Data processing agreement

When your business uses Dovalis to collect and show testimonials, your business decides what happens to the personal data in them, and Dovalis handles that data for you. This agreement sets out how, as article 28 of the General Data Protection Regulation requires. You accept it when you create your account, and it applies for as long as the account exists.

The parties

Your business, which decides: the controller.
SOULSOLUTIONS S.R.L., Romania, which runs Dovalis and handles the data for you: the processor. Contact: support@dovalis.com.

What we handle, and why

Whose data: the people you ask for a testimonial, the people who leave one, and the people in your team who use your account.
What data: what they give in a testimonial (their words, rating, name, role, company and photo), the record of their agreement, the names and addresses of the people you ask, and what you add yourself.
Why: only to collect, keep and show testimonials as your settings say.
For how long: as long as your account exists, or less when you delete something sooner.

A testimonial can say more than intended, such as the treatment someone had at a clinic. Ask only what you need, and read each testimonial before you show it.

What Dovalis promises

We handle the data only on your instructions: what you set up and do in Dovalis, and what you ask us in writing.
Everyone at Dovalis who can reach your data is bound to keep it confidential.
We protect it with the measures listed below.
We help you answer people who ask about their data. A request that reaches us is passed to you within 2 working days, and we never answer it in your place.
If a breach affects your data, we tell you without delay, and at the latest 24 hours after we know, with what we know then and what we are doing about it.
We help you with an impact assessment or a consultation with a data protection authority, where you need one.
We give you what you need to show that this agreement is kept, and answer your reasonable questions about it.
When your account ends, we delete your data, except what the law makes us keep.

The companies that help us

You allow Dovalis to use these companies. Each is bound by a contract that protects the data at least as well as this agreement:

Supabase: the database, logins and stored files, in Frankfurt, Germany.
Vercel: hosting. The application runs in Frankfurt, and Vercel's network passes each page to the browser that asked for it.
Resend: sending email, from Ireland.
Cloudflare: the dovalis.com domain name, and the mail sent to Dovalis's own addresses.

Before we add or replace one, we email your account's owner 30 days ahead. If you object and we cannot find a solution together, you can end your account before the change.

Where the data is

Your data is stored in the European Union, in Frankfurt, Germany. Where one of them could reach the data from outside the European Union, the transfer is covered by the European Commission's standard contractual clauses in its contract with us.

How we protect it

Every connection is encrypted, and so is the data where it is stored.
Each business's data is kept apart in the database itself: one business can never read another's.
Files are private. The public sees only what you publish.
Passwords are stored only in a scrambled form that nobody can read back.
Only the people who run Dovalis can reach its systems, and no key or password is kept in its code.
The important actions in an account, such as approving a testimonial or publishing a page, are recorded with who took them.

When the account ends

When your account is deleted, everything in it is deleted at once, and it leaves our backups within 30 days. Until then, you can ask us for a copy of your data.

When this agreement changes

When this agreement changes in a way that matters, we tell you by email before the new version applies and ask you to accept it. Each version has a number and a date, shown at the top of this page. The terms of service and the privacy policy are the other two documents you accepted.