Data Processing Agreement
Last updated October 5, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between DeskCrew (“DeskCrew,” “we”) and the business that operates a DeskCrew workspace (the “Customer”). It applies whenever DeskCrew processes personal data on the Customer’s behalf, and it is accepted when the Customer accepts the Terms. Customers who need a countersigned copy can email [email protected].
1. Roles
For personal data inside support content (tickets, messages, attachments, knowledge-base content and the end-customer details in them), the Customer is the controller and DeskCrew is the processor. DeskCrew processes that data only to provide the Service and only on the Customer’s documented instructions, which are the Terms, this DPA, and the settings the Customer chooses in its workspace. If we believe an instruction breaks data-protection law, we will tell the Customer.
2. What is processed
- Subject matter and purpose: running a support helpdesk for the Customer: receiving, storing, routing, answering and reporting on support conversations.
- Duration: while the Customer’s workspace is active, plus the wind-down period in section 8.
- Data subjects: the Customer’s end-customers and website visitors who contact it, and the Customer’s own team members who use the workspace.
- Categories of data: names, email addresses and other contact identifiers, message content and attachments, an approximate country derived from widget and chat requests, and technical data such as browser type. DeskCrew does not ask for special-category data; the Customer should not instruct end-customers to send it.
3. Confidentiality
Everyone at DeskCrew who can access Customer personal data is bound by confidentiality, and access is limited to what is needed to run, support and secure the Service.
4. Security
DeskCrew maintains technical and organisational measures appropriate to the risk, including encryption in transit, encryption of stored secrets, strict separation of each workspace’s data, access controls with an audit trail, rate limiting and abuse protection. The current measures are described on our Security page, which forms part of this DPA. We may improve these measures over time but will not reduce their overall protection.
5. Personal data breaches
If DeskCrew becomes aware of a breach affecting the Customer’s personal data, we will notify the Customer without undue delay and in any case within 72 hours, with what we know about its nature, likely effects and the steps being taken, and we will keep the Customer updated as we learn more.
6. Subprocessors
The Customer gives general authorisation for DeskCrew to use subprocessors. Each one is bound by written terms that protect personal data at least as well as this DPA, and DeskCrew remains responsible for their work. Our subprocessors, by role:
| Role | What it does | Where |
|---|---|---|
| Application hosting | Runs the Service and serves its pages and APIs. | Singapore |
| Database and file storage | Stores workspace data, tickets, messages and attachments. | Singapore |
| Network protection | Delivers traffic securely and filters abuse before it reaches the Service. | Global edge network |
| Email delivery | Sends ticket notifications and replies, and receives email-to-ticket messages. | United States |
| AI model provider | Generates answers and drafts, only for AI features a workspace has turned on (see our AI Policy). | United States |
| Subscription payments | Processes plan subscriptions and card top-ups. Card details never reach DeskCrew. | United States |
| Card checkout for USDC credit | Signs the buyer in by email and sells USDC by card on the pay page. Only the buyer’s email and payment details are processed there. | United States |
Customers can request the named list at [email protected]. We will give Customers who have asked to be notified at least 30 days’ notice by email before adding or replacing a subprocessor. A Customer may object on reasonable data-protection grounds; if we cannot address the objection, the Customer may close its workspace and receive a pro-rata refund of prepaid subscription fees for the remaining term.
7. International transfers
The Service is hosted in Singapore, and some subprocessors operate in the United States. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses (and the UK Addendum where it applies), which are incorporated into this DPA by reference.
8. Deletion and return
When a workspace closes, the Customer can export its data during a wind-down period, after which DeskCrew deletes it, except where law requires us to keep it. Backups age out on their normal schedule. The Customer can also ask us to delete data sooner.
9. Assistance and audits
DeskCrew will help the Customer, taking into account the nature of the processing, to respond to data-subject requests, carry out impact assessments and meet its security obligations. On request, we will make available the information needed to show compliance with this DPA, including written answers to reasonable security questionnaires. Any on-site audit is by prior agreement, at the Customer’s cost, and limited to what the law requires.
10. Liability and precedence
Each party’s liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict on the processing of personal data, this DPA wins.
This DPA is provided for transparency and is not legal advice. Please have qualified counsel review it before relying on it.