Data processing agreement

Last updated: 9 November 2026. This agreement is part of the terms of use and applies without a separate signature.

1. Roles

When a business or self-employed person (the Customer) uses Dowit for work and stores personal data of others in it, the Customer is the controller and Hexade VOF (Dowit) is the processor under Article 28 of the GDPR. Need a signed copy? Ask at hallo@dowit.io.

2. What Dowit processes, and why

• Purpose: providing Dowit: showing and managing the Customer's planning, calendar, tasks, projects, clients and time.
• Data subjects: members of the Customer's workspace, and the Customer's clients and their contact persons.
• Data: names and e-mail addresses, what the Customer records about clients and projects (notes, links), tasks, calendar events and time entries, including who logged which hours.
• Duration: as long as the workspace exists.

Dowit does not need special categories of personal data. The Customer does not put them in Dowit unless that is necessary and lawful.

3. Dowit's obligations

• Instructions: Dowit processes the data only on the Customer's documented instructions: what the Customer and its members do in the app, or have an AI assistant they connected do. Dowit does not use the data for its own purposes, does not sell it and does not train AI models with it.
• Confidentiality: only people who need it to run the service have access, and they are bound to confidentiality.
• Security: every workspace is isolated in the database itself (row-level security); connections use TLS; data is encrypted at rest by the hosting providers; calendar access tokens are additionally encrypted (AES-256-GCM); the error log contains no e-mail addresses.
• Assistance: the Customer can view, correct, export (Settings → Backup) and delete (Settings → Account) all data itself. Dowit helps with other requests from data subjects and with a data protection impact assessment where reasonable.
• Breaches: Dowit informs the Customer without undue delay, and at the latest within 48 hours after discovering a personal data breach, with what is known at that point.

4. Sub-processors

The Customer gives general authorisation for these sub-processors. Dowit binds each of them to equivalent obligations.

• Vercel Inc.: hosting of the app and anonymous statistics (without cookies) (US and EU)
• Neon (Databricks): database and backups (US)
• Resend: sending login links and service e-mails (EU)
• Stripe: payments and invoices for the Business plan (billing data only) (EU and US)
• ImprovMX: forwarding e-mail sent to the support address (EU and US)

Google, Microsoft and an AI assistant (such as Claude or ChatGPT) only receive data when the Customer or a member connects them; they then act on the Customer's instructions under the Customer's own agreement with that provider. Dowit announces a new sub-processor at least 30 days in advance on this page and by e-mail to workspace owners; the Customer can object by cancelling.

5. Outside the EEA

Where a sub-processor processes data outside the European Economic Area, this is based on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

6. End

The Customer can export all data at any time. When the Customer deletes the workspace or account, the data is deleted right away; copies in backups disappear automatically within 30 days.

7. Audits, liability and law

Dowit provides the information needed to show compliance with this agreement on request. The Customer may have an audit performed at its own expense, at most once a year and with reasonable notice. Liability and applicable law follow the terms of use (Belgian law).