Dolly Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Filmware, LLC (doing business as Dolly) (“Dolly”) and the business that has agreed to the Agreement to use the Services (“Customer”). It is subject to the terms of, and incorporated by reference into, the Dolly Terms of Service and any order form or other agreement between Dolly and Customer for the Services (together, the “Agreement”). Capitalized terms not defined in this DPA have the meanings given in the Agreement.

1. Scope

This DPA governs how Dolly Processes Personal Data in connection with the Services, including the Dolly web dashboard and mobile experience, expense management, receipt capture, transaction coding and accounting exports, crew card requests and approvals, and related support. It applies to Personal Data that Customer, its Authorized Users, or its personnel submit to the Services, and to Personal Data Dolly collects while providing the Services to Customer.

2. Dolly as Data Processor and Data Controller

Data processing roles

Dolly acts as a Data Processor (and, where US State DP Law applies, a “service provider” or “processor”) when it Processes Customer Personal Data on Customer’s behalf to provide the Services. Customer is the Data Controller of Customer Personal Data.

Dolly acts as a Data Controller (and, where US State DP Law applies, a “business” or “controller”) only for the limited purposes described in Section 5, such as managing its relationship with Customer.

Card program partners

Dolly is the software layer for the Dolly Card programs. The cards themselves are issued by banks and run by Program Managers:

• Dolly Card Visa® cards are issued by Celtic Bank, with Stripe as Program Manager.
• Dolly Card Mastercard® cards are issued by Patriot Bank, N.A., with Lithic as Program Manager.

The Program Managers and issuing banks are responsible for the regulated parts of each card program. This includes know-your-customer and know-your-business checks (KYC and KYB), anti-money-laundering and sanctions screening, ongoing risk monitoring, issuer processing (authorizing, clearing, and settling transactions), the program ledger, and storing full card numbers. They Process Personal Data for these purposes as independent controllers under their own terms, listed on the Partner terms page and in the Cardholder Agreement, and their own privacy notices. The card networks do the same for network purposes. Stripe and Lithic are also listed as Sub-processors in Exhibit C for the card and transaction data they send to Dolly so it can provide the Services.

Data processing purposes

When acting as a Data Processor, Dolly Processes Customer Personal Data to provide the Services under the Agreement and Customer’s Instructions, including to:

• create and manage Customer’s account, its administrators, and its Authorized Users;
• pass card requests to the Program Managers, and let Customer set spending limits, merchant and category controls, and approvals through Dolly’s interface;
• receive, read, store, and match receipts and other attachments, including those submitted by text message or email, and attach them to transactions, using AI and OCR Sub-processors where needed;
• code transactions to accounts, budgets, productions, and vendor codes, and produce reports, accounting exports, and wrap archives for Customer;
• send notifications, approval requests, and reminders to Customer’s users; and
• provide customer support, troubleshoot problems, and keep the Services secure and available.

Categories of Data Subjects and Personal Data

The Data Subjects, the categories of Personal Data, and the other details of Processing are described in Exhibit A.

Data security

Dolly maintains a written information security program and the Data Security Measures described in Exhibit B. These measures are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

3. Dolly’s obligations when acting as a Data Processor

3.1 Obligations

When acting as a Data Processor, Dolly will:

