentials are stored only in Dovito-approved password managers as described in Annex II.
Frequency of the transfer. Continuous, for the term of the Agreement.
Nature of the processing. Collection, recording, organization, structuring, storage, hosting, adaptation, retrieval, consultation, use, analysis (including AI-assisted analysis), transmission, integration and migration between systems, automation, alignment or combination as Customer instructs, restriction, erasure, and destruction, in each case as needed to provide the Services and Platform.
Purposes of the processing (business purposes).
Duration and retention. For the term of the Agreement, and then until return and deletion under Section 12 (export available for 30 days after termination on request, and deletion within 90 days after termination, except backups overwritten in the ordinary course and copies law requires Dovito to keep). During the term, Customer controls retention through its configuration and the Self-Service Tools.
Processing locations. The United States, and the countries where Dovito's independent contractors and Sub-processors operate. These currently include the Philippines and Belize. Transfers to personnel and contractors outside the United States are covered by written agreements that include confidentiality and data protection obligations consistent with this DPA and, where required, the SCCs.
Transfers to Sub-processors. Sub-processors process Customer Personal Data for the subject matter, nature, and purposes described in Annex III, for the term of the Agreement or until Dovito stops using the Sub-processor, whichever is earlier.
Dovito maintains the following measures, drawn from its written information security policies. Dovito may update them under Section 7.2. Where this Annex describes a measure as "reasonable," Dovito's policies do not state a specific standard for it.
Current as of version v2026.10. The current list is published at dovito.com/legal/subprocessors and is updated under Section 8.
| Sub-processor | Purpose | Customer Personal Data involved | Location |
|---|---|---|---|
| DigitalOcean, LLC | Application hosting and file storage | All Customer Personal Data stored in the Platform | United States |
| Vercel Inc. | Legacy file storage | Files held in legacy storage | United States |
| Stripe, Inc. | Payment processing | Billing contacts and transaction information for Platform purchases and payment features Customer enables | United States |
| OpenAI, L.L.C. | AI Services | Content submitted to AI features | United States |
| Anthropic, PBC | AI Services | Content submitted to AI features | United States |
| Perplexity AI, Inc. | AI Services | Content submitted to AI features | United States |
| PostHog, Inc. | Product analytics, feature flags, in-app surveys, and opt-in session recordings | Internal User IDs and roles, usage events, and masked session recordings where a User enables them | United States |
| Google LLC | Sign in with Google | User name, email address, and account identifier | United States |
| Apple Inc. | Sign in with Apple | User name, email address, and account identifier | United States |
| HighLevel, Inc. (LeadConnector) | CRM, email, and SMS messaging used to deliver the Services | Contact details and message content | United States |
| Mailgun Technologies, Inc. | Transactional email | Recipient email addresses and message content | United States |
| Twilio Inc. (SendGrid) | Transactional email | Recipient email addresses and message content | United States |
| Cloudflare, Inc. | Bot protection and network security | Network and request data, such as IP addresses | Global network |
| Ably Real-time Ltd. | Real-time updates within the Platform | Content of real-time messages in transit | United States and other regions where the provider operates |
| Upstash, Inc. | Caching and rate limiting | Cached data and identifiers used for rate limiting | United States |
| ClickUp (Mango Technologies, Inc.) | Support, feedback, and project management | Customer Personal Data included in support requests, feedback, and project records | United States |
| GitHub, Inc. | Software development and issue tracking | Customer Personal Data incidentally included in code, configuration, or issues | United States |
| Brandfetch | Public brand information for business profiles | Company domain names; not intended to receive Customer Personal Data | United States |
| Independent contractors | Delivery of Services under written confidentiality obligations | Customer Personal Data needed for the engagement | United States, the Philippines, and Belize |
Notes:
This DPA is effective and binding without a signature when incorporated into the MSA, an Order, or the Systematics Terms of Service. A signature is optional and is provided for customers that want a countersigned copy. Signing this DPA also signs the SCCs and UK Addendum as incorporated in Section 14. Signing does not change the terms of this DPA unless Dovito agrees in a writing signed by an officer. To request a countersigned copy, send the signed DPA to legal@dovito.com.
Reviews
“David and the team at Dovito Business Solutions are phenomenal at creating solutions with automation, systems and processes to give business owners back valuable time to work ON the business not IN the business. I learn something new every time I have a conversation with this group.”