1. Scope
This data processing agreement ("DPA") is part of the terms of service and applies whenever the operator of notdocs described on the legal notice, whose details are given on request as that page says ("processor"), processes personal data on behalf of an organization using the hosted service ("controller") in the course of providing it. It is meant to satisfy Article 28 of the GDPR. It applies automatically to every organization; no signature is needed. If you need a countersigned copy for your records, write to legal@notdocs.dev.
2. The processing
- Subject matter. Running a document workspace over the controller's git repositories.
- Duration. For as long as the controller has an account, plus the deletion period in section 8.
- Nature and purpose. Storing an index of the controller's documents, serving them to the controller's users and authorized agents, merging edits, committing them to the controller's repository, and, on the controller's request, sending text to AI model providers.
- Types of personal data. Email addresses and identifiers of the controller's users; whatever personal data the controller puts in its documents and comments.
- Data subjects. The controller's users, and whoever the controller's documents are about.
3. Instructions
The processor processes personal data only on the controller's documented instructions, which are: the terms of service, this DPA, and the actions the controller's users and agents take in the service. The processor will tell the controller if it believes an instruction infringes data protection law, unless the law prohibits telling.
4. Confidentiality
People authorized by the processor to process the data are bound by confidentiality.
5. Security
The processor implements the measures described on the security page, which are updated as they change. In summary: encryption in transit, access limited by organization role and token scope, hashed token secrets, signed webhooks, and separation of the controller's content in its own repository.
6. Subprocessors
The controller gives general authorization to the subprocessors listed on the subprocessors page. The processor will notify the organization's owners by email at least 14 days before a new subprocessor handles personal data. If the controller objects on reasonable data-protection grounds and the parties cannot resolve it, the controller may terminate the affected service. The processor imposes data-protection obligations on each subprocessor equivalent to those in this DPA and remains liable for their performance.
7. Assistance
The processor will help the controller respond to data-subject requests, taking into account the nature of the processing; most such requests can be handled by the controller directly in its repository. The processor will help with security, breach notification, impact assessments and consultations with supervisory authorities to the extent the controller cannot do so from the information already available to it.
8. Deletion and return
Return is built in: the controller's content is in its repository at all times. On termination the processor deletes the index rows, events and account data relating to the controller within 30 days of the request, unless the law requires keeping some of it, in which case only that is kept and only for as long as required. The controller can also delete a project or its organization itself, from the settings, at any time; that deletes the index rows, events, uploaded files and the texts of document versions that no other project holds, at once.
9. Breach notification
The processor will notify the controller without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the controller's data, with what it knows at that time and updates as it learns more.
10. Audit
The processor makes available the information reasonably needed to demonstrate compliance, on request to legal@notdocs.dev. Where that is not sufficient, the controller may audit, itself or through an auditor bound by confidentiality, at most once a year on 30 days' notice, during business hours, at the controller's cost, and without access to other customers' data.
11. International transfers
Where a subprocessor is outside the European Economic Area, the transfer rests on an adequacy decision, including the EU-US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses.
12. Liability and precedence
Liability under this DPA is subject to the limits in the terms of service, except where the GDPR does not allow limitation. If this DPA conflicts with the terms, this DPA prevails for the processing of personal data.