Data Processing Addendum

This Data Processing Addendum supplements the IndexDock Terms of Service. It governs the processing of personal data that occurs when we act as a processor on behalf of customers who use IndexDock Analyzer or related deliverables.

• Data processor: INDEXDOCK, obrt za informatičke usluge, vl. Oleksii Predachenko, OIB 91777187978, Put Murvice 12, 23000 Zadar, Croatia.
• Data controller: the customer specified in the order form, contract, or written request.

We process personal data solely to deliver the contracted IndexDock services. Processing lasts for the term of the underlying agreement plus any retention periods required by law or documented instructions.

Typical activities include ingesting URLs to audit, capturing technical metrics, storing analyser outputs, collaboration on remediation roadmaps, and providing customer support.

• Contact information for customer personnel (name, work email, role).
• Website telemetry necessary to produce audits (URL, crawl diagnostics, performance timing).
• Optional notes supplied by the customer in tickets or documents.
• End-users of the customer’s website may be indirectly referenced in logs and analytics.

• Process data only on documented instructions from the controller.
• Ensure personnel authorised to process data are subject to confidentiality undertakings.
• Implement the technical and organisational measures listed in Section 7.
• Keep a record of processing activities performed on behalf of the controller.
• Assist the controller with data subject requests and DPIAs where reasonably required.

• Segregated production environments with role-based access control and MFA.
• Encryption in transit (TLS 1.2+) and at rest for databases and backups.
• Continuous monitoring, logging, and automated alerting for anomalies.
• Vendor due diligence and contractual controls for approved subprocessors.
• Regular vulnerability management, including penetration testing and patching.

We rely on vetted providers for hosting, transactional email, AI processing, and analytics. The database holding customer data is hosted in Frankfurt, EU; some providers are established outside the EU/EEA and those transfers are covered by Standard Contractual Clauses. The current list is published in our Privacy Policy and also available on request at privacy@indexdock.com. We will notify customers before adding or replacing subprocessors and provide the opportunity to object on reasonable grounds.

If we receive a request directly from a data subject connected to the customer, we will promptly forward it to the controller and provide reasonable assistance so the controller can comply with GDPR obligations.

In the event of a personal data breach, we will notify the controller without undue delay after becoming aware of the incident, share relevant information, and cooperate on remediation.

Upon termination of the services, we will delete or return personal data in accordance with the controller’s instructions unless retention is required by EU or member state law.

This DPA is governed by the laws of the Republic of Croatia and the competent courts in Zadar, Croatia have jurisdiction. This does not affect any mandatory rights the controller or data subjects have under the GDPR.

INDEXDOCK, obrt za informatičke usluge, vl. Oleksii Predachenko — support@indexdock.com — Put Murvice 12, 23000 Zadar, Croatia