Data processing agreement

This agreement forms part of the terms of service between DICE ("processor") and the business using DICE ("controller").

1. Scope and roles

The controller decides why and how its end customers’ personal data is processed. DICE processes that data only to provide the service and on the controller’s documented instructions, which are the terms, this agreement and the settings the controller chooses in the portal.

2. Data processed

• Categories of people: the controller’s website visitors, customers and prospects who contact it, and its staff.
• Types of data: names, contact details, messages and attachments, booking details, consent records, and any other data people share in conversations.
• Special categories: only if the controller’s business involves them (for example health information at clinics). The controller marks such businesses so stricter defaults apply.

3. Processor duties

DICE will:

• process the data only on documented instructions;
• make sure people with access are bound by confidentiality;
• apply the security measures in section 6;
• help the controller answer requests from people exercising their rights, through export, deletion and consent tools in the portal;
• tell the controller without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach affecting its data;
• delete or return the data when the service ends, as the controller chooses, and issue a deletion certificate;
• make available the information needed to show compliance with this agreement.

4. Sub-processors

The controller authorizes the sub-processors listed on the trust center. DICE announces new sub-processors at least 30 days before use, and the controller may object on reasonable grounds.

5. International transfers

Where data moves to a country without an adequacy decision, DICE relies on appropriate safeguards such as standard contractual clauses.

6. Security measures

• Tenant isolation with row-level security in the database, tested automatically.
• Encryption in transit (TLS) and envelope encryption for secrets; encrypted backups.
• Role-based access, two-factor authentication for staff, four-eyes approval for dangerous actions, time-limited and logged support access.
• Append-only, hash-chained audit log without personal data.
• Personal data redacted from application logs.
• Nightly backups with an automated weekly restore test.

7. Term

This agreement lasts as long as DICE processes personal data for the controller.

Contact: the address on our contact page (/contact)