Data processing agreement

Version 3, last changed on 6 October 2026.

When your business uses Dovalis to collect and show testimonials, your business decides what happens to the personal data in them, and Dovalis handles that data for you. This agreement sets out how, as article 28 of the General Data Protection Regulation requires. You accept it when you create your account, and it applies for as long as the account exists.

The parties

  • Your business, which decides: the controller.
  • SOULSOLUTIONS S.R.L., Romania, which runs Dovalis and handles the data for you: the processor. Contact: support@dovalis.com.

What we handle, and why

  • Whose data: the people you ask for a testimonial, the people who leave one, and the people in your team who use your account.
  • What data: what they give in a testimonial (their words, rating, name, role, company and photo), the record of their agreement, the names and addresses of the people you ask, and what you add yourself.
  • Why: only to collect, keep and show testimonials as your settings say.
  • For how long: as long as your account exists, or less when you delete something sooner.

What Dovalis promises

  • We handle the data only on your documented instructions: what you set up and do in Dovalis, and what you ask us in writing, including about transfers outside the European Union. If the law requires us to do otherwise, we tell you first, unless that law forbids it.
  • If we think an instruction breaks data protection law, we tell you at once.
  • Everyone at Dovalis who can reach the data is bound to keep it confidential.
  • We protect it with the measures below.
  • We help you answer people who ask about their data, and pass on to you without delay any request that reaches us.
  • If a breach affects the data, we tell you without undue delay.
  • We help you with security, breaches, impact assessments and consultations with a data protection authority, where you need it.
  • We give you what you need to show that this agreement is kept, and allow and contribute to audits, including inspections, by you or an auditor you appoint.
  • When your account ends, we delete the data, after you could download a copy, except what the law makes us keep. It leaves our backups within 30 days.

The companies that help us

You allow Dovalis to use the companies on its sub-processor list. Each is bound by a contract with the same data protection duties as this agreement, and we remain fully responsible to you for them. The list as it stands:

  • Supabase

    The database, the logins and the stored files.

    Contracted company
    Supabase Pte. Ltd., Singapore.
    Where
    Frankfurt, Germany.
    Outside the EU
    Standard contractual clauses.

  • Vercel

    Hosting: it runs the application.

    Contracted company
    Vercel Inc., United States.
    Where
    The application runs in Frankfurt, Germany; pages pass through its network worldwide.
    Outside the EU
    Standard contractual clauses.

  • Resend

    Sending email, for Dovalis and for the businesses that use it.

    Contracted company
    Plus Five Five, Inc., United States.
    Where
    Ireland.
    Outside the EU
    Standard contractual clauses.

  • Cloudflare

    The dovalis.com domain name, and passing on email sent to Dovalis's own addresses.

    Contracted company
    Cloudflare, Inc., United States.
    Where
    Its network, worldwide.
    Outside the EU
    Standard contractual clauses.

  • Amazon Web Services

    Receiving the copies of emails a business sends to its Dovalis address in Bcc: their envelope, headers and checks, never their content.

    Contracted company
    Amazon Web Services EMEA SARL, Luxembourg.
    Where
    Frankfurt, Germany.
    Outside the EU
    Standard contractual clauses.

  • Stripe

    Charging for paid plans: the paying business's billing details and how it pays. Never testimonials.

    Contracted company
    Stripe Payments Europe, Limited, Ireland.
    Where
    The European Union and the United States.
    Outside the EU
    Standard contractual clauses.

  • StartCo

    Issuing Dovalis's invoices and sending them to the Romanian tax authority: the paying business's billing details. Never testimonials.

    Contracted company
    STARTCONTABILITATE S.R.L., Romania.
    Where
    Romania.
    Outside the EU
    Not sent outside the EU.

Standard contractual clauses: the European Commission's clauses in each company's contract with us, which protect the data outside the European Union.

The list is kept on its own page. Before we add or replace a company on it, we email your account's owners 30 days ahead. If you object and we cannot find a solution together, you can end your account before the change.

Where the data is

The data is stored in the European Union, in Frankfurt, Germany. Where a company on the list could reach it from outside the European Union, standard contractual clauses protect it.

How we protect it

  • Data is encrypted in transit and where it is stored.
  • Each business's data is kept apart in the database itself: one business can never read another's.
  • Files are private; only what you publish is public.
  • Passwords are never stored in a readable form.
  • Only the people who run Dovalis can reach its systems, and no key or password is kept in its code.
  • Important actions in an account are recorded with who took them.

When this agreement changes

When this agreement changes in a way that matters, we tell you by email before the new version applies and ask you to accept it.