Data processing addendum

1. Definitions

“Data protection law” means every law that applies to the processing, including the GDPR, the UK GDPR, India's Digital Personal Data Protection Act 2023 (“DPDP Act”) and the California Consumer Privacy Act as amended (“CCPA”). “Brand personal data” means the personal data described in Annex I. Words such as controller, processor, data subject, personal data breach, data fiduciary, data processor, service provider, sell and share have the meaning those laws give them.

2. Roles and instructions

• The brand is the controller (data fiduciary, business) and Dropp is its processor (data processor, service provider) for brand personal data.
• Dropp processes brand personal data only on the brand's documented instructions. The terms, this DPA, the brand's settings in the dashboard and its SDK and API calls are those instructions. Dropp will tell the brand if it believes an instruction breaks data protection law.
• If the law requires Dropp to process brand personal data in any other way, Dropp will tell the brand first, unless the law forbids it.
• The brand is responsible for the lawfulness of its instructions and for having a lawful basis, notices and any consent needed (terms, section 5).

3. Confidentiality

Dropp ensures that everyone it allows to process brand personal data is bound by confidentiality and has access only as far as their work needs it.

4. Security

Dropp keeps the technical and organisational measures in Annex II, which are designed to give a level of security appropriate to the risk. Dropp may change them, as long as the overall level of security isn't reduced.

5. Sub-processors

• The brand gives general authorisation for Dropp to use sub-processors. The current list is in Annex III.
• Dropp will give at least 30 days' notice of a new or replacement sub-processor, by updating the sub-processors page and emailing account owners. The brand may object on reasonable data protection grounds within that period by writing to [email protected]. If we can't resolve the objection, the brand may end the affected part of the service and get a refund of fees prepaid for it.
• Dropp puts data protection terms in place with each sub-processor that protect brand personal data at least as much as this DPA, and remains responsible for its sub-processors.

6. Help with requests and assessments

• Data subject requests. Dropp gives the brand tools to answer requests: the user deletion API (DELETE /v1/s2s/users/:userId), the Install debugger and the Users pages. For anything those don't cover, Dropp helps on request to [email protected] and replies within 30 days. If Dropp receives a request directly, it passes it to the brand and doesn't answer it itself, unless the brand asks.
• Assessments. Dropp gives the brand the information it reasonably needs for data protection impact assessments and prior consultations with authorities, about Dropp's processing.

7. Personal data breaches

Dropp tells the brand about a personal data breach affecting brand personal data without undue delay, and within 48 hours of becoming aware of it, by email to the account owner. The notice says what happened, the data and people likely affected, the likely consequences and what Dropp is doing about it. Information not available at first follows as soon as it is. Dropp helps the brand meet its own duties to notify authorities (including the Data Protection Board of India) and data subjects. Notifying is not an admission of fault.

8. Deletion or return

Data is deleted on the schedule in Annex I while the service runs. When the agreement ends, the brand can ask for an export within 30 days. After that, Dropp deletes brand personal data within 60 days, including from active systems, unless the law requires it to keep some. Backups are overwritten on their normal cycle and are not restored except to recover the service.

9. Audits

Dropp makes available the information needed to show it meets this DPA, mainly through this DPA, its annexes, the security page and written answers to reasonable security questionnaires (once a year, or after a breach). If that isn't enough to meet a legal requirement, the brand may ask for an audit: with 30 days' notice, during working hours, at the brand's cost, under confidentiality, and no more than once a year unless an authority requires it. Dropp holds no security certifications today.

10. CCPA service-provider terms

For personal information of California residents (and under similar US state laws), Dropp:

• doesn't sell or share it (including for cross-context behavioural advertising);
• doesn't keep, use or disclose it for any purpose other than providing the service to the brand (the business purposes in Annex I), or outside the direct business relationship with the brand;
• doesn't combine it with personal information from other brands or sources, except as the CCPA allows a service provider to;
• meets the CCPA's obligations and gives it the same level of protection the CCPA requires, and tells the brand if it can no longer do so;
• lets the brand take reasonable steps to stop and fix unauthorised use.

11. DPDP Act processor terms

Under the DPDP Act the brand is the data fiduciary and Dropp is its data processor. Dropp processes digital personal data only under this contract and for the purposes in Annex I, keeps reasonable security safeguards (Annex II), tells the brand of a breach as in section 7, helps the brand answer data principals' requests and grievances, and erases the data when the brand asks or the purpose is served, as in section 8. The brand remains responsible for notice, consent and the rights of data principals.

12. International transfers

• Brand personal data is stored in India. Sub-processors in other countries are listed in Annex III.
• Where brand personal data from the EEA or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module 2 (controller to processor) where the brand is a controller, and Module 3 (processor to processor) where the brand is itself a processor. Clause 7 (docking) applies; in Clause 9, option 2 (general authorisation) with the notice in section 5; in Clause 11 the optional language doesn't apply; in Clauses 17 and 18 the law and courts of Ireland. Annexes I to III of this DPA complete the clauses' annexes.
• For transfers from the UK, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0, issued by the Information Commissioner) is incorporated by reference, with Tables 1 to 3 completed from this DPA and either party able to end it as allowed in Table 4. For Switzerland, references to the GDPR mean the Swiss FADP.
• If these clauses and this DPA conflict, the clauses win.

13. General

This DPA lasts as long as Dropp processes brand personal data. Liability under it is subject to the limits in the terms, except where data protection law doesn't allow them. It is governed by the law that governs the terms, except where the Standard Contractual Clauses say otherwise.

Annex I. Details of the processing

A. Parties

B. Description of the transfer and processing

C. Retention

D. Competent supervisory authority

For the EEA: the authority of the member state where the brand is established or, if it has none in the EEA, where its EU representative is. For the UK: the Information Commissioner's Office.

Annex II. Security measures

What Dropp does today. We list only measures in place.

• Encryption in transit: TLS on every connection to the dashboard, the API, link domains and between our servers and the database.
• Encryption at rest: by our database provider, MongoDB Atlas.
• Access control: production access limited to the people who need it; dashboard access by role (owner, admin, manager) within each brand; each brand sees only its own data.
• Keys: SDK requests are signed with HMAC-SHA256 and a timestamp; server keys and secrets are shown once and can be revoked at any time.
• Data minimisation: no raw IP addresses (salted hashes, salts deleted after 9 days); email and phone hashed on the device; event properties containing emails or phone numbers dropped; no advertising ids, contacts or precise location.
• Retention: automatic deletion on the schedule in Annex I.
• Audit log: every change to a project's apps, keys, domains and funnels is recorded with who made it and when, and shown to the brand.

Annex III. Sub-processors

The current list, with each sub-processor's purpose and location, is on the sub-processors page, which forms part of this annex.