DataItemize Data Processing Addendum

Version: 2026-10-09 · Effective: 2026-10-09

This Data Processing Addendum ("DPA") is between Data Doodles Tech Pvt. Ltd., trading as Data Doodles Tech, a private limited company registered in Nepal, Baluwatar-03, Kathmandu, Nepal ("Provider"), and the business that uses DataItemize ("Customer"). It forms part of the DataItemize Terms of Service, or of any signed agreement for DataItemize between the parties (in either case, the "Agreement").

It takes effect automatically when Customer accepts the Agreement. A countersigned copy is available on request from support@datadoodlestech.com.

1. Definitions

Capitalised terms not defined here have the meaning given in the Agreement.

• Account Data means personal information about Customer's Authorised Users that Provider needs to run their accounts — name, email, password hash, phone number, memberships and roles, sign-in session records (IP address, user-agent, times) and preferences — and information about people who contact Provider for support or sales. Provider handles Account Data as an independent controller under its Privacy Policy. Account Data is not Personal Data under this DPA.
• Applicable Data Protection Laws means the privacy and data protection laws that apply to a party's processing of Personal Data under the Agreement, which may include Nepal's Individual Privacy Act, 2075 (2018) and, where applicable, the GDPR.
• Controller means the person who decides the purposes and means of processing personal data.
• Customer Data has the meaning given in the Terms of Service: the information Customer and its Authorised Users put into the Service.
• Data Subject means the identified or identifiable individual the Personal Data relates to.
• GDPR means the EU General Data Protection Regulation (2016/679) and, where applicable, the UK GDPR and the Swiss Federal Act on Data Protection.
• Information Security Incident means a breach of Provider's security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data. It does not include unsuccessful attempts that do not compromise Personal Data, such as failed sign-ins, pings or port scans.
• Personal Data means Customer Data that is personal data or personal information under Applicable Data Protection Laws. It includes, for example, details of Customer's customers, suppliers, employees and other contacts, and the audit-log entries kept for Customer's company.
• Process means any operation on Personal Data, such as collecting, storing, using, disclosing or deleting it.
• Processor means a person who processes personal data on behalf of a Controller.
• Subprocessor means a third party Provider engages to process Personal Data.

2. Roles and scope

2.1 For Personal Data, Customer is the Controller (or a processor acting for its own controller) and Provider is Customer's Processor.

2.2 For Account Data, Provider is an independent controller; its Privacy Policy applies.

2.3 Provider may also use audit-log and session records for its own purpose of keeping the Service secure. For that limited purpose it acts as a controller.

2.4 Annex 1 describes the processing. This DPA continues for as long as Provider processes Personal Data, even after the Agreement ends.

3. Customer's instructions

3.1 Provider will Process Personal Data only on Customer's documented instructions. Customer instructs Provider to Process Personal Data to provide, secure and support the Service under the Agreement, including as Customer directs through its use and configuration of the Service (for example, by setting up webhooks, API keys, imports, automation rules or the AI copilot).

3.2 Provider may also Process Personal Data where the law requires it. In that case Provider will tell Customer first, unless the law forbids that.

3.3 Provider will tell Customer if, in its opinion, an instruction breaks Applicable Data Protection Laws. Instructions outside the scope of the Service need a written agreement between the parties.

4. Confidentiality

Provider will make sure that its personnel who can access Personal Data are bound by confidentiality obligations. Access is limited to personnel with platform-administrator access who need it to provide support Customer asks for, operate and secure the Service, or comply with law. Changes they make inside Customer's company are recorded in Customer's audit log.

5. Security

5.1 Provider will implement and maintain the measures in Annex 3 ("Security Measures"). Provider may update them, but not in a way that materially reduces the overall protection of Personal Data.

5.2 Customer is responsible for using the Service securely, including: deciding who has access and with which role, business and warehouse scope; keeping passwords and API keys secure; securing its own devices (the web app keeps sign-in tokens in browser local storage); choosing safe destinations for webhooks; and keeping its own exports of records it must retain.

5.3 Customer has reviewed the Security Measures and agrees they are appropriate for the Personal Data it puts into the Service. The Service does not currently offer multi-factor authentication.

6. Information Security Incidents

6.1 Provider will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of an Information Security Incident. Provider will send the notice to the account owner's email address and any data protection contact Customer has given.

