Data Processing Addendum

1. Roles

This DPA applies when dicimint processes personal data on behalf of a customer. The customer is the controller; dicimint is the processor, unless a self-hosted deployment makes the customer the operator.

2. Subject matter and duration

Processing covers hosting, storage, collaboration, review workflows, notifications and support for the duration of the subscription plus the deletion window.

3. Instructions

We process personal data only on documented instructions from the customer, including the configuration of the workspace and the features the customer enables.

4. Confidentiality

Personnel with access to customer data are bound by confidentiality and access it only as needed to provide or secure the service.

5. Security measures

Measures include workspace isolation, role-based access, encryption in transit, private object storage, audit logging, backups and a documented incident response process.

6. Subprocessors

The customer authorizes the subprocessors listed in the current subprocessor schedule. We notify the customer before adding a new subprocessor and give an opportunity to object.

7. International transfers

Where data leaves the customer's region, we rely on an appropriate transfer mechanism, such as standard contractual clauses, and document it in the schedule.

8. Data subject requests

We assist the customer in responding to access, correction, deletion and portability requests, taking into account the nature of the processing.

9. Breach notification

We notify the customer without undue delay after becoming aware of a personal data breach, with the information needed to meet the customer's own obligations.

10. Deletion and return

On termination, the customer may export content during the stated window. After that, we delete or anonymize personal data unless law requires retention.

11. Audit

We provide the information reasonably needed to demonstrate compliance, including security documentation and, where agreed, a review of controls.

12. Contact

To request the current DPA with schedules: hello@dicimint.com.

Questions about this document: hello@dicimint.com.