This Data Processing Agreement (“DPA”) is between the business customer that owns a DoTally workspace (the “Customer“) and Disrupt EOOD (Дисрапт ЕООД), 86 Slavyanska Str., Blagoevgrad 2700, Bulgaria, EIK 205368450 (“DoTally“). It forms part of the Terms of Service (the “Terms“) and applies whenever DoTally processes Customer Personal Data. If the DPA and the Terms conflict, the DPA prevails on data protection matters.

A signed copy is available on request from awesome@dotally.app.

1. Definitions

Data Protection Laws: the EU General Data Protection Regulation 2016/679 (“GDPR“), the Bulgarian Personal Data Protection Act, the UK GDPR and Data Protection Act 2018, Swiss data protection law, and any other data protection law that applies to the processing.
Customer Personal Data: personal data that DoTally processes on the Customer’s behalf to provide the Team Features, as described in Annex I.
Team Features: the workspace features used by Administrators and Managers (team overviews, Team Health & Insights, member profiles, Team App Usage, Custom Reports and the team digest); the Leaderboard (Team Professional) and the Timeboard, which everyone on the team sees; and AI Chat, which everyone on the team can use.
Member-Controlled Data: each Member’s own account, profile and Activity Data, for which DoTally is a controller under its Privacy Policy.
Sub-processor: a third party DoTally engages to process Customer Personal Data.
“Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR.

2. Roles

2.1 Customer as controller. For the Team Features, the Customer is the controller and DoTally is its processor.

2.2 DoTally as controller. For Member-Controlled Data, account administration, billing, security and legal compliance, DoTally is an independent controller, and its Privacy Policy applies.

2.3 Why the split. In DoTally, each Member owns their own data. They decide what gets logged, whether named app detail is shared, and can have their account deleted at any time. The Customer’s Administrator deletes a Member’s account in DoTally, which deletes it in full. The Customer decides how its workspace uses what it’s allowed to see. This DPA governs that second part.

3. Customer instructions

3.1 DoTally processes Customer Personal Data only on the Customer’s documented instructions, unless the law requires otherwise. If so, DoTally will tell the Customer first, unless the law forbids that.

3.2 Documented instructions. The Customer’s instructions are these Terms, this DPA, and the Customer’s use and configuration of DoTally (for example, its plan, roles and window-title retention period).

3.3 Standing instructions about Members’ choices. The Customer instructs DoTally, as a permanent part of the service, to:

(a) show named app, window and tab detail about a Member to Administrators and Managers only while that Member has App Sharing turned on, and apply the same rule to AI Chat and Custom Reports;

(b) when a Member’s account is deleted, whether by the Member or by the Customer’s Administrator, delete that Member’s data from the Team Features straight away, including Custom Reports about them, and remove them from Custom Reports that compare them with others. Custom Reports the Member created stay with the workspace.

The Customer acknowledges that it can’t change these instructions through DoTally.

3.4 DoTally will tell the Customer if it believes an instruction breaks Data Protection Laws.

4. Customer responsibilities

The Customer is responsible for:

(a) having a lawful basis for its use of the Team Features;

(b) giving people in its workspace the information required by Articles 13 and 14 GDPR about its use of DoTally;

(c) any duty to consult employee representatives, adopt internal rules (including those required by the Bulgarian Personal Data Protection Act for working-time systems), or carry out a data protection impact assessment;

(d) respecting App Sharing as a free choice, as set out in section 9 of the Terms.

5. DoTally’s obligations

DoTally will:

(a) process Customer Personal Data only for the purposes in Annex I;

(b) make sure everyone authorized to process it is bound by confidentiality;

(d) use Sub-processors only as set out in section 6;

(e) help the Customer respond to data subject requests (section 7);

(f) help the Customer with security, breach notifications, data protection impact assessments and prior consultations with authorities (Articles 32–36 GDPR), taking into account the nature of the processing and the information available to DoTally;

(g) delete Customer Personal Data at the end of the service (section 10);

(h) give the Customer the information needed to show compliance with Article 28 GDPR (section 11).

