This Data Processing Agreement ("DPA") forms part of the agreement between ExtractMethod Ltd ("Jotterly", "we", "us" — the processor) and the community, organisation or individual operating a community on Jotterly ("you", "the Community" — the controller). It applies whenever you use Jotterly to process personal data about your members, attendees, supporters, volunteers or buyers, and it is incorporated into our Terms. It reflects the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR).
For Jotterly's own role as a controller — for example your account data and the running of the platform — see our Privacy Policy.
1. Definitions
"UK GDPR", "controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in UK data protection law. "Sub-processor" means any third party engaged by Jotterly to process personal data on your behalf.
2. Roles of the parties
For personal data the Community collects about its own members, attendees, supporters, volunteers and buyers through Jotterly, the Community is the controller and Jotterly is the processor. Jotterly processes that data only to provide the service and only on the Community's documented instructions, which include the use of the platform's features and this DPA.
3. Details of processing
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex A.
4. Jotterly's obligations
As your processor, we will:
- Process only on your instructions: we process personal data only on your documented instructions, including for international transfers, unless required by law (in which case we will tell you, unless the law prohibits it)
- Confidentiality: ensure that people authorised to process the data are bound by confidentiality
- Security: implement appropriate technical and organisational measures to protect the data, as described in Annex B
- Sub-processors: engage sub-processors only under a written contract imposing the same data protection obligations, and only those listed in Annex C; we will give you reasonable notice of any intended change and the chance to object
- Assist with data subject rights: taking into account the nature of the processing, help you respond to requests from data subjects to exercise their rights (access, correction, erasure, portability, objection and restriction)
- Assist with compliance: help you meet your obligations around security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us
- Breach notification: notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties
- Deletion, anonymisation or return: at the end of the service, or on your instruction, delete, irreversibly anonymise or return the personal data at your choice, and delete or anonymise existing copies unless we are required by law to keep them
- Audits: make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, on reasonable notice
5. Your obligations
As the controller, you are responsible for having a lawful basis for the data you collect, for being transparent with your data subjects (including having your own privacy notice), for the accuracy of your instructions, and for only collecting data you are entitled to collect. Our guidance for community organisers explains these duties in plain English.
6. International transfers
Some sub-processors process data outside the UK. Where they do, the transfer is protected by an appropriate safeguard such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses. Details are in Annex C and in our Privacy Policy.
7. Liability and changes
This DPA is subject to the liability provisions of our Terms. We may update this DPA to reflect changes in the service, our sub-processors or the law; material changes will be notified to registered community administrators by email. The date at the top of this page reflects the current version.
Annex A — Details of processing
- Subject matter: provision of the Jotterly events, ticketing, shop and fundraising platform
- Duration: for as long as the Community uses Jotterly, plus any retention period required by law
- Nature and purpose: hosting, storage, processing and transmission of personal data to enable the Community to run events, sell tickets and items, take payments, manage members and volunteers, and communicate with their people
- Types of personal data: names, email addresses, membership and volunteer details, event attendance and ticket records, order and transaction records, donation and supporter messages, and limited technical data (such as IP address)
- Categories of data subjects: the Community's members, event attendees, ticket buyers, shop buyers, donors, supporters and volunteers
Annex B — Security measures
- encryption of personal data in transit and at rest
- access controls, authentication and least-privilege access for our team
- logical separation of each community's data and cross-community isolation
- secure, reputable cloud infrastructure with regular backups
- payment card data handled entirely by Stripe — never stored on Jotterly
- monitoring, logging and regular security review
Annex C — Approved sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | US (Standard Contractual Clauses) |
| Cloudflare | Content delivery and privacy-friendly analytics | Global |
| Google Analytics | Usage analytics (only with cookie consent) | US (Standard Contractual Clauses) |
| Cloud hosting & file storage | Hosting and storage of platform data | EU |
| Email delivery provider | Transactional and service emails | EU / US (with safeguards) |
| Error-monitoring provider | Fault detection and diagnostics | EU |
The specific providers behind these categories are available to community administrators on request at [email protected].