This Data Processing Addendum (DPA) forms part of the agreement between the customer (controller) and Jot (processor), as identified in the Terms of service, and applies wherever Jot processes personal data of the customer's end users. Questions: privacy@usejot.co.
Processor obligations (Art. 28(3)(a)–(h))
Jot shall:
- (a) process personal data only on the customer's documented instructions, including regarding international transfers, unless required by law — in which case Jot informs the customer before processing unless the law forbids it;
- (b) ensure persons authorised to process the data are bound by confidentiality;
- (c) implement the technical and organisational measures in Annex II;
- (d) engage sub-processors only under the conditions in Annex III;
- (e) assist the customer, insofar as possible, in responding to data subject requests;
- (f) assist the customer with security, breach notification, DPIAs, and prior consultation obligations (Arts. 32–36);
- (g) at the customer's choice, delete or return all personal data at the end of the services, and delete existing copies unless law requires storage — per the deletion SLAs below;
- (h) make available all information necessary to demonstrate compliance and allow for and contribute to audits conducted by the customer or its mandated auditor.
Breach notification
Jot notifies the customer of a personal data breach affecting their end users' data without undue delay and in any case within 48 hours of becoming aware of it, with the information the customer needs for its own Art. 33 obligations.
Deletion SLAs
- Deleted organisation: 7-day grace period, then purge begins.
- Hard purge complete within 30 days of deletion.
- Backups and point-in-time recovery snapshots: beyond use immediately, purged within 35 days.
International transfers
Where processing involves a transfer out of the EEA or UK, the parties incorporate the EU Standard Contractual Clauses by reference — Module 2 (controller → processor) or Module 3 (processor → processor) as applicable — together with the UK Addendum where UK GDPR applies.
Annex I — Description of processing
| Item | Description |
|---|---|
| Subject matter | Collection and resolution of feedback on the customer's web application, including optional session replay |
| Duration | The term of the agreement plus the deletion periods above |
| Nature and purpose | Capturing feedback reports and associated technical context so the customer can reproduce and fix issues |
| Data subjects | The customer's end users (reviewers, visitors to pages where the widget is deployed) |
| Data types | Screen content subject to masking, DOM selectors, page URLs, IP address, user agent, interaction events |
Annex II — Technical and organisational measures
- TLS for all data in transit; encryption at rest for database and object storage.
- Masking by default: all inputs masked in the end user's browser before
upload; passwords always masked;
.jot-block/.jot-maskhonoured; masking is never performed server-side. - Access control: tenant isolation enforced and tested; role-based membership; the internal admin console on a separate origin with TOTP.
- Logging: admin actions and impersonation written to an audit log and to the customer's own activity feed; impersonation is read-only and time-boxed.
- Deletion procedures per the SLAs above.
Annex III — Sub-processors
The current list is maintained at Sub-processors. Jot notifies customers of intended additions or replacements, and the customer may object within 30 days of notice on reasonable data-protection grounds; if the objection cannot be resolved, the customer may terminate the affected services.