6.2 The notice will describe, as far as then known, what happened, the data and Data Subjects affected, the likely consequences, and the steps taken and recommended. Provider will update Customer as more becomes known and will reasonably cooperate with Customer's investigation.

6.3 Customer is responsible for deciding whether to notify authorities or Data Subjects, and for doing so, unless the law places that duty on Provider. Notifying or responding to an incident is not an admission of fault.

7. Data Subject requests

7.1 Customer can find, correct and export much of its Customer Data itself through the Service, and can archive records. Provider will give reasonable further help for Customer to respond to Data Subject requests, including permanent deletion of records under section 10.2 and copies of data not covered by in-app exports.

7.2 If Provider receives a request from a Data Subject about Personal Data, it will tell Customer promptly (unless the law forbids it) and refer the Data Subject to Customer, and will not respond itself except as Customer instructs or the law requires.

7.3 Help beyond the normal operation of the Service may be charged at our then-current hourly rate, quoted in advance, agreed in advance.

8. Customer's responsibilities

8.1 Customer is responsible for having a lawful basis for the Personal Data it puts into the Service and for giving Data Subjects any notices, and obtaining any consents, required by law.

8.2 Customer will not put the following into the Service without Provider's prior written agreement ("Restricted Data"): health or medical information, biometric data, genetic data, information about criminal records, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or sex life, payment card numbers, bank or other financial account credentials, passwords for other services, national identity document numbers or images, or personal data of children. Business tax registration numbers (such as PAN or VAT numbers) entered in the fields provided for them are not Restricted Data.

9. Subprocessors

9.1 Customer generally authorises Provider to use Subprocessors. The Subprocessors in use on the effective date are listed in Annex 4, which is also published in the Privacy Policy.

9.2 Provider will use only Subprocessors whose terms require them to protect Personal Data at least to the standard appropriate for the services they provide, and Provider remains responsible to Customer for their performance.

9.3 Before a new Subprocessor (including those marked "planned" in Annex 4) starts processing Personal Data, Provider will update Annex 4 and the Privacy Policy and email the account owner at least 15 days in advance. Customer may object on reasonable data-protection grounds within that period. The parties will try in good faith to resolve the objection; if they cannot, Customer may terminate the affected Services and receive a refund of any prepaid fees for the period after termination.

10. Return and deletion

10.1 During the Agreement. Customer can export its item catalogue and most reports as CSV or XLSX in the Service. On request, Provider will provide a copy of other Customer Data in a commonly used, machine-readable format within a reasonable time.

10.2 Deletion on request. Archiving or deleting records in the Service hides them but keeps them in the database. Stock ledger and audit-log entries cannot be changed or deleted through the Service. On Customer's written request (from the account owner), Provider will permanently delete the Personal Data specified, including from the stock ledger and audit log where needed, within 30 days.

10.3 After the Agreement ends. Customer's company becomes read-only or suspended; Personal Data is not deleted automatically. Within 90 days after the end of the Agreement Customer may ask for a copy of its Customer Data, deletion of it, or both. After that, the data is permanently deleted within a further 30 days, after the account owner has been emailed at least 14 days beforehand.

10.4 Backups. Deleted Personal Data can remain in the database provider's point-in-time backup history until it ages out, up to 7 days. Provider will not restore it from backups except to recover the Service, and in that case will re-delete it.

10.5 Legal retention. Provider may keep Personal Data where the law requires, only for as long as required, protected under this DPA and used only for that purpose.

10.6 On request, Provider will confirm deletion in writing.

11. Audits and information

11.1 Provider will make available the information reasonably needed to show that it complies with this DPA, including written answers to reasonable security questionnaires, once a year or when a competent authority requires it.

11.2 Where that information is not enough to meet Customer's legal obligations, Customer may audit Provider's compliance once a year, on at least 30 days' written notice, during business hours, under a confidentiality agreement, and at Customer's cost. Audits must not compromise the security of the Service or the confidentiality of other customers' data. Provider has no third-party certification (such as SOC 2 or ISO 27001) at present.

12. Location and transfers

12.1 Personal Data is stored in Singapore (database) and processed by application servers in Singapore. Provider is located in Nepal and its personnel may access Personal Data from Nepal. Provider's hosting provider is a US company and serves the web application through a global network. Annex 4 gives details.

