Data processing agreement (DPA) and GDPR

If you serve members in the EU, UK or Switzerland, data protection law may ask you to have a data processing agreement with the companies that handle your members’ data for you. Drry has one, and you do not have to ask for it.

Where to find it

The agreement is public at drry.com/legal/dpa. It is part of Drry’s Terms of Service, so it applies automatically to every coach on every plan, at no extra charge. Nobody has to sign it, request it or pay for it. It takes effect on the date you become bound by the version of the Terms that includes it, which for a new account is when you create the account.

Who is who

For the members, leads and customers in your community, you are the controller of their community content and Drry is your processor. Drry is the controller of its own account records: sign-in, billing for your own Drry plan, security and abuse prevention. Drry’s Privacy Policy covers those.

What the agreement covers

• Instructions. Drry processes your members’ data on your instructions: the Terms, the DPA and how you use and configure Drry.

• Security. The measures Drry has in place are described in the DPA and on its Security page. Both are plain about what Drry does not have: no SOC 2 or ISO 27001 certification, no third-party penetration test and no uptime commitment.

• Sub-processors. The companies that help Drry process data are listed in the DPA and on drry.com/security. For a new one, Drry emails the primary address on your account at least 30 days before it handles your data, and you have 14 days to object.

• Data breaches. Drry tells you without undue delay after it becomes aware of a breach that affects your data, at the email address on your account.

• Requests from members. Drry passes on requests that relate to your data and gives reasonable help. See Deletion requests for what members and you can do inside Drry.

• Audits. Drry gives you the information needed to show it follows the DPA. You can audit with 30 days’ written notice, no more than once a year in the usual case.

Where data is held

Drry, Inc. is a United States company and your members’ data is stored and hosted primarily in the United States. Cloudflare and Vercel deliver content through global edge networks, so data may pass through or be briefly cached outside the United States while it is being served. Drry does not claim your data is kept in the EU. For transfers from the EU, UK and Switzerland, the DPA incorporates the EU Standard Contractual Clauses (and the UK Addendum and Swiss changes where they apply). Drry does not rely on the EU-US Data Privacy Framework.

When data is deleted

• When you delete your account or community inside Drry, your data is deleted from the live systems then.

• If you ask by email, from the primary address on your account, for your data to be deleted or returned, Drry completes the request within 30 days.

• If your agreement with Drry ends, or Drry ends your account, you have 14 days to ask for a return (by export) or deletion, and Drry completes it within 30 days of the end.

• Backups and logs that Drry controls expire no later than 30 days after deletion from the live systems. Drry may keep data only where the law requires it.

Moving to a free plan is not an ending: your data stays.