Legal

Data Processing Addendum

Last updated: 4 November 2026

1. Incorporation and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer and PortKnot when PortKnot processes personal data on the Customer's behalf. It applies automatically without a separate signature; a countersigned copy is available on request.

Controller: the Customer entity identified in the account or order form, with its registered address and contact details.

Processor: PortKnot, 36 Hoang Cau, Ha Noi, Vietnam, contact hello@portknot.com.

2. Definitions

"GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as incorporated into UK law; "Swiss FADP" means the Swiss Federal Act on Data Protection; "SCCs" means the European Commission Standard Contractual Clauses for international transfers; "Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings given in the GDPR.

3. Scope, roles and instructions

PortKnot processes Personal Data only to provide the service, secure it, prevent abuse, comply with law, and follow the Customer's documented instructions. The subject matter, duration, nature and purpose are the provision of the PortKnot workspace; the categories of data subjects and data are described in Annex A.

The Customer is the Controller and is responsible for lawful basis, notices, consent, list provenance, message content and recipient rights. PortKnot will notify the Customer if an instruction appears to violate data protection law and may suspend processing until it is clarified.

4. Processor obligations

  • Process Personal Data only on documented instructions, including transfers, unless required by law.
  • Ensure personnel authorised to process Personal Data are bound by confidentiality.
  • Implement appropriate technical and organisational measures, including the measures in Annex B.
  • Assist the Customer with data subject requests, impact assessments and prior consultations, taking into account the nature of processing.
  • Notify the Customer without undue delay after becoming aware of a Personal Data Breach, with information reasonably available.
  • Delete or return Personal Data at termination, subject to the retention exceptions in this DPA.
  • Provide information reasonably necessary to demonstrate compliance and allow audits under section 10.

5. Security measures

PortKnot maintains measures designed to protect Personal Data, including tenant-scoped authorisation, hashed passwords and sessions, AES-GCM encryption of provider credentials, TLS, audit logging, rate limiting, backups and incident response. The Customer is responsible for its own account security, recipient lists, devices and connected provider accounts.

6. Subprocessors

The Customer authorises the subprocessors listed on the Subprocessors page as of the effective date. PortKnot will give at least 30 days' notice of a new subprocessor or a material change, and the Customer may object on reasonable data-protection grounds. If the parties cannot resolve an objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

PortKnot remains liable for its subprocessors' performance to the extent required by law. Subprocessors are bound by written terms no less protective than this DPA.

7. International transfers

Where Personal Data is transferred outside the EEA, the UK or Switzerland, the parties incorporate the SCCs (Module 2: controller to processor), the UK Addendum, and the Swiss addendum as applicable. The Customer is the data exporter and PortKnot is the data importer. Annex D records the selected modules and any additional safeguards.

If a transfer mechanism is invalidated, the parties will cooperate in good faith on a replacement and may suspend the affected transfer until a lawful mechanism is in place.

8. Data subject requests

PortKnot will promptly notify the Customer if it receives a request from a data subject relating to Customer Personal Data and will not respond except to confirm receipt, unless legally required. PortKnot will provide reasonable assistance through the workspace export, deletion and correction features.

9. Breach notification

PortKnot will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide a description of the incident, categories and approximate volume of data, likely consequences, and measures taken or proposed. Notification is not an admission of fault. The parties will cooperate on notifications to regulators and data subjects where required.

10. Audit and compliance

Once per year, and following a documented security incident, the Customer may request a summary of relevant security controls or a remote audit on reasonable notice. Audits must be conducted during business hours, under confidentiality, and must not compromise other tenants' data, security or service availability. PortKnot may satisfy the request with current certifications, penetration-test summaries or a security questionnaire.

11. Deletion and return

On termination, PortKnot will delete or return Customer Personal Data within 30 days, except where law requires retention, a legal hold applies, or data remains in backups. Backups are retained for up to 30 days and then deleted in the ordinary course. The Customer may export data before termination using the workspace export features.

12. CCPA service provider terms

Where the California Consumer Privacy Act applies, PortKnot acts as a service provider. PortKnot will not sell or share Personal Data, retain, use or disclose it outside the business purpose specified in the Terms, or combine it with data from other sources except as permitted by the CCPA. PortKnot will comply with applicable CCPA obligations and notify the Customer of any conflicting instruction.

13. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on data protection, this DPA controls. If a mandatory SCC term conflicts, the SCC controls. Nothing in this DPA limits data subject rights under applicable law.

Annex A — Data and subjects

Data subjects: Customer personnel and Customer prospects/contacts.

Data categories: account data, business contact data, campaign and message content, reply and meeting metadata, provider connection metadata, technical logs and usage data.

Sensitive data: not intended. The Customer must not submit special-category data without a separate written agreement.

Annex B — Technical and organisational measures

Tenant-scoped access control, least-privilege administration, MFA for admins, hashed passwords and sessions, encryption of provider credentials at rest, TLS in transit, audit logging, rate limiting, suppression handling, backup and restore procedures, incident response, vendor review and secure development practices.

Annex C — Subprocessors

The current list, purposes, locations and safeguards are maintained at portknot.com/subprocessors and incorporated by reference.

Annex D — Transfer mechanism

Module 2 (controller to processor) of the SCCs; UK Addendum; Swiss addendum. The parties select the optional clauses necessary for their jurisdiction and complete the annexes with their legal details. The Customer may request an executed copy at hello@portknot.com.

This page is a standard commercial document for PortKnot. For a signed DPA, security questionnaire, or a data protection request, email hello@portknot.com.