• (a) Instructions. Process Customer Personal Data only on Customer’s documented Instructions, including with respect to transfers, unless required to do otherwise by law. Dolly will inform Customer if, in its opinion, an Instruction infringes DP Law, unless the law prohibits Dolly from doing so.
• (b) Personnel. Limit access to Customer Personal Data to personnel who need it to provide the Services, and ensure that those personnel are bound by confidentiality obligations, have passed a background check where permitted by law, and complete security awareness training when they join and every year after.
• (c) Data Subject Requests. Promptly forward to Customer any request from a Data Subject to exercise their rights under DP Law concerning Customer Personal Data (a “Data Subject Request”), and not respond to it except as Customer instructs in writing or as required by law. Taking into account the nature of the Processing, Dolly will help Customer respond to Data Subject Requests through the Services or by other appropriate technical and organizational measures.
• (d) Government requests. Notify Customer of any legally binding request from a government authority for Customer Personal Data, unless the law prohibits notice. Dolly will disclose only the minimum Customer Personal Data needed to comply.
• (e) Assistance. Provide reasonable assistance, taking into account the nature of the Processing and the information available to Dolly, with Customer’s security obligations, data protection impact assessments, and consultations with regulators, to the extent DP Law requires. Dolly may charge a reasonable fee for assistance beyond what DP Law requires of it.
• (f) Data Incidents. Notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Data Incident affecting Customer’s State-Defined Sensitive Data. Dolly is not required to notify Customer of a Data Incident that does not affect State-Defined Sensitive Data. The notice will describe, to the extent known, the nature of the Data Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the steps Dolly has taken or proposes to take to contain and remediate it. Dolly will update Customer as more information becomes available, and will take reasonable steps to contain, investigate, and mitigate the Data Incident under its incident response plan.
• (g) Audits. On Customer’s written request, no more than once in any 12-month period, provide a copy of Dolly’s most recent SOC 2 Type 2 report, or a written response to a reasonable security questionnaire. These materials are Dolly’s confidential information and may be subject to a non-disclosure agreement. Customer agrees that they satisfy any audit or inspection right Customer has under DP Law, unless a regulator with authority over Customer requires otherwise.
• (h) Retention, return, and deletion. Keep Envelope Data for up to two years after the Wrap of the production it belongs to, so Customer can close out and audit the production. Dolly and Customer may agree to keep Envelope Data longer for particular productions or for Customer as a whole. Before Dolly stops storing Envelope Data for a production, it will export an archive of that production’s transactions, coding, and receipts to a drive folder owned by Customer. After the Agreement ends, and at Customer’s choice, Dolly will return Customer Personal Data through the same export or delete it within 30 days of Customer’s written request. Dolly may keep Customer Personal Data where the law requires it or to establish or defend legal claims. Any Customer Personal Data kept will remain subject to this DPA and will be Processed only for those purposes.

3.2 Sub-processors

Customer gives Dolly general written authorization to engage Sub-processors to Process Customer Personal Data. The Sub-processors Dolly uses as of the date of this DPA are listed in Exhibit C.

Dolly may add or replace Sub-processors at any time and will keep Exhibit C up to date.

Dolly will enter into a written agreement with each Sub-processor that imposes data protection and security obligations no less protective than those in this DPA, and will review the security of its higher-risk Sub-processors at least once a year. Dolly remains liable to Customer for the acts and omissions of its Sub-processors to the same extent as for its own under this DPA.

3.3 United States specific data protection obligations

Where US State DP Law applies to Customer Personal Data and Dolly is acting as a Data Processor, Dolly will:

• not sell or share Customer Personal Data, as those terms are defined in the CCPA;
• not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes set out in the Agreement and this DPA, or as US State DP Law otherwise permits;
• not retain, use, or disclose Customer Personal Data outside the direct business relationship between Dolly and Customer;
• not combine Customer Personal Data with personal information Dolly receives from or on behalf of another person, or collects from its own interactions with a Data Subject, except as US State DP Law permits;
• provide the same level of privacy protection to Customer Personal Data as US State DP Law requires;
• notify Customer if Dolly determines it can no longer meet its obligations under US State DP Law; and
• allow Customer, on notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

Dolly certifies that it understands and will comply with these restrictions.

3.4 Disclaimer of liability

Notwithstanding anything in the Agreement, Dolly will not be liable for any claim brought by a Data Subject arising from any act or omission of Dolly, to the extent that it results from Dolly following Customer’s Instructions.

