# Data processing addendum

> Processor terms under Art. 28 GDPR, with annexes.

Source: https://docs.usejot.co/docs/legal/dpa

This Data Processing Addendum (DPA) forms part of the agreement between the
customer (**controller**) and Jot (**processor**), as identified in the
[Terms of service](/docs/legal/terms), and applies wherever Jot processes
personal data of the customer's end users. Questions: **[privacy@usejot.co](mailto:privacy@usejot.co)**.

## Processor obligations (Art. 28(3)(a)–(h))

Jot shall:

* **(a)** process personal data only on the customer's documented
  instructions, including regarding international transfers, unless required
  by law — in which case Jot informs the customer before processing unless the
  law forbids it;
* **(b)** ensure persons authorised to process the data are bound by
  confidentiality;
* **(c)** implement the technical and organisational measures in Annex II;
* **(d)** engage sub-processors only under the conditions in Annex III;
* **(e)** assist the customer, insofar as possible, in responding to data
  subject requests;
* **(f)** assist the customer with security, breach notification, DPIAs, and
  prior consultation obligations (Arts. 32–36);
* **(g)** at the customer's choice, delete or return all personal data at the
  end of the services, and delete existing copies unless law requires storage
  — per the deletion SLAs below;
* **(h)** make available all information necessary to demonstrate compliance
  and allow for and contribute to audits conducted by the customer or its
  mandated auditor.

## Breach notification

Jot notifies the customer of a personal data breach affecting their end users'
data **without undue delay and in any case within 48 hours** of becoming aware
of it, with the information the customer needs for its own Art. 33 obligations.

## Deletion SLAs

* Deleted organisation: 7-day grace period, then purge begins.
* Hard purge complete within **30 days** of deletion.
* Backups and point-in-time recovery snapshots: beyond use immediately, purged
  within **35 days**.

## International transfers

Where processing involves a transfer out of the EEA or UK, the parties
incorporate the EU Standard Contractual Clauses by reference — **Module 2**
(controller → processor) or **Module 3** (processor → processor) as
applicable — together with the UK Addendum where UK GDPR applies.

## Annex I — Description of processing

| Item               | Description                                                                                                |
| ------------------ | ---------------------------------------------------------------------------------------------------------- |
| Subject matter     | Collection and resolution of feedback on the customer's web application, including optional session replay |
| Duration           | The term of the agreement plus the deletion periods above                                                  |
| Nature and purpose | Capturing feedback reports and associated technical context so the customer can reproduce and fix issues   |
| Data subjects      | The customer's end users (reviewers, visitors to pages where the widget is deployed)                       |
| Data types         | Screen content subject to masking, DOM selectors, page URLs, IP address, user agent, interaction events    |

## Annex II — Technical and organisational measures

* TLS for all data in transit; encryption at rest for database and object
  storage.
* Masking by default: all inputs masked in the end user's browser before
  upload; passwords always masked; `.jot-block` / `.jot-mask` honoured;
  masking is never performed server-side.
* Access control: tenant isolation enforced and tested; role-based membership;
  the internal admin console on a separate origin with TOTP.
* Logging: admin actions and impersonation written to an audit log and to the
  customer's own activity feed; impersonation is read-only and time-boxed.
* Deletion procedures per the SLAs above.

## Annex III — Sub-processors

The current list is maintained at
[Sub-processors](/docs/legal/subprocessors). Jot notifies customers of
intended additions or replacements, and the customer may **object within 30
days** of notice on reasonable data-protection grounds; if the objection
cannot be resolved, the customer may terminate the affected services.