Data processing agreement

1. Who does what

For the personal data you put into Doodali or collect through it (your customers, contacts, leads, staff and so on), you are the controller and we are your processor. For data about you as our customer (your account and billing details), we are the controller, as our privacy policy explains.

2. The processing

• What and why: storing, organising and using personal data so Doodali can provide its features to you: customer records, sales, projects, messages, email, texts and calls, bookings, invoices, forms, newsletters, your customer hub, and AI features you choose to use.
• How long: for as long as you use Doodali, then until it’s deleted as set out in section 9.
• Whose data: your customers and prospects, their contacts, people who contact or book with you, your team, and anyone else you choose to record.
• What data: names and contact details, messages and call recordings or transcripts, notes, bookings, orders and invoices, form answers, files you upload, and anything else you choose to record. Doodali isn’t designed for special category data (such as health records); if you store it, you’re responsible for having a lawful basis and suitable safeguards.

3. Your instructions

We only process personal data on your documented instructions, which are these terms and how you use and set up Doodali, unless the law requires otherwise (in which case we’ll tell you first, unless the law forbids it). If we think an instruction breaks data protection law, we’ll tell you.

4. Confidentiality

Everyone at Doodali who can access personal data is bound to keep it confidential, and only accesses it when needed to provide or support the service. Support access to your account happens only when you ask us for help, lasts two hours at most, is recorded, and your account’s owners are emailed each time. The password vault, staff HR records, documents and forms, leave details and direct messages are never shown during support access.

5. Security

We keep appropriate technical and organisational measures in place to protect personal data, including encryption in transit, encryption of secrets at rest, separation of each business’s data, two-step sign-in and passkeys, restricted and monitored server access, automatic security updates, and nightly checked backups. They’re described on our security page. We review them as risks and technology change.

6. Sub-processors

You give us general permission to use sub-processors to provide Doodali. The current list, with what each does and where, is in our privacy policy. Many are only used when you switch on the feature that needs them.

We put data protection terms in place with each sub-processor that are at least as protective as this agreement, and we stay responsible to you for them. Before adding or replacing a sub-processor we’ll update the list and tell you by email or in the app, giving you the chance to object. If you object on reasonable data protection grounds and we can’t resolve it, you may close your account and we’ll refund any amount you’ve paid in advance for the time after you leave.

7. International transfers

Where personal data is transferred outside the UK, we make sure it’s protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses.

8. Helping you

• People’s rights: Doodali lets you find, correct, export and delete the data you hold about a person. If we receive a request directly, we’ll pass it to you, and help you respond where you need it.
• Breaches: if we become aware of a personal data breach affecting your data, we’ll tell you without undue delay, and within 48 hours, with what we know and what we’re doing about it, so you can meet your own duties to report it.
• Impact assessments: we’ll give you reasonable help with data protection impact assessments and with any consultation with the Information Commissioner’s Office.

9. When you leave

You can export your data at any time from Settings → Import and export. When you close your account or delete a business, we delete its personal data from the live system straight away, and it drops out of our backups within about eight weeks, unless the law requires us to keep it (for example billing records, which we keep for six years).

10. Information and audits

We’ll give you the information you reasonably need to show that this agreement is being followed, including answering security questionnaires. Where that isn’t enough, we’ll allow an audit by you or an independent auditor you appoint, on reasonable notice, at most once a year, at your cost, and under a confidentiality agreement.

11. General

This agreement lasts as long as we process personal data for you. The limits of liability in our terms apply to it. If this agreement and the terms disagree about personal data, this agreement wins. It’s governed by the law of England and Wales.