4. Customer’s obligations when acting as a Data Controller

4.1 Instructions

Customer will ensure that its Instructions comply with DP Law. The Agreement, this DPA, and Customer’s configuration and use of the Services are Customer’s complete Instructions to Dolly. Additional Instructions require Dolly’s written agreement.

4.2 Compliance with DP Law

Customer will comply with DP Law in its use of the Services, including by having a lawful basis for the Personal Data it submits and by keeping the Personal Data accurate and complete.

4.3 Disclosures and consents

Customer is responsible for giving its personnel, crew, Authorized Users, and other Data Subjects any notices required by DP Law, and for obtaining any consents required, before it provides their Personal Data to Dolly or invites them to use the Services. This includes consent to receive text messages where Customer enables text-message receipt submission or card requests.

4.4 Customer controls

Customer is responsible for the controls within its own environment, including:

• adding, reviewing, and removing its administrators’ and Authorized Users’ access to the Services, and setting card limits and permissions appropriate to their roles;
• supervising how its personnel and representatives use the Services, and allowing access only to authorized, properly trained people;
• keeping secure the devices and credentials its users rely on to access the Services;
• using any AI or automation features in the Services in line with its own data governance policies; and
• notifying Dolly immediately at security@dollycard.com of any actual or suspected Data Incident, including a compromised user account or card.

5. Dolly’s obligations when acting as a Data Controller

When acting as a Data Controller, Dolly will comply with DP Law and will Process Personal Data as described in the Dolly Privacy Policy. Dolly does not perform KYC, KYB, or sanctions screening itself; the Program Managers do. Dolly Processes Personal Data as a Data Controller to:

• pass information Customer provides to the Program Managers so they can complete KYC, KYB, and their other card program obligations;
• keep the Services secure and investigate misuse of Customer accounts;
• manage its relationship with Customer, including billing, account management, and service communications;
• analyze use of the Services in de-identified or aggregated form to maintain and improve them; and
• comply with law, regulation, legal process, and lawful requests from government authorities.

6. Data location and transfers

6.1 Location of Processing

The Services are offered to businesses in the United States. Dolly and its Sub-processors store and Process Customer Personal Data in the United States.

6.2 Transfers from outside the United States

If Customer transfers Personal Data that is subject to the GDPR, the UK GDPR, or Swiss data protection law to Dolly, Customer will tell Dolly before doing so. The parties will then enter into the Standard Contractual Clauses (and the UK or Swiss addendum, as applicable) or rely on another valid Data Transfer Mechanism before the transfer takes place.

7. Conflict

If this DPA conflicts with the Agreement, this DPA will control with respect to the Processing of Personal Data. If any Data Transfer Mechanism the parties enter into conflicts with this DPA, the Data Transfer Mechanism will control.

8. Term and changes

This DPA remains in effect for as long as Dolly Processes Customer Personal Data under the Agreement, including after the Agreement ends until the Personal Data is returned or deleted under Section 3.1(h). Dolly may update this DPA to reflect changes in DP Law, its Sub-processors, or the Services. Changes will not materially reduce the protection of Customer Personal Data, and Dolly will post the updated DPA on this page with a new “last updated” date.

9. Definitions

“Authorized User” means an individual Customer authorizes to use a Dolly card or access the Services, including crew members, as described in the Authorized User Terms.

“CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations.

“Customer Personal Data” means Personal Data that Dolly Processes on Customer’s behalf as a Data Processor in providing the Services.

“Data Controller” means the party that determines the purposes and means of Processing Personal Data, including a “business” or “controller” under US State DP Law.

“Data Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Dolly’s or its Sub-processors’ control.

“Data Processor” means the party that Processes Personal Data on behalf of a Data Controller, including a “service provider” or “processor” under US State DP Law.

“Data Security Measures” means the technical and organizational measures described in Exhibit B.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.

“Data Transfer Mechanism” means a lawful mechanism for transferring Personal Data across borders under DP Law, including the Standard Contractual Clauses.

