Data processing terms

Your company decides what goes into DockCount and why. That makes you the controller of it. We hold it and act on your instructions, which makes us your processor. Those instructions are the product itself: you type a purchase order, we store it; you confirm a delivery, we record it and email the summary to the addresses you set.

Your own staff details are a separate matter: for names, email addresses and sign-in records we are the controller, and the privacy policy covers those.

• Only what is needed to run the product for you, and nothing else.
• We do not sell it, rent it, or hand it to anyone for their own purposes, and we do not train anybody’s models on it.
• A photographed packing slip is sent to the model that reads it, which returns the numbers and keeps nothing. The subprocessor list names who that is.
• People here can reach your records only where support requires it, and only while it requires it.

The companies we rely on are named on the subprocessor page, along with what each one does and where it sits. Each is bound to terms no weaker than these. That page changes when the list changes, so it is the version to check rather than a copy sent to you once.

• Encrypted in transit, everywhere, always.
• One company cannot see another’s records. Every query is scoped to the account it came from, and a request for a document belonging to somebody else is answered as though it does not exist.
• Passwords are stored hashed. Nobody here can read one, including us.
• Access is by role, so somebody who signs for deliveries cannot reach the plan or the team.

If your information is exposed or lost, we will tell you without undue delay and in any case within seventy-two hours of knowing, with what happened, what was affected and what we are doing about it. We will not wait for a full investigation before telling you it happened.

An admin can download everything the account holds, as one machine-readable file, from the settings page at any time. An admin can also delete the company and everything under it from the same page: the records go, the photographs go, and we cannot put any of it back.

If you close the account without deleting it, tell us and we will remove it. Backups age out on their own within thirty days.

If one of your staff or suppliers asks you for their information, or asks you to correct or erase it, most of it you can do yourself inside the product. Where you cannot, write to privacy@dockcount.com and we will help you answer within a timeframe that lets you meet your own deadline.

Ask and we will answer questions about how any of this works, in writing. That is an honest answer where an on-site inspection clause would be a promise nobody intends to keep.