Dock

Data Processing Agreement

Last updated September 17, 2026

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Controller") and Surf Online ("Processor") when you use Dock to publish sites that process personal data about Discord users or other visitors on your behalf.

This DPA applies where GDPR, UK GDPR, or similar laws require a written processing agreement.

2. Subject matter and duration

Processor hosts your site configurations, published pages, bot data, uploaded media, and related metadata for the duration of your account and subscription, plus retention periods in our Privacy Policy.

3. Nature and purpose of processing

Processing includes storage, hosting, display, backup, transmission to Discord for access verification, and support activities necessary to operate your published sites on Dock.

4. Categories of data and subjects

Data subjects may include your staff, collaborators, and people who visit or are referenced on your sites. Categories may include identifiers (such as Discord user IDs), usernames, avatars, guild membership, roles, bot data fields, and other information you configure your sites to display.

5. Processor obligations

Processor will:

  • Process personal data only on documented instructions from Controller.
  • Ensure personnel with access are bound by confidentiality.
  • Implement appropriate technical and organizational security measures.
  • Assist Controller with data subject requests where feasible.
  • Notify Controller without undue delay of personal data breaches we discover.
  • Delete or return data when the service ends, subject to legal retention.

6. Subprocessors

Controller authorizes Processor to use subprocessors listed below. Processor remains responsible for their performance:

SubprocessorPurposeLocationData processed
ConvexBackend, database, authentication, and real-time APIUnited StatesAccount data, site configurations, page content, bot data records, session metadata
VercelFrontend hosting and edge deliveryGlobalHTTP request metadata, session cookies
DiscordAuthentication, guild membership, and role checksUnited StatesOAuth profile fields, guild and role metadata
CloudflareCDN, custom hostname SSL, edge delivery, and object storage (R2)GlobalHTTP metadata, custom domain configuration, uploaded images and file metadata

7. International transfers

Where personal data is transferred outside the EEA/UK, Processor uses appropriate safeguards such as Standard Contractual Clauses under the Netherlands and EU law.

8. Contact

DPA inquiries: legal@meridian.surf. See also our Privacy Policy.