docketbeta
Create your account

Data Processing Agreement

Article 28 GDPR terms for customers acting as controller of personal data processed in docket.

Last updated: July 8, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Controller" or "Customer") and Evernow GmbH ("Processor") governing the use of docket.

1. Purpose and Scope

This DPA applies where Evernow GmbH processes personal data on behalf of Customer in connection with the docket platform.

The parties intend this DPA to satisfy the requirements of Article 28 GDPR and applicable data protection laws.

2. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach", and "supervisory authority" have the meanings given in the GDPR.

"Customer Personal Data" means personal data processed by Evernow GmbH on behalf of Customer through the docket platform.

3. Roles of the Parties

Customer acts as controller of Customer Personal Data.

Evernow GmbH acts as processor of Customer Personal Data.

For account administration, billing, support, security, and its own business operations, Evernow GmbH may act as controller as described in the Privacy Policy.

4. Subject Matter of Processing

The subject matter of processing is the provision of the docket SaaS platform, including project management, ticket management, time tracking, contact management, quotations, invoices, reporting, file storage, collaboration, transactional emails, monitoring, and AI-assisted functionality.

5. Duration of Processing

Processing continues for the duration of the customer relationship and any post-termination period during which data is retained for export, backup, legal compliance, or dispute resolution.

6. Nature and Purpose of Processing

Processing may include:

  • hosting;
  • storage;
  • retrieval;
  • transmission;
  • organization;
  • structuring;
  • display;
  • modification;
  • deletion;
  • backup;
  • support access where necessary;
  • AI-assisted analysis and generation when initiated by users;
  • monitoring and error analysis.

The purpose is to provide, maintain, secure, and support the docket platform according to Customer's instructions.

7. Categories of Data Subjects

Customer Personal Data may relate to:

  • Customer's employees;
  • Customer's contractors;
  • freelancers;
  • customer contacts;
  • prospects;
  • suppliers;
  • service providers;
  • business partners;
  • other individuals whose data is entered into docket by Customer or users.

8. Categories of Personal Data

Customer Personal Data may include:

  • names;
  • email addresses;
  • telephone numbers;
  • business addresses;
  • company affiliations;
  • roles and job titles;
  • project information;
  • ticket content;
  • comments and notes;
  • time entries;
  • work logs;
  • billing and invoice information;
  • quotation information;
  • uploaded documents and attachments;
  • communication records;
  • metadata and technical identifiers.

9. Special Categories of Personal Data

Docket is not intended for the intentional processing of special categories of personal data. However, because the platform includes free-text fields and file uploads, Customer may technically submit such data.

Customer is solely responsible for ensuring that any processing of special categories of personal data is lawful and subject to appropriate safeguards.

10. Customer Instructions

Processor shall process Customer Personal Data only on documented instructions from Customer, including with regard to transfers to third countries, unless required to do so by applicable law.

Customer's instructions include:

  • these Terms;
  • this DPA;
  • settings and configurations chosen in the platform;
  • user actions within the platform;
  • written instructions accepted by Processor.

If Processor believes an instruction infringes applicable data protection law, Processor shall inform Customer unless prohibited by law.

11. Confidentiality

Processor shall ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations or are subject to appropriate statutory confidentiality obligations.

12. Security Measures

Processor shall implement appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

Measures may include, as appropriate:

  • access control;
  • authentication mechanisms;
  • role-based permissions;
  • logical tenant separation;
  • encryption in transit;
  • backup procedures;
  • monitoring and logging;
  • vulnerability and error monitoring;
  • internal access restrictions;
  • confidentiality obligations for personnel;
  • incident response procedures.

Customer acknowledges that security measures may evolve over time, provided that the overall level of security is not materially reduced.

13. Subprocessors

Customer provides general authorization for Processor to engage subprocessors for the provision of the service.

Processor shall maintain a current list of subprocessors, including their processing purpose and general processing location.

