LEGAL
Privacy Policy
How [LEGAL ENTITY NAME] collects, uses and protects personal data across Dockly One and the Dockly apps.
Draft — not yet legally reviewed. This document is a pre-launch draft and has not yet been reviewed by legal counsel. Bracketed text marks details still to be confirmed. It does not yet constitute the binding policy.
Last updated: [EFFECTIVE DATE]
Who we are
Dockly One is operated by [LEGAL ENTITY NAME], registered at ITPL Main Road, Bangalore 560048, Karnataka, India. In this policy "we", "us" and "Dockly" refer to that entity.
For the purposes of India's Digital Personal Data Protection Act, 2023, we act as a Data Fiduciary for the personal data you give us directly, and as a Data Processor for personal data you upload about your own customers and employees. Where UK or EU data protection law applies, the equivalent roles are controller and processor.
What we collect
We collect three kinds of data, for different reasons.
- Data you give us — your name, work email, company name, team size, phone number and anything you write in a contact form or support request.
- Data you put into the apps — invoices, employee records, customer contacts, documents and other business records. This is your data; we hold it on your behalf.
- Data collected automatically — IP address, browser and device type, pages visited and referring site. See our Cookie Policy for how this is gathered.
Why we use it
We process personal data only where we have a lawful basis to do so.
- To provide the service you signed up for, including creating and running your workspace.
- To respond to enquiries and provide support.
- To send service messages about security, billing and material changes. These are not marketing and you cannot opt out of them while you hold an account.
- To send product and marketing email, only where you have consented. You can withdraw consent at any time.
- To meet legal, tax and accounting obligations in India and any other jurisdiction we operate in.
- To detect, investigate and prevent fraud, abuse and security incidents.
AI features
Dockly AI processes your business data to draft documents, answer questions and suggest actions within your workspace.
[CONFIRM AND STATE PLAINLY: whether customer data is used to train any model; which model providers are used as sub-processors; whether prompts and outputs are retained, and for how long; whether customers can opt out of AI processing.] This section must be specific — vague wording here is a common source of enterprise procurement failure.
Dockly Experts
Where you ask Dockly Experts to carry out a job, named members of our team access the data needed to complete that work order, and only for as long as the work order is open. Access is logged and visible to you.
Dockly Experts is delivered by both Dockly employees and contracted specialists. In either case the access described above applies — scoped to the work order, time-limited, and logged.
[CONFIRM: the countries those employees and contractors work from, and that contractors are under written confidentiality and security obligations equivalent to employees. Both are still needed. The first drives the cross-border transfer disclosure below; the second is what makes "named members of our team" true of a contractor rather than a claim we cannot stand behind.]
Who we share it with
We do not sell personal data. We share it only with service providers who help us run Dockly, and only under contract.
[LIST SUB-PROCESSORS: hosting, database, email delivery, payments, analytics, error reporting, AI model providers, and the country each operates in. This list must be kept current and is routinely requested during enterprise procurement.]
We may also disclose data where required by law, or to establish or defend legal claims.
Where your data is stored
[CONFIRM: primary hosting region and whether Indian customer data stays in India. State clearly whether any data is transferred outside India, to which countries, and on what safeguards — standard contractual clauses or equivalent.]
[CONTEXT, updated 2026-09-18: registration is limited to six markets — India, the United States, Germany, the UAE, Singapore and Australia (src/content/markets.ts). The United Kingdom was dropped, which removes UK GDPR but changes nothing else: Germany keeps EU GDPR in scope, so a lawful transfer basis and, where required, a named EU representative are still needed. This section cannot be written for India alone. It does not remove the need to state where data sits. Identity data is no longer with a vendor: Dockly ID is self-hosted Keycloak (docs/ADR-010, infra/keycloak), so its location is wherever we deploy it and is [CONFIRM] until that is fixed. This changes the disclosure rather than removing it. If it is hosted in India, the cross-border transfer for Indian customers' login data disappears — but the German/EU position does not, so a lawful transfer basis is still needed there, and self-hosting makes us the controller of the credential store rather than a vendor's customer.]
How long we keep it
We keep personal data only as long as we need it for the purposes above, or as long as the law requires.
[SPECIFY RETENTION PERIODS: active account data; data after account closure; backups; billing and tax records; support tickets; marketing contacts who never became customers.]
Your rights
Under the Digital Personal Data Protection Act, 2023, you have the right to access a summary of your personal data, to have it corrected or completed, to have it erased, to nominate another person to exercise your rights if you die or become incapacitated, and to a readily available means of grievance redressal.
Where UK or EU law applies you also have rights to restrict or object to processing, and to data portability.
To exercise any of these, write to admin@docklyone.com. We will respond within [RESPONSE PERIOD].
Grievance officer
The Digital Personal Data Protection Act requires us to publish a named contact for complaints.
[GRIEVANCE OFFICER NAME], [TITLE]. Email: [GRIEVANCE EMAIL]. Postal address: ITPL Main Road, Bangalore 560048, Karnataka, India.
If you are not satisfied with our response you may complain to the Data Protection Board of India.
Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls and audit logging.
[STATE: encryption at rest; authentication and MFA; penetration testing cadence; certifications held or planned, such as ISO 27001 or SOC 2; the breach notification process and timeline.]
No system is perfectly secure. If we become aware of a personal data breach we will notify affected users and the Data Protection Board as required by law.
Children
Dockly is a business product and is not directed at children. We do not knowingly process the personal data of anyone under 18. [CONFIRM the approach to verifiable parental consent required by the DPDP Act, if any processing of children's data is possible.]
Changes to this policy
We will post any material change on this page and, where the change is significant, tell account holders by email before it takes effect.
Contact
Questions about this policy: admin@docklyone.com, or write to us at ITPL Main Road, Bangalore 560048, Karnataka, India.