DoTally won’t sell Customer Personal Data or use it for advertising. It won’t use it for its own purposes, except:

(a) to keep DoTally secure and working; and

(b) to improve DoTally’s classification system for all customers, using classification examples made from the role, industry, app name and window title (URLs, email addresses, keys and tokens removed), stored with the app name, the classification label, the role and a short site or tab name, but not the window title itself. Examples are shared across customers, without names, email addresses or workspace IDs, so one Member’s corrections can influence how the same app or window title is classified for other customers.

For (b), DoTally acts as an independent controller, and the Customer authorizes this use. Examples from a Member are removed when that Member’s account is deleted.

6. Sub-processors

6.1 The Customer gives DoTally general authorization to use the Sub-processors listed in Annex III.

6.2 DoTally will give at least 30 days’ notice before adding or replacing a Sub-processor, by email to the workspace Administrator and by updating Annex III. The Customer may object on reasonable data protection grounds within that period. If the parties can’t resolve the objection, the Customer may end the affected service and receive a refund of any prepaid fees for the remaining period.

6.3 DoTally will put a written contract in place with each Sub-processor that gives at least the same protection as this DPA, and it stays responsible for its Sub-processors’ performance.

7. Data subject requests

Members can see their own data in DoTally, get a copy of it by emailing DoTally, and have their account deleted by the Customer’s Administrator. If DoTally receives a request about the Team Features that’s meant for the Customer, it will pass it to the Customer without undue delay and won’t respond itself, except to direct the person to the Customer or where the request concerns Member-Controlled Data.

8. Personal data breaches

DoTally will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include what DoTally knows at the time (the nature of the breach, categories and approximate numbers of people and records, likely consequences, and the measures taken or proposed) and will be updated as more becomes known. Notifying the Customer is not an admission of fault.

9. International transfers

9.1 DoTally stores Customer Personal Data and runs its API and web app in the EU (Frankfurt, Germany). Sub-processors that are US companies or process it outside the EEA are listed in Annex III. For those transfers, DoTally relies on an adequacy decision (including the EU–US Data Privacy Framework, where the Sub-processor is certified) or on the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Three, together with any additional safeguards that are needed.

9.2 Where the Customer is outside the EEA and DoTally transfers Customer Personal Data to it, the Standard Contractual Clauses Module Four apply, to the extent required.

9.3 For UK data, the UK International Data Transfer Addendum applies. For Swiss data, the Standard Contractual Clauses apply with the changes required by Swiss law.

10. Deletion at the end of the service

When the Customer’s subscription ends, DoTally keeps the workspace’s Customer Personal Data for 12 months, so the Customer can export or reactivate, and emails the Customer’s Administrator at least 30 days before deleting it permanently. If the Customer deletes its workspace, DoTally keeps it for 30 days, during which it can be restored by emailing awesome@dotally.app, then deletes it permanently. Backups are overwritten within 7 days. DoTally may keep data only where the law requires. Member-Controlled Data stays with each Member’s own account under the Privacy Policy. A Member’s account deleted during the subscription is deleted straight away, as set out in section 3.3(b).

11. Information and audits

DoTally will make available, on request, the information reasonably needed to show compliance with this DPA, including written answers to security questionnaires (once a year). If that isn’t enough, or a supervisory authority requires it, the Customer may audit DoTally once a year, with at least 30 days’ notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and in a way that doesn’t disrupt the service or expose other customers’ data.

12. Liability and term

Each party’s liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws don’t allow those limits. This DPA lasts as long as DoTally processes Customer Personal Data. It is governed by the law of the Republic of Bulgaria, with disputes resolved as set out in the Terms.

Annex I — Details of processing

Controller

The Customer, as identified in its workspace and billing details

Processor

Disrupt EOOD, 86 Slavyanska Str., Blagoevgrad 2700, Bulgaria · awesome@dotally.app

Subject matter

Providing the Team Features of DoTally to the Customer

Duration

The term of the Customer’s subscription, plus the deletion period in section 10

Nature and purpose

Storing, aggregating, analyzing and showing Members’ logged activity to the Customer’s Administrators and Managers; calculating team scores, health signals and rankings; generating Custom Reports (PDF); answering questions in AI Chat from everyone on the team; sending the team digest

Data subjects

Members of the Customer’s workspace (typically employees and contractors), and the Customer’s Administrators and Managers