Processor shall impose data protection obligations on subprocessors that are substantially similar to those in this DPA, to the extent required by applicable law.

Processor remains responsible for the performance of subprocessors as required by applicable data protection law.

14. Changes to Subprocessors

Processor shall notify Customer of intended material additions or replacements of subprocessors by publication on the website and by email to account administrators.

Where reasonably practicable, such notice will be provided at least 30 days before the new subprocessor is used for Customer Personal Data.

Customer may object to a new subprocessor on reasonable data protection grounds by notifying Processor in writing within the notice period.

If the parties cannot resolve the objection in good faith, Customer may terminate the affected service before the new subprocessor is used. Continued use after the notice period constitutes acceptance of the new subprocessor.

15. Assistance with Data Subject Requests

Taking into account the nature of processing, Processor shall reasonably assist Customer with responding to requests from data subjects exercising their rights under applicable data protection law.

If Processor receives a request directly from a data subject relating to Customer Personal Data, Processor may refer the request to Customer unless legally required to respond.

16. Assistance with Security, DPIAs, and Consultation

Taking into account the nature of processing and information available to Processor, Processor shall reasonably assist Customer with:

  • security obligations;
  • personal data breach notifications;
  • data protection impact assessments;
  • prior consultation with supervisory authorities;
  • information reasonably required to demonstrate compliance.

17. Personal Data Breaches

Processor shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

The notification shall include information reasonably available to Processor, which may include:

  • nature of the breach;
  • affected data categories;
  • affected data subjects, where known;
  • likely consequences;
  • measures taken or proposed to address the breach.

Processor's notification is not an acknowledgement of fault or liability.

18. Return and Deletion

Upon termination of the service, Processor shall delete or return Customer Personal Data according to the Terms and Customer's reasonable instructions, unless retention is required by law.

Customer is responsible for exporting Customer Personal Data before the end of the export period.

Backup copies may be retained temporarily and deleted or overwritten according to regular backup cycles.

19. Audits and Information Rights

Processor shall make available information reasonably necessary to demonstrate compliance with this DPA.

Customer may request audits where required under applicable data protection law. Audits must be:

  • limited to what is necessary;
  • conducted during normal business hours;
  • subject to reasonable prior notice;
  • subject to confidentiality;
  • designed to avoid disruption of Processor's operations;
  • limited to systems and processes relevant to Customer Personal Data.

Processor may satisfy audit requests by providing documentation, policies, summaries, third-party reports, or written responses where appropriate.

20. International Transfers

Processor may transfer Customer Personal Data outside the EEA only where permitted under applicable data protection law.

Where required, Processor shall rely on appropriate transfer mechanisms such as:

  • adequacy decisions;
  • Standard Contractual Clauses;
  • the EU-U.S. Data Privacy Framework where applicable;
  • other lawful transfer mechanisms.

21. Liability

Liability under this DPA is governed by the liability provisions of the Terms, unless mandatory data protection law provides otherwise.

22. Order of Precedence

In the event of conflict between this DPA and the Terms concerning the processing of Customer Personal Data, this DPA shall prevail to the extent of the conflict.

Annex 1 — Processing Details

Subject Matter

Provision of the docket SaaS platform.

Duration

For the duration of the customer relationship and any post-termination retention period.

Nature and Purpose

Hosting, storage, processing, transmission, organization, retrieval, deletion, support, monitoring, and AI-assisted processing of Customer Personal Data to provide docket.

Categories of Data Subjects

Employees, contractors, freelancers, customer contacts, prospects, suppliers, service providers, business partners, and other individuals whose data is entered into docket.

Categories of Personal Data

Names, contact details, business information, project data, ticket content, time entries, invoice data, quotation data, uploaded files, comments, notes, and technical metadata.

Special Categories

Not intended, but technically possible through free-text fields and uploads. Customer is responsible for lawful use.

Annex 2 — Authorized Subprocessors

The authorized subprocessors are listed in the Subprocessor List.