This addendum forms part of the Terms of Service between you (the customer, as controller) and DOTWICK INC (as processor) for personal data we process on your behalf. Enterprise customers can ask for a countersigned copy.
01Scope and roles
You are the controller of personal data in your Workspace and of data collected through your codes. We process it only to provide the service and on your documented instructions, which are these terms, this addendum and your use of the product settings.
02Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing Dotwick: codes, redirects, Hosted Pages, analytics, exports and email |
| Duration | The term of your subscription, plus the deletion period in section 8 |
| Data subjects | People who scan your codes; people who submit forms on your Hosted Pages; visitors to a website where you install the Dotwick pixel; people who share their details through a business card’s lead form; your Workspace members; contacts you publish on vCard pages and business cards |
| Personal data | Scan events (time, code, approximate city and country, device, OS, browser, a daily-salted visitor hash — never the IP address); form submissions; pixel events (a signed click identifier, an event name, an order value and number, the page’s host and path, a daily-salted visitor hash — never a name or an email address); business card lead details; contact details you publish; member names and emails |
| The conversion pixel | If you install the pixel you are the controller for it and must say so in your privacy notice; our documentation gives a paragraph you can copy. By default it waits for the visitor’s consent, it treats a Global Privacy Control signal as a refusal, it sets one first-party cookie that holds only a click identifier, and the service refuses personal data in every field. Turning off the consent requirement is your statement that you have another legal basis, and we record the change in your audit log |
| Special categories | Not intended. Do not collect them through Dotwick forms |
03Our obligations
- process personal data only on your instructions, and tell you if we think an instruction breaks the law
- make sure everyone with access is bound by confidentiality
- help you answer requests from data subjects and with impact assessments, taking into account what we can see
- not sell the data or use it for our own purposes beyond running and securing the service
04Security measures
- TLS for all traffic; encryption at rest by our hosting providers
- no raw IP addresses stored for scans; unique devices counted with a daily-salted hash
- role-based access in Workspaces, two-factor authentication for accounts
- limited, logged staff access through a separate staff console, with an append-only audit log
- regular database backups, kept in encrypted object storage
05Sub-processors
You authorise the sub-processors below. We will give at least 30 days’ notice of a new one by email or in the app; you may object on reasonable grounds, and if we cannot address the objection you may end the affected service.
| Provider | What it does for Dotwick | Where | Status |
|---|---|---|---|
| Cloudflare | DNS, CDN and firewall, TLS for custom domains, R2 file and backup storage, the status page, approximate scan location | Global edge; R2 storage in the EU | in use |
| Railway | Hosting for the API, background workers, Postgres, Redis and ClickHouse | EU (Amsterdam) | in use |
| Vercel | Hosting for the website and the web app | EU (Frankfurt); global edge | in use |
| Resend | Sending email: sign-in links and codes, invitations, exports, reports | EU | in use |
| Sign in with Google (only if you choose it) | United States | in use | |
| Stripe | Payments and invoices for paid plans | United States, EU | in use |
| Google Web Risk | Checking code destinations against lists of unsafe sites | United States | in use |
| Anthropic | AI features: brand from a website, design suggestions, the analytics assistant and page drafts. No personal data is sent | United States | in use |
| Sentry | Error reports from the app and the API | EU | in use |
| Better Stack | Uptime monitoring and alerts, and the uptime figures on the status page | EU | in use |
| GitHub | Runs the daily backup jobs: database backups and copies of uploaded files pass through its machines on the way to storage and are not kept there | United States | in use |
06Personal data breaches
We will tell you without undue delay after becoming aware of a breach affecting your data, with what we know, what we are doing about it, and a contact for updates.
07International transfers
Where data leaves the European Economic Area, the United Kingdom or Switzerland, transfers rely on the Standard Contractual Clauses (or the UK addendum), which are incorporated by reference.
08Return and deletion
You can export your data at any time. Ending a paid plan deletes nothing: the Workspace moves to the Free plan. When you close the Workspace we delete its data within 30 days, except where the law requires us to keep it, and backups expire on their normal schedule.
09Audits
We will make available the information reasonably needed to show compliance with this addendum. Enterprise customers can request a security review questionnaire and our standard security pack.
Questions about these documents
Write to legal@dotwick.com. For a signed DPA or a security review, our Enterprise team can send the standard pack.
Security practices, the sub-processors and where SOC 2 stands: Dotwick Trust