Data Processing Addendum
Last updated: 20 October 2026
This Data Processing Addendum ("DPA") forms part of the 1Dashboard Terms of Service (the "Agreement") between Scalabl LLC, a Wyoming limited liability company, trading as 1Dashboard ("Processor", "we"), and the customer named in the account or order ("Customer", "you"). If there is a conflict between this DPA and the Agreement about personal information, this DPA applies.
1. Definitions
- Customer Personal Data: personal information within Customer Data that we process on the Customer's behalf in providing the Service.
- Data Protection Laws: the New Zealand Privacy Act 2020, the Australian Privacy Act 1988 (where it applies), United States federal and state privacy laws that apply to the processing, and, where the Customer is subject to them, the EU or UK GDPR.
- Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- Subprocessor: a third party we engage that processes Customer Personal Data.
Other capitalised terms have the meaning given in the Agreement.
2. Roles
The Customer controls Customer Personal Data and decides the purposes and means of its processing. We process it only on the Customer's behalf. For the New Zealand Privacy Act, we hold Customer Personal Data as the Customer's agent for the purposes of section 11, and we do not use or disclose it for our own purposes.
3. Customer instructions
We process Customer Personal Data only:
- to provide, secure and support the Service as described in the Agreement and the documentation;
- as the Customer configures through the Service (for example by connecting a source or turning on sending data back to a CRM); and
- on other documented, reasonable instructions from the Customer that are consistent with the Agreement;
unless required by law, in which case we will tell the Customer first unless the law prohibits it. We will tell the Customer if we believe an instruction breaches Data Protection Laws.
4. Details of processing
| Item | Description |
|---|---|
| Subject matter | Hosting and processing of leads, contacts and advertising data for the Service |
| Duration | The term of the Agreement plus the deletion period in section 10 |
| Nature and purpose | Collection via integrations and API, storage, organisation, de-duplication, filtering, reporting, export, and transfer back to Customer-connected tools |
| Types of personal information | Names, email addresses, phone numbers, company, job details, addresses, lead status and value, notes, form answers, custom CRM fields, marketing attribution data (UTM parameters, click identifiers such as GCLID), and sign-in data for the Customer's users |
| Categories of individuals | The Customer's leads, prospects, contacts and customers; the Customer's users |
| Sensitive information | Not intended. The Customer will not submit sensitive information unless agreed in writing |
5. Confidentiality
We ensure that anyone we authorise to process Customer Personal Data is bound by confidentiality obligations and has access only as needed to perform their role.
6. Security
We maintain appropriate technical and organisational measures, described in Annex 1, and review them regularly. We may update them as long as the overall level of protection is not reduced.
7. Subprocessors
- The Customer gives general authorisation for us to use the Subprocessors listed at 1dashboard.io/subprocessors.
- We will give at least 30 days' notice before adding or replacing a Subprocessor, by updating that page and emailing workspace owners who have subscribed to updates.
- The Customer may object on reasonable data protection grounds within that period. We will discuss the concern in good faith. If we cannot resolve it, the Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.
- We impose data protection terms on each Subprocessor that are no less protective than this DPA, and we remain responsible for their performance.
Third-party services that the Customer connects (such as its CRM or ad platforms) are not our Subprocessors. They act under the Customer's own agreement with them.
8. Overseas transfers
Customer Personal Data is stored in Singapore and processed by Subprocessors in the United States and other countries listed on the Subprocessors page. We will only transfer Customer Personal Data overseas in compliance with Data Protection Laws, including IPP 12 of the New Zealand Privacy Act and APP 8 of the Australian Privacy Principles, using contractual safeguards (and, where the EU or UK GDPR applies, standard contractual clauses or another valid transfer mechanism).
9. Assistance
Taking into account the nature of the processing, we will reasonably assist the Customer to:
- respond to requests from individuals to access or correct their information (we will pass on any request we receive directly, and will not respond ourselves unless the Customer asks us to);
- meet its security and breach notification obligations; and
- carry out privacy impact assessments where the Service is relevant.
10. Return and deletion
The Customer can export Customer Data at any time through the Service. Within 30 days after the workspace is closed or the Agreement ends, we delete Customer Personal Data from our live systems. Backups expire and are deleted within 30 days of creation. We may keep data longer only where the law requires it, and then only for that purpose.
11. Security Incidents
We will notify the Customer without undue delay, and in any case within 72 hours, after confirming a Security Incident affecting Customer Personal Data. The notice will include, as far as known, the nature of the incident, the data and individuals affected, likely consequences, and the steps taken or proposed. We will cooperate with the Customer so it can meet any obligation to notify regulators (such as the New Zealand Office of the Privacy Commissioner or the OAIC) and affected individuals. Notifying the Customer is not an admission of fault.
12. Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA, such as a summary of our security measures and answers to a reasonable security questionnaire, no more than once a year unless a Security Incident has occurred. On-site audits require reasonable notice, are at the Customer's cost, and are subject to confidentiality.
13. Liability
Each party's liability under this DPA is subject to the limitations in the Agreement.
Annex 1: Security measures
- Encryption: TLS for all data in transit. Integration tokens and credentials encrypted at rest with AES-256-GCM, with the key held outside the database.
- Tenant isolation: every database query is scoped to one workspace through a single data access layer.
- Access control: role-based access in workspaces (owner, admin, member). Production access limited to authorised personnel. Mandatory two-factor authentication for platform administrators. Administrator actions recorded in an audit log.
- Authentication: passwordless email sign-in links, optional passkeys, trusted-device records, session review and revocation, per-request checks for banned or suspended accounts.
- Application security: rate limiting on public endpoints, input validation, CSV export injection protection, API keys that can be revoked.
- Monitoring: sync job monitoring, error alerts, uptime checks and email delivery logs.
- Backups: nightly database backups, held for no more than 30 days, with a tested restore procedure.
- Infrastructure: SSH key-only server access, a host firewall, automatic security updates, and a database that is not exposed to the public internet.
Annex 2: Subprocessors
See 1dashboard.io/subprocessors.
Signatures (optional, for customers who need a signed copy)
| Customer | 1Dashboard | |
|---|---|---|
| Name | ||
| Title | ||
| Date | ||
| Signature |