Back to Privacy

Data protection

Data Processing Addendum

Effective August 23, 2026 · Version 2026-08-23

This Data Processing Addendum (“DPA”) forms part of the Docket Terms of Service or another written agreement between Docket and the firm using Docket (“Customer”). It applies when Docket processes Customer Personal Data to provide the service.

1. Roles and scope

Customer is the controller, business, or equivalent responsible party under applicable privacy law and determines why client and firm information is submitted to Docket. Docket acts as Customer’s processor, service provider, or contractor for Customer Personal Data. Docket remains an independent controller for its own account administration, security, fraud prevention, legal compliance, and billing records where applicable law assigns that role.

“Customer Data” means information submitted to or generated for Customer through Docket. “Customer Personal Data” means Customer Data relating to an identified or identifiable person. Processing details are described in Appendix A.

2. Documented instructions

Docket will process Customer Personal Data only to provide, secure, support, and maintain the service; create the requested assessment, investigation, and workpapers; comply with Customer’s documented instructions; or satisfy law. The agreement, Customer’s use and configuration of Docket, and authorized support requests are documented instructions.

Docket will not sell Customer Personal Data, share it for cross-context behavioral advertising, combine it with data received from unrelated businesses except as legally permitted for a service provider, or use Customer Data to train Docket or third-party artificial-intelligence models.

3. Confidentiality and security

Docket will limit access to personnel and subprocessors who need it to perform the service and who are bound by confidentiality obligations. Docket will maintain technical and organizational safeguards appropriate to the nature of the data and risk, including the measures summarized in Appendix B.

Customer is responsible for lawful collection, notices, permissions, user access, and the accuracy of its instructions. Customer must not submit seed phrases, private keys, signing credentials, or credentials capable of moving assets.

4. Privacy requests and compliance assistance

Taking into account the nature of processing, Docket will reasonably assist Customer with requests to access, correct, export, restrict, or delete Customer Personal Data. If Docket receives a request directly from a person whose data is controlled by Customer, Docket will direct the requester to Customer unless law prohibits doing so.

Docket will reasonably assist with Customer’s data-protection impact assessments, regulator consultations, and information needed to demonstrate compliance, considering the information available to Docket and the nature of the service.

5. Security incidents

Docket will notify Customer without undue delay after confirming unauthorized access to, acquisition of, or disclosure of Customer Personal Data for which Docket is responsible. Notice will include the known nature and scope, likely consequences, mitigation taken or planned, and a contact for follow-up. Notification is not an admission of fault. Customer remains responsible for notices it is legally required to provide to clients, regulators, or others.

6. Subprocessors

Customer authorizes the subprocessors on Docket’s current subprocessor list. Docket will require each subprocessor to protect Customer Personal Data consistently with this DPA for the service it performs and remains responsible for its subprocessor obligations to the extent required by applicable law.

Docket will post material additions or replacements before they begin routinely processing Customer Personal Data and will provide at least 15 days’ advance notice to customers subscribed to update notices when reasonably possible. Customer may object on reasonable data-protection grounds during that period. If the parties cannot resolve an objection, Customer may stop using the affected feature or terminate the affected service.

7. International transfers

Docket and its subprocessors may process data in the United States and other locations identified by the applicable provider. Where a legally required transfer mechanism applies, the parties incorporate the then-current controller-to-processor Standard Contractual Clauses or another valid mechanism. Docket will provide reasonable information about transfer safeguards upon request.

8. Return, deletion, and retention

Customer may export available records and workpapers during the service term. Docket will delete or return Customer Personal Data at Customer’s verified request and at the end of the applicable retention period, unless law, a legal hold, payment recordkeeping, security requirements, or professional-workpaper instructions require limited continued retention. Timing and exceptions are stated in Docket’s Retention and Deletion Commitments.

9. Reviews and audits

Upon reasonable written request, no more than once annually unless a confirmed incident or regulator requires more, Docket will provide information reasonably necessary to assess its compliance with this DPA. The parties will first use current policies, summaries, questionnaires, and independent reports. Any further audit must avoid exposing other customers’ data, disrupting the service, or compromising security and will be subject to reasonable confidentiality and scheduling requirements.

10. Duration, conflicts, and liability

This DPA remains effective while Docket processes Customer Personal Data. If it conflicts with the agreement about processing Customer Personal Data, this DPA controls. The agreement’s governing law, liability limits, and dispute terms apply to this DPA unless applicable law requires otherwise.

Appendix A — Processing details

Subject and duration
Operating Docket for the agreement term and the applicable retention period.
Nature and purpose
Collection, organization, hosting, retrieval, comparison, automated analysis, professional-review support, export, security, support, and deletion needed to produce crypto tax assessments and workpapers.
People
Customer users, Customer’s clients or taxpayers, authorized firm personnel, and people represented in submitted transaction or account records.
Data
Names and contact details; firm, client, and engagement information; public wallet addresses; blockchain activity; exchange, custodian, payment, and tax records; uploaded documents; user answers; generated work product; audit, authentication, device, support, and usage records.
Sensitive data
Financial and tax information and any special-category information incidentally present in records. Docket is not designed to receive private keys, seed phrases, or asset-movement credentials.
Frequency
As initiated by authorized users and automated case workflows while the service is in use.

Appendix B — Security measures

Contact and countersigned copies

This DPA is incorporated by reference when applicable. For diligence questions or a countersigned, order-specific copy, email privacy@docketcrypto.com.