Categories of data

Name, email, profile picture, role, job title, industry; logged activity (app names, window and tab titles of up to 100 characters, start and end times, away periods and reasons, manual time entries and their descriptions); scores, classifications, trends and health signals (including Burnout Risk); App Sharing status; AI Chat questions and answers; Custom Report contents

Special categories

None intended. Window titles are free text and may occasionally reveal sensitive information. Members can review and leave out activity before logging it

Frequency

Continuous, for as long as the workspace is active

Retention

Window titles and manual time descriptions are removed after 24 months by default (the Customer can choose 1, 3, 6, 12, 24 or 36 months). AI Chat conversations are deleted 90 days after their last message, or sooner if the person who started them deletes them, their role changes to Member, or their account is deleted. Custom Reports are kept until deleted or until the account of the Member they’re about is deleted; reports a Member created stay with the workspace after their account is deleted. See also section 10

Annex II — Technical and organizational measures

Encryption: TLS in transit, and encryption at rest for the database and file storage.
Data minimization at source: activity is captured locally and sent only when the Member logs it; unlogged activity is deleted from the Member’s computer after 90 days. No screenshots, keystrokes, clipboard contents or URLs are ever captured. Window titles are shortened to 100 characters. URLs, email addresses, keys and tokens are removed from titles before AI processing.
Access control: role-based access (Administrator, Manager, Member). App Sharing is enforced on every view, including AI Chat and Custom Reports. Access to production systems is limited to authorized DoTally personnel.
Authentication: passwords are hashed. Web and desktop sessions use short-lived tokens that renew automatically; the desktop app keeps its token in the operating system’s secure credential store and is signed out after a password change or when the account is deleted. Google sign-in is available.
Data location: the main database, file storage, API and web app are in the EU, in Frankfurt, Germany.
Retention controls: configurable window-title retention, immediate and complete deletion of an account when it’s deleted, and deletion of a workspace’s data 12 months after the service ends.
AI processing: OpenAI processes data under the OpenAI Data Processing Addendum signed with OpenAI Ireland Ltd. API data isn’t used for training. OpenAI keeps abuse-detection logs for up to 30 days. URLs, emails, keys and tokens are removed from window titles before they’re sent. In the team digest, people are labelled “Member A”, “Member B” and so on.
Resilience: the database is backed up daily; backups are kept for 7 days.
Incident response: breaches are assessed and notified as set out in section 8.

Annex III — Sub-processors

Sub-processor

Purpose

Location

Transfer safeguard

Supabase, Inc.

Database, file storage and live page updates (account ID and IP address only, nothing stored)

Frankfurt, Germany; live updates on a global network

DPF / SCCs

Vercel Inc.

API and web app hosting; cookie-free web-app analytics

Frankfurt, Germany

DPF / SCCs

Functional Software, Inc. (Sentry)

Error reports from the API and web app; names, emails, app names and window titles removed

EU (Germany)

DPF / SCCs

OpenAI Ireland Ltd. (processing through OpenAI OpCo, LLC and its affiliates)

AI app classification, insights, AI Chat answers, team digest. Data: job title, industry, app names and window titles with URLs, emails and keys removed; AI Chat questions, first names and the activity looked up, which can include app names and window titles; weekly digest summaries (a Member’s scores, hours and most-used app names; pseudonymised team totals). No training; abuse logs up to 30 days

Mainly United States; OpenAI’s own sub-processors (cloud providers, CDN and content-moderation providers, listed at platform.openai.com/subprocessors) in the US, EU and other countries

2021 EU SCCs (Module Three) under the OpenAI DPA. OpenAI isn’t relied on as DPF-certified

Pinecone Systems, Inc.

Classification examples, shared across customers

United States

DPF / SCCs

Plus Five Five, Inc. (Resend)

Sends DoTally’s emails. Data: name, email address and email content; opens (approximate, through a tracking image) on every email, and link clicks only on after-trial, win-back and What’s new emails; contacts for the What’s new email (email address, first and last name, and whether they unsubscribed)

United States; emails are sent from Ireland

DPF / SCCs

Stripe

Billing (Administrator data only)

EU and United States

DPF / SCCs

Google

Sign-in (if used)

United States

DPF

Cloudflare, Inc.

Bot check (Cloudflare Turnstile) on the web app’s Log in, Sign up and Forgot password pages. Data: IP address and browser signals; no account data