Data Processing Addendum

1.Parties and how this addendum applies

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the company that operates Cloudesk (“Processor”, “we”) and the customer that owns a Cloudesk workspace (“Customer”, “you”). It applies automatically, without signature, whenever we process Customer Personal Data on your behalf. If you need a countersigned copy for your records, use the details on our contact page.

“Customer Personal Data” means personal data in Customer Content (as defined in the Terms). “Data Protection Law” means all laws that apply to its processing, including India's Digital Personal Data Protection Act, 2023 and rules under it (“DPDP Act”), the Information Technology Act, 2000 and rules under it, the EU GDPR, the UK GDPR and Data Protection Act 2018, and the CCPA as amended by the CPRA. Terms such as “controller”, “processor”, “data fiduciary”, “data principal”, “personal data breach” and “sub-processor” have the meanings given in Data Protection Law.

2.Roles

You are the controller (data fiduciary) of Customer Personal Data and we are your processor (data processor). Where you are yourself a processor for someone else, we are your sub-processor and you confirm that your instructions are authorised by your controller. You are responsible for having a lawful basis, giving notices and obtaining any consents needed for the processing — including parental consent for children's data and explicit consent for health data where required.

3.Details of the processing

4.Processing only on your instructions

We process Customer Personal Data only on your documented instructions — which are the Terms, this DPA, and your use and configuration of the Service — unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits it. We will tell you if we believe an instruction infringes Data Protection Law. We will not sell Customer Personal Data, use it for advertising, combine it with data from other customers, or use it for any purpose other than providing, securing and supporting the Service.

5.Confidentiality and personnel

We ensure that anyone we authorise to process Customer Personal Data is bound by confidentiality, and that access is limited to people who need it to run or support the Service. Workspace owners can grant our support team time-limited access to a workspace for a stated reason (up to 72 hours), and each grant is recorded in the workspace's audit log.

6.Security measures

We implement appropriate technical and organisational measures, taking into account the state of the art, cost, and the risks to data subjects, including:

• encryption in transit (HTTPS/TLS with HSTS) and AES-256-GCM encryption of stored credentials, mailbox secrets and two-step sign-in secrets;
• Argon2id password hashing, hashed session tokens, two-step sign-in, SSO (SAML/OIDC) and SCIM provisioning;
• separation of workspaces enforced on the server for every request, role-based access with custom roles, and audit logging;
• a web application firewall, rate limiting, same-origin checks against cross-site request forgery, and a Content Security Policy;
• database backups on the schedule set for the platform's hosting, and processes for testing and reviewing these measures.

More detail is on our Security page. We may update these measures as long as the overall level of protection is not reduced.

7.Sub-processors

You authorise us to use the sub-processors listed on our Sub-processors page. We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance. We will update that page before a new sub-processor starts processing Customer Personal Data and, if you have asked us to, notify you by email at least 15 days in advance. You may object on reasonable data-protection grounds within that period; if we can't reasonably accommodate the objection, you may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

8.Helping you with requests and compliance

Taking into account the nature of the processing, we help you respond to requests from data principals / data subjects to exercise their rights (access, correction, erasure, portability, objection, grievance redressal and nomination) — largely through the Service itself, which lets you find, edit, export and delete records. If we receive a request directly, we will pass it to you and not respond ourselves except to direct the person to you.

We also give you reasonable help with data protection impact assessments, prior consultations with authorities, and your security obligations, using information available to us.

9.Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any case within the time that lets you meet your own deadlines (including the DPDP Act's requirement to inform the Data Protection Board and affected data principals, and the GDPR's 72-hour window). The notice will describe, as far as known, the nature of the breach, the data and data subjects concerned, likely consequences, and the measures taken or proposed. We will take reasonable steps to contain it, and we report cyber-security incidents to CERT-In as Indian law requires.

10.Return and deletion

During your subscription you can export Customer Personal Data at any time (lists as CSV or Excel, or the whole workspace as a machine-readable file). When a workspace is deleted — by you, or after your account ends — we delete Customer Personal Data from the live systems after a 30-day grace period, and copies in backups expire on the backup schedule, unless the law requires us to keep some of it, in which case we keep it protected and only for that purpose.

11.Information and audits

We will make available the information reasonably needed to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, by you or an independent auditor you appoint and who is bound by confidentiality. Audits must be requested with at least 30 days' notice, take place during business hours no more than once a year (unless required by a regulator or after a breach), avoid disrupting the Service or exposing other customers' data, and be at your cost. We will first try to satisfy a request with written answers and documentation.

12.International transfers

We may process Customer Personal Data, and use sub-processors that process it, outside the country where you are located, subject to this DPA. We will comply with any restriction on transfers notified by the Government of India under the DPDP Act.

Where Customer Personal Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) — Module 2 (controller to processor) or Module 3 (processor to processor) as applicable — and, for the UK, the International Data Transfer Addendum, are incorporated into this DPA by reference. For those clauses: the optional docking clause applies; option 2 (general authorisation) applies to sub-processors with the notice period in section 7; the clauses are governed by the law of Ireland (or, for the UK Addendum, the law of England and Wales); the details of processing are in section 3 and the security measures in section 6.

13.California (CCPA/CPRA)

Where the CCPA applies, we act as your service provider. We will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship with you or for any purpose other than the business purposes in this DPA, or combine it with personal information from other sources except as the CCPA permits. We will tell you if we can no longer meet these obligations.

14.Liability, precedence and contact

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow them. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; if the Standard Contractual Clauses conflict with this DPA, the clauses prevail.

Questions about this DPA? use the details on our contact page.

You can reach us through our contact page.