Data Processing Agreement
Where you (the account) are the controller and Candor is the processor of the board and item data our apps handle for you.
Last updated: 24 September 2026
This DPA is incorporated into the Terms of Service and applies whenever a Candor App processes personal data on your behalf. You are the controller; datadir s. r. o. is the processor.
1. Subject matter and duration
We process personal data only to provide the Apps you've installed, for as long as they're installed, plus the short wind-down period in section 7.
2. Nature and purpose
Reading and writing board and item data (boards, items, subitems, columns and metadata) and, where a feature needs it, limited end-user data — solely to deliver that App's function.
3. Categories of data and data subjects
- Data subjects: the account's members and the people its work involves (approvers, document signers, ticket contacts).
- Data: board and item configuration and content; and, per feature, identifiers such as an approver's monday identity, a signer's email address, or a ticket contact. We minimise this to what the feature requires.
4. Our obligations
- Process only on your documented instructions (installing and configuring an App is such an instruction).
- Ensure personnel are bound by confidentiality.
- Apply appropriate technical and organisational security measures (section 6).
- Assist you with data-subject requests and with your security, breach, and impact-assessment obligations.
- Notify you without undue delay, and no later than 48 hours, after becoming aware of a personal-data breach — in time for you to meet your own 72-hour obligation.
5. Sub-processors
You give general authorisation to the sub-processors below. The e-signature providers are engaged only if you connect one in e-Sign Status; until you do, no signer data leaves monday code. We will give at least 30 days' notice of any intended addition or replacement of a sub-processor (posted on this page, and by email if you subscribe at support@candor.datadir.co), during which you may object on reasonable data-protection grounds.
| Sub-processor | Purpose | Location |
|---|---|---|
| monday.com Ltd | The platform your account runs on, and — via monday code — the cloud that hosts the app and any data it stores | Per monday.com's terms & sub-processors |
| DocuSign (only if you connect it in e-Sign Status) | Sends documents for signature through your connected DocuSign account and returns their status; processes signer names, emails, and the document | Per DocuSign's terms & sub-processors |
| DocuSeal (only if you connect it in e-Sign Status) | Open-source (AGPL-3.0) e-signature engine — you self-host it, or use DocuSeal's hosted API — to send documents for signature and return their status; processes signer names, emails, and the document. See our open-source notices | The instance you host, or DocuSeal's hosted service, per your configuration |
| Transactional notification / email relay | Sending notifications or emails for apps that send them (e.g. approval reminders) | Named here before any such app goes live |
6. Security measures (technical & organisational measures)
- Tenant isolation — an app's stored data is scoped per account and per app, so no account's install can read another's data.
- Verified requests — the monday session that renders a view is verified against the app's client secret, and every inbound webhook is checked against its signing secret before it's acted on.
- Dependable, auditable state — where an app owns a decision (an approval, an envelope status) that state is app-owned so it isn't silently overwritten; Approval Flows keeps an immutable audit log.
- Encryption in transit; access on least-privilege; hosting on monday code.
7. Return and deletion
On uninstall or deauthorization, or on your request, we delete or return the personal data we process for you within 10 days, and in any event within 30 days of termination, except where the law requires retention. We will certify deletion on request.
8. International transfers
The apps and their stored data are hosted on monday code (monday.com's cloud) in your account's region (US, EU, or AU); we introduce no onward transfer of our own. monday.com's own data-residency and international-transfer safeguards apply to that hosting. Where you connect an e-signature provider, any transfer it makes is covered by that provider's safeguards — for EU personal data, typically the EU Standard Contractual Clauses (Module 2/3).
9. Audits
On reasonable request and notice, we'll make available the information needed to demonstrate compliance with this DPA.
Questions about this DPA: support@candor.datadir.co. Company details: Legal notice.