Data processing agreement

First draft, 14 November 2026. A lawyer-reviewed DPA will replace this before paid processing at volume.

This DPA applies when you use Doorly to process attendee personal data. You are the controller. AnswerCentric, operating Doorly, is the processor.

Instructions

We process attendee data only to provide Doorly, on your instructions, including storage, display, check-in, reporting and deletion when you or the retention rules require it.

Security

We use TLS, hashed passwords, scoped database queries, access roles, audit logs and rate limiting. Super-admin access to a company workspace is controlled and logged.

Subprocessors

Current subprocessors are listed on the subprocessors page. We will keep that list up to date.

International transfers

We prefer UK or EU hosting. Any transfers will be documented with an appropriate safeguard (for example the UK IDTA or addendum).

Assistance and deletion

We will help you respond to data-subject requests that relate to data in Doorly, and will delete or return attendee data at the end of the service, subject to the stated retention window and backups that age out afterwards.