“DP Law” means all data protection and privacy laws that apply to the Processing of Personal Data under the Agreement, including US State DP Law and, where applicable, the GDPR and UK GDPR.

“Envelope Data” means the transactions, coding, receipts, and related notes and approvals for a production or other budget in the Services.

“GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation).

“Instructions” means Customer’s documented instructions for Processing Personal Data, as given through the Agreement, this DPA, and Customer’s configuration and use of the Services.

“Personal Data” means any information relating to a Data Subject, including “personal data” under the GDPR and “personal information” under US State DP Law.

“Program Manager” means the company that runs a Dolly Card program with the issuing bank: Stripe for Dolly Card Visa® cards and Lithic for Dolly Card Mastercard® cards.

“Process” means any operation performed on Personal Data, such as collection, recording, organization, storage, retrieval, use, disclosure, or deletion. “Processing” and “Processed” have corresponding meanings.

“Sensitive Data” means Personal Data that DP Law treats as sensitive or as a special category, including “sensitive personal information” under the CCPA.

“Standard Contractual Clauses” means the clauses adopted by European Commission Decision (EU) 2021/914, and the equivalent UK and Swiss addenda where applicable.

“State-Defined Sensitive Data” means Customer Personal Data whose unauthorized access or acquisition requires notice under the data breach notification law of the US state where the affected Data Subject resides, such as a name combined with a Social Security number, driver’s license number, or financial account number and access code.

“Sub-processor” means a third party Dolly engages to Process Customer Personal Data.

“UK GDPR” means the GDPR as it forms part of the law of the United Kingdom.

“US State DP Law” means the CCPA and the comprehensive consumer privacy laws of other US states, such as those of Virginia, Colorado, Connecticut, and Utah, to the extent they apply.

“Wrap” means the date Customer marks a production as wrapped in the Services, or, if it does not, the date of the production’s last card transaction.

Exhibit A: Description of Processing

Subject matter and duration

Dolly’s provision of the Services to Customer under the Agreement, for the term of the Agreement and until Customer Personal Data is returned or deleted under Section 3.1(h).

Nature and purpose

Collection, storage, organization, retrieval, analysis, transmission, and deletion of Customer Personal Data to provide the Services, as described in Section 2.

Categories of Data Subjects

• Customer’s owners, officers, and account administrators;
• Customer’s employees, crew members, contractors, and other Authorized Users who hold cards or use the Services;
• accountants, production managers, and other personnel Customer invites to review, code, or approve spending; and
• individuals whose details appear on receipts or attachments that Customer’s users submit.

Categories of Personal Data

• Identity and contact data: name, email address, phone number, mailing address, job title, department, and production.
• Verification data: date of birth, Social Security number or taxpayer ID, and government ID images that Customer submits through the Services so the Program Manager can complete KYC and KYB.
• Card data: the last four digits of each card, card status, spending limits, and controls. Dolly does not store full card numbers or security codes.
• Transaction data: merchant name and category, amount, date, time, and merchant location.
• Attachment and expense data: receipts and other attachments, the text read from them, the content and sender of text messages and emails used to submit receipts or requests, account and vendor codes, notes, and approvals.
• Funding data: bank account details used to fund Customer’s Dolly account, processed by Stripe.
• Technical data: IP address, device and browser information, sign-in records (including sign-in through Google), and logs of activity in the Services.

Sensitive Data

Social Security numbers or taxpayer IDs, government ID images, and financial account details, which Dolly passes to the Program Managers for KYC, KYB, and funding. Customer should not submit other Sensitive Data, such as health information, in receipts, notes, or attachments.

Frequency

Continuous, for as long as Customer uses the Services.

Retention

Envelope Data is kept for up to two years after the Wrap of its production, or longer where Dolly and Customer agree, and is exported to a Customer-owned drive folder before Dolly stops storing it. Other Customer Personal Data is kept for the term of the Agreement. All Customer Personal Data is then returned or deleted under Section 3.1(h), except where law requires Dolly to keep it longer.

