Data processing agreement (POPIA operator agreement and GDPR Article 28 terms)

Version 1.1, in force from 29 October 2026 for pilot customers (version 1: 26 October 2026). Not yet reviewed by a lawyer; wording may change before general release.

This agreement is between your company (the "Customer") and Computron Tech (Pty) Ltd, trading as Doppelgone ("Doppelgone"). It is part of the Doppelgone for Work terms of service and applies whenever Doppelgone processes personal information for you.

It is written to satisfy section 21 of South Africa's Protection of Personal Information Act (POPIA), which requires a written contract between a responsible party and its operator, and Article 28 of the EU and UK GDPR, which requires the same between a controller and its processor. We use the plain words "you" and "we" and note the legal roles where they matter.

1. Roles

Data	Who decides why and how it is used	Doppelgone's role
Your files and what we learn from them: metadata, hashes, duplicate groups, actions, the personal information inside file names and excerpts	You	Operator (POPIA s21) / processor (GDPR art 28). We act only on your instructions.
Your account and billing data: tenant id, admin and reviewer names and emails, purchases, support emails	Doppelgone, for running the service and billing	Responsible party (POPIA) / controller (GDPR). Covered by our privacy notice.

For file data, you are the responsible party or controller. You confirm that you are allowed to give us access to it and that you have whatever legal basis and notices your own law requires.

2. Your instructions

We process file data only to provide Doppelgone for Work as described in the terms, the product itself (the actions you approve in it) and any written instruction you send to work@doppelgone.app. These documents are your complete instructions.

If an instruction would, in our view, break POPIA, the GDPR or other data-protection law, we will tell you and may pause that instruction until it is resolved.

If a law requires us to process your file data in some other way (for example, a court order), we tell you before we do, unless that law forbids telling you. We treat all file data as confidential and do not disclose it except as this agreement allows or the law requires (POPIA section 20).

We will not use your file data for our own purposes. The one exception is the aggregated metrics in section 12, which never include file data.

3. What we do with your data

Annex 1 lists the details. In short:

Read: file names, paths, sizes, dates, hashes, owners, sharing settings, version counts, and the identities of your users and groups, through Microsoft Graph with the permissions your admin consented to.
Compare: for documents that look alike, short text passages read into memory, compared, and discarded. Some of those passages, with coarse facts (for example "two contracts, same client, dates differ"), are sent to our AI provider for a judgment. No file names and no identifiers go with them.
Store: metadata, hashes, duplicate groups, the actions you approve and an audit log. We never store file contents.
Act: on your approval, move chosen copies to your Microsoft 365 recycle bin.

4. Confidentiality and people

Only people who need access to provide the service have it. At launch that is one operator (the founder), under a confidentiality obligation. Anyone we add later signs a confidentiality undertaking first.
Support access to a customer's data happens only to resolve a support request or an incident. Access through our admin tool is written into your organisation's audit log automatically. Direct access to the database, kept for incidents, is recorded by hand with who, when and why, and the record is available to you on request.
All operator accounts use multi-factor authentication.

5. Security

We apply the technical and organisational measures in Annex 2, which points to our Security sheet. They are appropriate to the risk of the data we hold: metadata and hashes, not files. We check them regularly and when risks change (POPIA section 19), may improve them over time, and will not reduce the overall level of protection.

6. Subprocessors

You give general authorisation for the subprocessors listed in Annex 3 (our Subprocessor list, kept at work.doppelgone.app/legal/subprocessors).
We bind each subprocessor by a written contract with data-protection obligations that give at least the protection in this agreement, including security, confidentiality and deletion.
Changes: we email the account owner at least 30 days before adding or replacing a subprocessor that processes personal information on your behalf. If you have a reasonable objection and we cannot resolve it, you may end the agreement before the change takes effect. We then refund any clean-up you paid for that has not run, and any unused monthly fee.
We remain responsible for our subprocessors' performance under this agreement.

7. Cross-border transfers

Our database is in the EU (Ireland) and our application functions run in Vercel's EU region (Dublin). Vercel, Resend and Polar are US companies and may process some data in the USA, and we operate the service from South Africa. Your data will therefore leave South Africa, and some of it may leave the EU.

POPIA section 72. You instruct us to make these transfers to provide the service. We transfer personal information outside South Africa only where the recipient is bound by a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA's conditions for lawful processing, including similar rules for onward transfers (section 72(1)(a)). The EU recipients are bound by the GDPR. The others are bound by written data processing agreements that meet this test. We do not rely on data subjects' consent for these transfers.

GDPR. If you are subject to the EU or UK GDPR:

Transfers from you to us (we are in South Africa, which has no EU adequacy decision) are covered by the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor), which are incorporated into this agreement by reference. You are the data exporter and we are the data importer. Clause 7 (docking) does not apply. Under Clause 9 option 2 applies, with the 30 days' notice in section 6. The option in Clause 11 does not apply. Clause 13: the supervisory authority of your EU establishment or representative. Clauses 17 and 18: the law and courts of Ireland. Annexes I to III are Annexes 1 to 3 of this agreement.
For UK data, the UK International Data Transfer Addendum (version B1.0) applies to those clauses, with the parties' details from this agreement.
Onward transfers from us to subprocessors outside the EEA or UK rely on the subprocessor's Standard Contractual Clauses (or UK Addendum), or an adequacy decision such as the EU-US Data Privacy Framework where the subprocessor is certified.
If those clauses conflict with this agreement, the clauses win.

South African data residency is available as an Enterprise option by quote. It is not part of the standard service.

8. Helping you with rights requests and compliance

If a data subject contacts us about your file data, we send the request to you within 3 business days and do not answer it ourselves, unless the law requires us to.
We help you respond to data-subject requests, Information Regulator or supervisory-authority enquiries, and data-protection impact assessments, as far as the request concerns our processing. The product's export and audit-log features are the first tool for this. Reasonable help is free. If a request needs substantial work beyond that, we agree a fee with you before we start.

9. Security compromises (breach notification)

If there are reasonable grounds to believe that personal information we process for you has been accessed or acquired by an unauthorised person (a "security compromise" under POPIA sections 21 and 22, a "personal data breach" under the GDPR), we notify the account owner by email immediately, and at the latest within 48 hours of finding out. That leaves you time to meet your own deadlines, such as the GDPR's 72 hours to the regulator.
The notice says what happened, which data and roughly how many people are affected, what we have done and what we recommend you do. If we do not know everything yet, we send what we know and follow up as we learn more.
We take reasonable steps to contain the compromise, keep a record of it, and help you with your investigation.
You are responsible for notifying the Information Regulator, your supervisory authority or affected people where the law requires it. We give you what you need to do so. We do not notify them on your behalf unless you ask us to or the law requires us to.

10. Deletion and return

When	What happens
90 days after your last scan	Inventory (file metadata, hashes, fingerprints, groups and reviews) is deleted automatically. The record of what each clean-up moved, and the audit log, stay.
When you ask to leave, or we detect that you removed our applications	Scans, analyses and clean-ups stop immediately. The report, the audit log and the clean-up records stay available for 30 days so you can export them. Until then you can change your mind.
30 days after that, or sooner on request	All your organisation's data is deleted from our database automatically. Copies in our database provider's backups expire on its normal backup cycle. On request we confirm the deletion in writing.
Audit log and clean-up records	Kept while your organisation's account is open, exportable at any time, and deleted with everything else when you leave.
Exception	Purchase records we must keep under tax law (at least 5 years), and anything else a law requires us to keep.

Export (the report, the audit log and the clean-up records) is how we return your data. Files you removed stay in your Microsoft 365 recycle bin under Microsoft's rules (up to 93 days from the move), regardless of what happens to your Doppelgone account. We do not touch them after a clean-up, and Microsoft, not Doppelgone, deletes them permanently after that.

11. Audits

On request, once a year, we give you a written description of our security measures and confirm in writing that we comply with this agreement. Once our first independent penetration test is done, we also share the summary of the most recent one.
If a written confirmation is not enough for a specific legal or regulatory reason, you may carry out one audit a year, at your cost, on 30 days' notice, during business hours, through an independent auditor bound by confidentiality, without disturbing other customers' data or our operations. We may charge for our time at a rate we agree with you before the audit.
Audit findings are confidential and used only to check compliance with this agreement.

12. Aggregated metrics for service improvement

We may keep and use aggregated, anonymised counts from your use of the service to improve it: for example, how many duplicate groups were found, of which types, how often reviewers overrode a suggestion and the reasons they chose. These counts contain no file data, no file names, no excerpts, and nothing that identifies your company or any person. They are not personal information once aggregated, and we may keep them after your data is deleted.

13. Liability

The limit of liability in section 11 of the terms of service applies to this agreement as well, including its exceptions for fraud, wilful misconduct and gross negligence. Each side is liable for its own breaches of data-protection law as that law provides, and nothing here limits a data subject's own rights against either of us.

14. Term and changes

This agreement lasts as long as we process personal information for you, and section 10 survives until deletion is complete.
We may update this agreement to reflect changes in law or in our service. Material changes are emailed to the account owner 30 days in advance and never reduce your protection without your agreement.
If this agreement and the terms of service conflict about personal information, this agreement wins.
South African law applies, with disputes handled as in the terms of service.

Annex 1: Processing details

Item	Detail
Subject matter	Finding and removing duplicate and near-duplicate files in the Customer's Microsoft 365 tenant (SharePoint and OneDrive). Google Drive may be added later.
Duration	From admin consent until deletion under section 10.
Nature	Automated inventory through Microsoft Graph; hashing; comparison of short excerpts in memory; AI judgment on excerpts; moving approved files to the recycle bin on instruction.
Purpose	Providing Doppelgone for Work to the Customer.
Data subjects	The Customer's employees, contractors and other users with files in the tenant; people named in file names or in the short excerpts compared; the Customer's admins and reviewers.
Categories of personal information, file data	Names and emails of file owners, editors, sharing recipients and the tenant's users and groups; file names and paths (which may contain names); dates; text fingerprints (MinHash); short text excerpts of candidate documents (in memory only; some sent to the AI provider without file names).
Categories, account data	Microsoft tenant id; admin and reviewer object ids, names and emails; roles; purchase records; support correspondence.
Special personal information and children's information	Not intended. If your files contain it (for example HR or medical records), it may appear in a short excerpt during comparison, and that excerpt may go to the AI provider. Excerpts are never stored by us. Tell us before the audit if you need particular sites excluded.
Stored	File metadata, hashes, signatures, groups, actions, audit log, account and billing data. No file contents.
Not stored	File contents, excerpts, previews, Microsoft access tokens beyond their session lifetime.
Location	Database in the EU (Ireland). Application functions in Vercel's EU region (Dublin). Some subprocessors are US companies. See section 7.
Retention	Section 10.

Annex 2: Security measures

The measures are described in the Security sheet (work.doppelgone.app/legal/security), which forms this annex. Headline points: single-tenant isolation in the database with the organisation id on every row and tests that prove it; keyless cloud credentials (no stored client secret); MFA on all operator accounts; TLS in transit and encryption at rest; no file contents stored; no file names in logs or sent to the AI provider; logged support access; independent penetration test before the first paid clean-up; incident notification immediately and within 48 hours.

Annex 3: Subprocessors

The current list is the Subprocessor list (work.doppelgone.app/legal/subprocessors), which forms this annex. At the date of this version: Vercel (hosting), Supabase (database, EU, Ireland), TypeSafe (AI judgments on excerpts), Polar (payments, merchant of record; account data only), Resend (email; account data only), and Microsoft as the platform you already use. Changes follow section 6.

Computron Tech (Pty) Ltd, trading as Doppelgone 10 Belgrave Street, Bryanston, Sandton, 2191, South Africa work@doppelgone.app