GDPR & Data Processing

Doki Dok is built to hold documents that contain other people’s personal data — contracts, IDs, property papers, payslips. This page explains who is responsible for what, and contains the data processing terms that apply to every customer. Together with the Terms of Service they form a data processing agreement under Article 28 GDPR, and no separate signature is needed. If your organisation needs a signed copy, email [email protected].

1. Roles

• You (the customer) are the controller for the personal data in the documents, rooms, inbox messages, and signature requests you create. You decide what goes in and why.
• Agdir Drift AS is your processor for that data. We only process it to provide the Service to you.
• Agdir Drift AS is a controller for account, billing, security, and website data, as described in the Privacy Policy.

2. Data processing terms

Subject matter and duration

We process customer personal data to store, organise, share, send, and sign documents for as long as you use the Service, and until it is deleted after your account ends.

Data subjects and categories of data

Your users, room members, signers, email senders, and any person mentioned in your documents. The data can be any type you choose to upload, including identity numbers and special categories of data. You are responsible for having a legal basis for this and for informing the people concerned.

Our obligations

As processor we will:

1. Process personal data only on your documented instructions. Your use of the Service and its settings are your instructions. We will tell you if we believe an instruction breaks data protection law.
2. Make sure everyone authorised to access the data is bound by confidentiality.
3. Apply appropriate technical and organisational security measures (Art. 32), including encryption in transit and at rest, access control, audit logging, and backups. See Security.
4. Use sub-processors only as described below, under written terms that give the same level of protection, and remain responsible for them.
5. Help you answer requests from data subjects, mainly through the Service itself (export, correction, deletion), and forward any request we receive directly to you.
6. Notify you without undue delay, and no later than 48 hours after becoming aware, of a personal data breach affecting your data, with the information you need to meet your own obligations.
7. Help you with data protection impact assessments and prior consultations where relevant to the Service.
8. Delete or return your data when your account ends, as described in the Privacy Policy, unless law requires us to keep it.
9. Make available the information needed to show compliance with Article 28, and allow audits with reasonable notice, at most once a year unless a breach or authority requires otherwise. We may answer with documentation first.

Transfers

Customer documents and backups are stored with Hetzner in Germany. Any transfer outside the EEA by a sub-processor is covered by an adequacy decision or the European Commission’s Standard Contractual Clauses.

3. Sub-processors

We will announce new sub-processors on this page and by email to account owners at least 30 days before they start processing customer data. If you object on reasonable data protection grounds and we cannot resolve it, you may terminate the affected part of the Service.

4. Contact

For data protection questions, a signed DPA, or to report a security concern: