Data Processing Addendum

This DPA forms part of the Process Street Terms of Service for the use of Dash. It applies where you are a controller and we are a processor of personal data under the GDPR, UK GDPR, and similar laws.

Roles and scope

You are the data controller. We are the processor. We process personal data only on your documented instructions, primarily through the actions Dash performs in your workspace.

Data subjects and categories

We process personal data of your end users, employees, and contacts. Categories include: identifiers (names, emails, user IDs), professional information (job titles, company), and content of communications you direct Dash to handle.

Security measures

We maintain technical and organizational measures appropriate to the risk, including: encryption at rest (AES-256) and in transit (TLS 1.2+), access controls based on least privilege, audit logging, vendor management, incident response procedures, and annual security review of all sub-processors.

Sub-processors

You authorize the sub-processors listed at /security. We will give 30 days notice before engaging any new sub-processor, and you may terminate Dash if you object on reasonable grounds.

International transfers

Where data is transferred from the EEA, UK, or Switzerland to the US, we rely on Standard Contractual Clauses. EU data residency is available on the Enterprise plan.

Data subject requests

We assist you in responding to data subject requests within 7 business days. We will not respond directly to data subjects without your authorization.

Breach notification

We notify you of any personal data breach without undue delay, and no later than 72 hours after becoming aware, with all reasonable information needed for your own reporting obligations.

Deletion

On termination, we delete or return all personal data within 30 days, subject to legal retention requirements.

Signing the DPA

Email [email protected] to request the signed PDF version of this DPA.

This is a v0 placeholder pending legal review. Final DPA will be published before public launch.