Data Processing Addendum
Version 2026-10 · Effective date: October 18, 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service between Diocri Corporation ("Diocri," the "Processor") and the Customer (the "Controller"). It applies when Diocri processes Personal Data contained in Customer Data. If this DPA conflicts with the Terms, this DPA controls for Personal Data.
1. Definitions
- Personal Data: information in Customer Data that identifies or relates to an individual, such as a client's name and address or an employee's name and phone number.
- Data Protection Laws: all U.S. federal and state privacy laws that apply to the processing, including the California Consumer Privacy Act (CCPA) and similar state laws.
- Security Incident: a confirmed breach of security leading to unauthorized access to, or loss, disclosure or alteration of, Personal Data.
2. Roles and instructions
The Customer is the controller (or "business") and Diocri is the processor (or "service provider"). Diocri processes Personal Data only to provide, secure and support the Service, and only on the Customer's documented instructions. The Terms, this DPA and the Customer's use of the Service are those instructions. Diocri will tell the Customer if it believes an instruction breaks the law.
3. Details of processing
| Item | Description |
|---|---|
| Subject matter | Providing the Diocri operations software |
| Duration | The term of the Terms, plus the deletion period in Section 10 |
| Nature and purpose | Hosting, storage, display, reporting, support and backup of Customer Data |
| Data subjects | The Customer's users, employees and crew members, and the Customer's clients |
| Types of Personal Data | Names, email addresses, phone numbers, profile photos, property addresses, notes, vehicle and driver assignments, visit history |
| Sensitive data | None. The Terms prohibit uploading it |
4. CCPA service-provider commitments
Diocri will not: (a) sell or share Personal Data; (b) keep, use or disclose it for any purpose other than the business purposes in this DPA; (c) use it outside the direct business relationship with the Customer; or (d) combine it with personal information from other sources, except as the CCPA allows. Diocri will comply with the CCPA and notify the Customer if it can no longer meet its obligations.
5. Confidentiality
Everyone at Diocri who can access Personal Data, including employees and contractors, is bound by a written duty of confidentiality and accesses it only as needed to provide the Service or support.
6. Security
Diocri maintains reasonable technical and organizational measures, including:
- Encryption of data in transit (TLS) and at rest, provided by our hosting providers.
- Separation of each customer's data enforced at the database level (row-level security), not only in the app.
- Role-based access inside each account (admin, supervisor and other roles).
- Hashed passwords, breached-password checks at sign-up, and rate limiting on sign-in and sign-up.
- Error monitoring configured to minimize personal data, and audit logs of administrative actions.
- Limited, need-to-know access to production systems for personnel and contractors.
7. Subprocessors
The Customer authorizes Diocri to use the subprocessors on our Subprocessors list. Diocri holds each one to data-protection obligations no less protective than this DPA and stays responsible for their work. Diocri will update the list and notify the Customer at least 30 days before adding or replacing a subprocessor. The Customer may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, the Customer may cancel and receive a refund of prepaid fees for the unused period.
8. Assistance with requests
If Diocri receives a request from an individual about Customer Data, it will send it to the Customer and will not answer it directly unless the law requires. The Service lets the Customer access, correct and delete most Personal Data itself. Diocri will give reasonable help with requests the Customer cannot handle in the Service.
9. Security Incidents
Diocri will notify the Customer without undue delay, and in any case within 72 hours, after confirming a Security Incident affecting the Customer's Personal Data. The notice will describe what happened, the data involved and the steps taken. Diocri will cooperate so the Customer can meet its own notification duties.
10. Return and deletion
During the subscription, the Customer can delete most of its data in the Service at any time, and can ask support@diocri.com to delete the rest or for a copy of its Customer Data in a common machine-readable format. After the subscription ends, Diocri deletes Customer Data as described in our Data Retention & Deletion policy. Copies in backups are overwritten in the normal backup cycle. Diocri may keep data only where the law requires.
11. Audits
On written request, no more than once a year, Diocri will answer a reasonable security questionnaire and provide the information needed to show compliance with this DPA.
12. Liability
Each party's liability under this DPA is subject to the limitation of liability in Section 13 of the Terms.
13. Location and international access
Diocri and its subprocessors store Personal Data in the United States. Some Diocri personnel and contractors work outside the United States and may access Personal Data remotely, only as needed to provide and support the Service and subject to Sections 5 and 6. If the Customer needs to transfer Personal Data from outside the United States, the parties will agree on an additional transfer mechanism first.