Data processing addendum

This applies where you are a controller of personal data and we process it for you — which for an agency using Dispatch on behalf of its clients is the normal case. It forms part of the terms between [registered name] and you, and takes precedence over them on anything about personal data.

Roles

You are the controller. We are the processor. Where you are yourself a processor for your own client, we are the sub-processor and this addendum flows down: the same obligations apply to us that apply to you.

Scope

Your instructions

The panel and these terms are your documented instructions. We process only on them, and we will tell you if we believe an instruction breaks data protection law rather than carrying it out quietly.

Our obligations

• Process only on your documented instructions.
• Bind everyone with access to confidentiality.
• Keep the measures below, and not weaken them during the term.
• Help you answer a person's rights request. Export and erase are already self-service, so most of this needs nothing from us.
• Help you with impact assessments and with consulting a regulator, given the information we hold.
• Tell you without undue delay of any personal data breach, and within 72 hours of becoming aware, with what we know at the time.
• Delete or return everything on termination — erase is a button, and it genuinely deletes, including the files on disk. It reports honestly what it could not clear rather than a cheerful zero.
• Allow an audit no more than once a year on 30 days' notice, at your cost, or provide a report in its place.

Measures actually in place

Written as what the software does, not as what a certificate says. The current list, and everything not held, is on the security page.

• LinkedIn tokens encrypted at rest and authenticated on read; a tampered record fails rather than decrypting to nonsense.
• Passwords hashed with scrypt, salted per user.
• Every account isolated by an account tree enforced in one place, and tested by enumerating every route the application exposes and attacking each one with an identity that must not reach it — so a route added later without a check fails without anyone remembering to test it.
• Refusals never confirm whether an account exists.
• Sign-in throttled on both the address and the network address.
• An append-only audit log that nothing in the system updates or deletes.
• Encrypted transport, and a session cookie that is HttpOnly and SameSite.
• Deletion on a schedule, per table, with a written reason for each — and a check that fails if a table exists with no rule.
• Nightly backup of the database and the graphics together, kept 30 days.

Sub-processors

Hosting, mail, and LinkedIn for the publishing itself. Each is named, with its region, on the security page, which is generated from the running system rather than maintained separately. We will give 30 days' notice before adding one, and you may object on reasonable data protection grounds; if we cannot resolve it, you may end the account and we will refund the unused part of the period.

Transfers

Where personal data leaves the region named on the security page, the transfer relies on the standard contractual clauses or on an adequacy decision, whichever applies to that provider.

Liability

The limits in the terms apply to this addendum as well, except where the law does not permit them.

Ending

This addendum lasts as long as we process personal data for you. On termination you may export everything for 30 days, after which we delete it. You can erase it yourself at any time and it happens immediately.