Exhibit B: Data Security Measures

Dolly maintains the following measures. Dolly’s controls are examined by an independent CPA firm under the AICPA SOC 2 framework for security, and Dolly makes its most recent SOC 2 Type 2 report available under Section 3.1(g).

Security program and governance

• Written information security policies, reviewed and approved at least once a year, which all personnel must read and accept.
• A Security Steering Committee that meets quarterly to oversee security, and senior management review of risks and resources at least once a year.
• A formal risk assessment at least once a year, with a risk register that tracks how each identified risk is mitigated.
• Continuous compliance monitoring of internal controls, with exceptions tracked to resolution.

Personnel

• Background checks for personnel, as permitted by local law.
• A Code of Conduct that all new personnel accept.
• Security awareness training when personnel join and every year after.
• Disciplinary action for personnel who violate security policies.

Access control

• Access to production systems granted on the principle of least privilege, based on a documented business need and approval.
• Unique accounts for each person, with no shared accounts.
• Strong password requirements, and multi-factor authentication and single sign-on wherever available.
• Access reviews every quarter.
• Access removed within 24 hours of a person’s last working day.
• Company devices protected with strong passwords, anti-virus software, and full-disk encryption.

Encryption

• All databases and stored files, including receipts and identity documents, encrypted at rest.
• All data encrypted in transit over public networks using HTTPS.
• Production systems and storage containing customer data configured to block public access without authentication.

Card data

• Dolly does not store, process, or transmit full card numbers or security codes. It stores only the last four digits of each card.
• When a cardholder views full card details, they are displayed in a secure frame served directly by the PCI DSS compliant Program Manager, such as Stripe, so the details never pass through Dolly’s systems.

AI and attachment processing

• Receipts and other attachments are read using OCR and AI Sub-processors listed in Exhibit C, through their business APIs.
• Dolly sends these Sub-processors only the content needed to read and code an attachment or transaction.

Infrastructure and network

• Production systems hosted on Amazon Web Services (AWS) in the United States. Dolly operates no physical data centers, and physical and environmental security is provided by AWS.
• Firewalls, network gateways, and intrusion detection that filter traffic and enforce encryption.
• Network and baseline configurations reviewed at least once a year.

Vulnerability management

• Continuous vulnerability scanning of code and infrastructure, with critical and high findings remediated according to severity.
• Penetration testing by an independent third party at least once a year.

Change management

• Version control for all code and infrastructure configuration.
• Separate environments for development, testing, and production.
• At least one independent review and approval before any change is merged to production.
• Notifications to designated personnel whenever changes are deployed.

Logging and monitoring

• Logging of access to production infrastructure, kept according to policy.
• Monitoring and alerting for security threats, unusual activity, and system performance, with alerts tracked to resolution.

Incident response

• A Security Incident Response Plan covering detection, containment, mitigation, and communication, including notice to affected customers.
• An incident response tabletop exercise every year, and a lessons-learned review after confirmed incidents.
• A public channel for reporting security concerns at security@dollycard.com.
• Cybersecurity insurance.

Business continuity

• A Business Continuity and Disaster Recovery Policy governing how service is restored after a disruption, reviewed every year.
• Managed database backups on AWS.

Vendor management

• A Vendor Management Policy requiring due diligence before Dolly engages a vendor, and written agreements that include security requirements.
• A review of the security and compliance reports of higher-risk vendors at least once a year.

Exhibit C: Sub-processors

Dolly uses the following Sub-processors to Process Customer Personal Data. The issuing banks, Celtic Bank and Patriot Bank, N.A., and the card networks act as independent controllers and are not listed as Sub-processors. Stripe and Lithic are listed here for the data they Process for Dolly. For their own card program duties they act as independent controllers, as described in Section 2.