Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Customer") and Tiny Tugboat (Pty) Ltd ("Tiny Tugboat", "we") for Dockli: our Terms of Use, the EULA, and any order or partner quote (together, the "Agreement"). It applies when we process personal data on the Customer's behalf. If you need a signed copy, email support@dockli.io and we'll countersign this version.

1. Roles

For personal data processed to provide Dockli to the Customer's users ("Customer Personal Data"), the Customer is the controller (the "responsible party" under POPIA) and Tiny Tugboat is the processor (the "operator" under POPIA). Where we process personal data for our own purposes, such as billing, account management, security and improving Dockli with content-free usage data, we do so as an independent controller under our Privacy Policy.

2. Instructions

We process Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA and the Customer's use and configuration of Dockli are those instructions. If we believe an instruction breaks data protection law, we'll tell the Customer. We won't sell Customer Personal Data or use it to train AI models.

3. Details of the processing

• Subject matter and purpose: providing, securing and supporting Dockli (the Windows app, Web App, Teams app, Dockli AI and dictation, and licensing).
• Duration: the term of the Agreement, plus the deletion period in section 10.
• Nature: hosting, storage, transmission, retrieval through Microsoft Graph on the user's behalf, AI processing, and deletion.
• Data subjects: the Customer's users and administrators, and people whose details appear in content those users work with in Dockli.
• Categories of data: identifiers (name, email address, Microsoft Entra tenant and user ids); Web App settings, favourites, skills and sign-in caches; licence and usage records; content that users ask Dockli AI or dictation to process (prompts, the text Dockli AI reads to answer, answers, dictated audio).
• Special categories: not intended. Dockli doesn't ask for them, but users may include them in content they process. The Customer decides whether that is appropriate.

4. Confidentiality

Only Tiny Tugboat staff who need access to run or support Dockli can access Customer Personal Data, and they are bound by confidentiality.

5. Security

We protect Customer Personal Data with the technical and organisational measures in Annex 1, and review them at least once a year. We may improve them over time but won't lower the overall level of protection.

6. Sub-processors

The Customer gives general authorisation for the sub-processors listed on our Sub-processors page. We bind each one by written terms that protect personal data at least as well as this DPA, and we remain responsible for them. We'll update that page at least 30 days before adding or replacing a sub-processor (except in an emergency affecting security or availability). The Customer may object on reasonable data protection grounds within that period; if we can't resolve it, the Customer may end the affected part of the service and receive a pro-rata refund of prepaid fees for it.

7. Where data is processed and international transfers

Dockli's services and data are hosted in Microsoft Azure in the European Union (Sweden Central). Dockli AI and dictation run there too, and email is sent from Microsoft's European data centres. The Sub-processors page lists where each sub-processor works. Tiny Tugboat staff in South Africa may access data to support the service. Where personal data leaves the EEA, the UK or South Africa, we make sure an approved safeguard is in place, such as the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), or the conditions in section 72 of POPIA.

8. Helping the Customer

• Data subject requests: we'll pass on any request we receive about Customer Personal Data and help the Customer respond, taking into account what Dockli lets the Customer do itself.
• Assessments: we'll give reasonable information for the Customer's data protection impact assessments and consultations with regulators about Dockli.

9. Personal data breaches

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data, we'll tell the Customer without undue delay and in any case within 48 hours. We'll describe what happened, the data and people likely affected, the likely consequences and what we're doing about it, and keep the Customer updated as we learn more.

10. Deletion and return

When the Agreement ends, the Customer can export what Dockli lets it export. We delete Customer Personal Data from our active systems within 30 days of the end of the Agreement, or sooner on request, and it ages out of backups within 35 days after that, unless the law requires us to keep it. Content-free usage records age out as described in our Privacy Policy. Content in the Customer's Microsoft 365 stays in the Customer's tenant and isn't affected.

11. Information and audits

We'll make available the information reasonably needed to show we meet this DPA, including answers to security questionnaires and our security documentation. If that isn't enough, the Customer (or an independent auditor bound by confidentiality) may audit our compliance once a year, with at least 30 days' notice, during business hours, at the Customer's cost, and without access to other customers' data or to our providers' facilities. Microsoft's own audit reports for Azure are available from Microsoft.

12. General

Liability under this DPA is subject to the limits in the Agreement, except where the law doesn't allow that. If this DPA conflicts with the Agreement, this DPA wins on data protection matters; Standard Contractual Clauses, where they apply, win over both. This DPA is governed by the law that governs the Agreement (South Africa), except where the Standard Contractual Clauses require otherwise.

Annex 1: Technical and organisational measures

Data minimisation and architecture

• Dockli works on Microsoft 365 through Microsoft Graph with the signed-in user's own permissions. It can't see more than that user, and it never widens anyone's access.
• File content stays in Microsoft 365. The Web App passes file content through memory when you open, preview or upload, and doesn't write it to disk.
• Text from documents attached to Dockli AI is held in memory only, for about three hours.
• Dockli AI chat history is stored on the user's device, not on our servers.
• Usage analytics and AI usage metadata contain no prompts, answers, file content or file names.

Identity and access

• Users sign in with Microsoft. Dockli never sees or stores passwords. In the Web App, access tokens stay on the server and the browser holds only a secure, HttpOnly session cookie.
• Each user's Web App data is isolated from every other user and tenant.
• Staff sign in to Dockli's internal tools with Microsoft Entra ID. Access is limited to the people who run and support Dockli.
• Dockli's services sign in to Azure OpenAI and Azure Speech with Azure managed identities, so no AI or Speech keys are held by the apps.

Encryption

• All traffic uses HTTPS with TLS 1.2 or later.
• Databases are encrypted at rest (Azure SQL transparent data encryption).
• On Windows, the sign-in cache is encrypted for the Windows user (DPAPI) and the local service listens only on that PC.
• The Windows app is code-signed.

Operations

• Changes are tested on separate staging environments, which use made-up sample data, before they reach production.
• Production databases have point-in-time restore.
• Secrets are kept in Azure Key Vault or platform settings, never in source code. Source code is in private repositories.
• We keep a documented security programme, including a risk register, and review these measures at least once a year.

Annex 2: Sub-processors

See the Sub-processors page.