Data Processing Agreement
Last updated
About this agreement
This Data Processing Agreement (“DPA”) applies when you use Desklet for a business or an organization and your content holds personal data about other people. It is part of our Terms of Service. “We” and “us” are Alexander Kovalev, Porajowska 14/2, 54-106 Wrocław, Poland. “You” are the person or organization that holds the Desklet account.
It applies from the day you accept the Terms and lasts as long as we process this personal data for you. You do not need to sign anything. If you need a signed copy, write to [email protected] and we send one.
If this DPA and the Terms disagree about personal data, this DPA wins. If the Standard Contractual Clauses apply (see International transfers), they win over both.
Definitions
“Data protection law” means the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and other data protection laws that apply to the personal data. “Customer data” means the personal data in your content that we process for you. “Controller”, “processor”, “personal data”, “personal data breach” and “subprocessor” have the meaning they have in the GDPR.
Roles
For customer data, you are the controller and we are your processor. If you are a processor for someone else, we are your subprocessor, and you confirm that your instructions to us match those of the controller.
For personal data about you as our customer, such as your account, billing and technical data, we are a controller, as the Privacy Policy says. This DPA does not cover that data.
What we process
| Item | Details |
|---|---|
| Subject matter | Running Desklet for you: storing your content, showing it on your devices, giving your agents the access you chose, sorting your items automatically, emailing you about the service |
| Duration | While your account exists, and as long as the Terms and the Privacy Policy say we keep the content |
| Nature | Storing, copying between your devices, making thumbnails, transmitting, reading by the agents you connect, classifying, deleting |
| Purpose | Providing Desklet to you under the Terms |
| Data subjects | Anyone about whom you put personal data in your content: your colleagues, customers, contacts and others |
| Personal data | Whatever your content holds: names, contact details, text, files, images and links. We do not ask for any particular kind |
Desklet is not built for special categories of personal data, such as health data, or for data about criminal convictions. You decide what goes into your content, and you are responsible for having a legal basis for it.
Instructions
We process customer data only on your documented instructions. The Terms, this DPA and your use of Desklet’s features, such as putting an item on a desk, connecting an agent, sharing a code or deleting an item, are your instructions. We tell you if we think an instruction breaks data protection law. We may also process customer data when the law requires it, and we tell you first unless the law forbids it.
Confidentiality and security
Everyone who works for us and can reach customer data is bound to keep it confidential. We protect customer data with the measures in Security measures and keep them in line with the risk.
Personal data breaches
If we learn of a personal data breach that affects customer data, we tell you without undue delay and give you what we know to help you meet your own duties: what happened, which data it touches and what we are doing about it. We keep you informed as we find out more.
Help with your duties
- Requests from people. If someone asks us about customer data, we pass the request to you and do not answer it ourselves, unless the law requires it. You can export and delete data in the app. For anything the app does not do, we help on request.
- Assessments. On request, we give you the information you reasonably need for a data protection impact assessment or a consultation with an authority.
Deletion and return
You can export your data at any time, also while your desks are read-only. When your plan ends or you delete your account, we delete customer data as the Terms and the Privacy Policy describe. Backup copies expire as the Privacy Policy describes. We keep a copy longer only where the law requires it.
Audits
On request, we give you the information needed to show that we meet this DPA. If that is not enough, you may audit us once a year, or after a personal data breach, on at least 30 days’ written notice, in working hours, remotely where possible, under a confidentiality agreement and at your own cost. An audit may not reach the data of other customers.
Subprocessors
You allow us to use the subprocessors listed in the Privacy Policy. We have a contract with each of them that binds it to the same data protection duties as this DPA, and we stay responsible for what they do.
We add a new subprocessor to that list before it receives customer data. You can subscribe to emails about changes by writing to [email protected], and we send the email at least 30 days before the change. If you object on reasonable data protection grounds within that time, we try to find a solution with you. If we cannot, you may end your subscription, and we refund what you paid for the period after it ends.
International transfers
If customer data moves from the EU, the UK or Switzerland to a country that has no adequacy decision, the following apply and are part of this DPA:
- The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914): Module Two when you are a controller and Module Three when you are a processor. Clause 7 applies. Clause 9(a): option 2, with 30 days’ notice. The optional wording of clause 11(a) does not apply. Clauses 17 and 18: the law and the courts of the EU Member State where you are established, and if that law does not allow third-party beneficiary rights, of Ireland. The competent supervisory authority is the one of that Member State.
- The UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0) for transfers from the UK. In its table 4, neither party may end it.
- For transfers from Switzerland, the same Clauses, with references to the GDPR read as references to the Swiss Federal Act on Data Protection.
- Annex I of the Clauses is What we process, Annex II is Security measures, and Annex III is the list of subprocessors in the Privacy Policy.
Liability
Each party’s liability under this DPA is subject to the limits in the Terms, to the extent the law allows. Nothing here limits a liability to data subjects or to an authority that the law does not let us limit.
Changes
We may change this DPA when data protection law, a court or an authority requires it, or to improve it without lowering the protection of customer data. We email you at least 30 days before a material change takes effect.
Contact
Email [email protected] or write to Porajowska 14/2, 54-106 Wrocław, Poland.
Security measures
- Every connection to Desklet uses TLS.
- Files live in a storage bucket that is not public, and download links expire as the Privacy Policy describes.
- Sign-in links, codes, pairing words, share codes, AI link secrets and agent access keys are stored only as hashes.
- Every agent request is checked against the desks you gave that agent, and an agent never deletes or changes your items.
- The browser sign-in uses a cookie that scripts cannot read, and requests that change data are protected against other sites.
- A sign-in lasts 30 days, and you can sign out one device or all of them.
- We use no analytics and no advertising trackers. Request logs hold no request content and are overwritten by newer logs.
- Personal data is deleted as the retention table in the Privacy Policy says. Backups expire within 35 days.