12.2 Customer authorises these transfers. Where Applicable Data Protection Laws require a transfer mechanism, the parties will use the mechanism in Annex 2 (if it applies) or another mechanism they agree.

13. AI and automated processing

13.1 Provider will not use Personal Data to train, fine-tune or improve any AI or machine-learning model, its own or a third party's.

13.2 The optional AI copilot is off unless Provider has enabled it on the platform and Customer's plan includes it. When it is used, the question and the read-only results it looks up (such as product names, SKUs, stock, prices and sales totals) are sent to the AI Subprocessor listed in Annex 4. Provider will use only AI providers whose terms do not allow them to train on that data.

13.3 The Service does not make decisions with legal or similarly significant effects about Data Subjects.

14. General

14.1 If this DPA conflicts with the Agreement, this DPA prevails for the processing of Personal Data. If Annex 2 applies and conflicts with this DPA, Annex 2 prevails.

14.2 Each party's liability under this DPA is subject to the limits and exclusions in the Agreement, except where the law does not allow it.

14.3 Provider may update this DPA to reflect changes in law or in its Subprocessors, with notice under section 9.3 or section 19 of the Terms of Service, but not in a way that materially reduces the protection of Personal Data without Customer's agreement.

14.4 This DPA is governed by the same law as the Agreement, except where Annex 2 requires otherwise.

Signatures (optional — only for a countersigned copy)

Annex 1 — Details of processing

Annex 3 — Security Measures

These describe what is in place today. Measures marked "provider control" are operated by Provider's hosting or database provider, not by Provider.

Access control and tenant isolation

• Every request is authorised on the server against the user's company membership, role permissions, and business and warehouse scope. Requests for another company's business return "not found".
• An application-level guard aborts any request that loads a record belonging to a different business.
• Nine built-in roles plus custom roles; users cannot grant permissions they do not hold. API keys are scoped to one business and never exceed their creator's permissions.
• Platform-administrator access is limited to Provider personnel who need it and cannot be used through API keys. Changes made through the platform-administration screens require a stated reason, and all changes made inside a customer's company are recorded in that company's audit log.

Authentication

• Passwords hashed with argon2id; minimum strength checks on sign-up, reset and change.
• Ten failed sign-ins lock an account for 15 minutes, in addition to per-IP rate limits on sign-in, sign-up, token refresh, password reset and invitation acceptance.
• 15-minute access tokens bound to a revocable session; 30-day refresh tokens stored only as hashes, rotated on every use, with reuse detection.
• Password-reset (1 hour) and email-verification (3 days) links are single-use and stored only as hashes; a reset revokes all sessions.
• Multi-factor authentication is not yet available.

Data in transit and at rest

• HTTPS for all traffic between browsers or API clients and the Service; HSTS when running in production mode.
• Encryption at rest of the database is a provider control (Neon). Provider does not apply additional encryption.
• Webhook deliveries are signed with HMAC-SHA256; webhook URLs are checked to block requests to private or internal network addresses.

Integrity and logging

• The stock ledger and audit log are append-only, enforced by database triggers.
• The audit log records create, update, delete, status change and approval actions with user, before/after values, reason, IP address and user-agent.
• Request logs carry a request ID; secrets are not returned by the API and are redacted from logs.
• Uploads are restricted by file type and size and served through signed, expiring links.
• Spreadsheet exports neutralise cells that could be interpreted as formulas.

Application security headers

• Per-request content security policy on the web app that only allows scripts carrying that request's nonce and connections to the Service's own origins; framing denied; strict referrer and permissions policies.

Resilience

• Database point-in-time history kept by the database provider for up to 7 days (provider control).
• A documented restore procedure, tested on a development database; balances can be rebuilt from the append-only ledger.

Physical security

• Provider operates no data centres or servers of its own. Physical and environmental security of the hosting and database infrastructure is a provider control.

Personnel

• Personnel with access to Personal Data are bound by confidentiality obligations (section 4).

Annex 4 — Subprocessors

In use

GitHub hosts Provider's source code only and receives no Customer Data, so it is not a Subprocessor.

Planned — not yet processing Personal Data (section 9.3 notice will be given before use)

This DPA is adapted from the Data Processing Addendum (Global) template published by General Legal under CC0 1.0. Credit as requested by General Legal:

This template was prepared and made publicly available by General Legal, PC ("General Legal"). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.