Data Processing Agreement (DPA)

Unless otherwise defined here, capitalized terms have the meanings given in the Deskbolt Terms of Service.

• "Account Data" means personal data relating to the Customer's account — such as login credentials, billing details, and account configuration.
• "Applicable Data Protection Laws" means all data protection and privacy laws applicable to the processing of Personal Data under this DPA, including the GDPR, UK GDPR, Swiss DPA, and the CCPA/CPRA.
• "Customer Personal Data" means personal data that Deskbolt processes on behalf of the Customer while providing the Services.
• "Data Controller" (or "Controller") means the Customer, who determines the purposes and means of processing.
• "Data Processor" (or "Processor") means Deskbolt, which processes personal data on behalf of the Controller.
• "Subprocessor" means any third party engaged by Deskbolt to process Customer Personal Data.
• "Services" means the Deskbolt AI SaaS platform, including live chat, WhatsApp integrations, CRM synchronizations, AI automation, analytics, and related services.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Restricted Transfer" means a transfer of personal data outside of the EEA or UK that is not covered by an adequacy decision.
• "Security Breach" means any confirmed unauthorized access to, or disclosure of, Customer Personal Data that compromises its confidentiality, integrity, or availability.

• This DPA applies to Deskbolt's processing of Customer Personal Data as a Processor on behalf of the Customer.
• The subject matter of processing is the provision of the Deskbolt Services, including lead capture, qualification, and automation.
• The duration of processing corresponds to the duration of the Customer's subscription, unless otherwise required by law.

The Customer is responsible for:

• Ensuring that the collection and transfer of personal data to Deskbolt comply with applicable laws.
• Providing lawful bases for processing (e.g., consent, legitimate interest).
• Informing data subjects about Deskbolt's role as Processor.
• Managing requests from data subjects (access, rectification, deletion, etc.).

• Deskbolt limits access to Customer Personal Data to employees or service providers who need it to perform their duties and who are bound by confidentiality obligations.
• All employees receive security and privacy training.
• Deskbolt conducts background and compliance checks where legally permitted.

Deskbolt implements industry-standard technical and organizational measures, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Multi-factor authentication and access control (RBAC)
• Segregation of data by tenant
• Firewalls, WAF, and intrusion detection
• 24/7 infrastructure monitoring
• Daily encrypted backups and disaster recovery systems
• Annual external penetration tests and vulnerability management

Details are available in our Security & Compliance documentation.

If Deskbolt becomes aware of a confirmed Security Breach, it will:

1. Notify the Customer without undue delay (within 24 hours).
2. Provide available details on scope, impact, and remediation.
3. Cooperate with the Customer to meet regulatory reporting obligations.

Deskbolt will not make public statements about the breach without prior written consent.

Deskbolt provides tools and assistance to help Customers respond to data subject requests under applicable laws.

• Customers can delete or export data directly from their dashboard.
• If a request is received directly by Deskbolt, it will notify the Customer without responding unless legally required.
• Deskbolt never contacts a Customer's end-users for marketing or unrelated purposes.

Deskbolt retains personal data only as long as necessary:

Upon account termination:

• Customer data is deleted or anonymized within 60 days,
• Backup copies are securely purged within 30 days thereafter, unless retention is legally required.

Customer data is hosted on cloud infrastructure provided by Google Cloud Platform (primary application hosting) and Amazon Web Services (database hosting via Neon). The primary database is located in the United States. Several of our subprocessors are also established outside the EEA.

For all transfers of personal data from the EEA, the UK or Switzerland to the United States or other third countries, Deskbolt relies on the following lawful transfer mechanisms under Chapter V of the GDPR:

• Standard Contractual Clauses (2021 version) approved by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), executed automatically under this DPA;
• EU–US Data Privacy Framework (Adequacy Decision (EU) 2023/1795 of 10 July 2023), where our subprocessors are certified to it (notably Google, AWS, OpenAI, Microsoft, Meta);
• For UK customers, the UK Addendum to the SCCs issued by the ICO;
• For Swiss customers, the Swiss SCCs;
• Additional safeguards: encryption in transit (TLS 1.3) and at rest (AES-256), strict access controls, data minimization.

Deskbolt relies on independent third-party audits of its infrastructure providers (AWS, GCP, 360dialog, Twilio, etc.), all of which maintain ISO 27001, SOC 2 Type II, and equivalent certifications.

Customers may request security documentation or audit reports at any time by contacting hello@deskbolt.com. Formal on-site audits may be arranged upon reasonable notice, subject to confidentiality and operational limits.

Deskbolt will provide reasonable assistance to Customers in:

• conducting DPIAs or risk assessments,
• consulting supervisory authorities when legally required,
• providing necessary information about processing operations and safeguards.

Deskbolt does not sell, rent, or share Customer Personal Data for monetary or advertising purposes. Processing is limited to the legitimate business purposes of providing and maintaining the Services.

Deskbolt's lawful data transfer framework includes:

• Standard Contractual Clauses (Modules 2 and 3), executed automatically under this DPA.
• For UK customers, the UK Addendum to the SCCs issued by the ICO.
• For Swiss customers, the Swiss SCCs.
• Where available, reliance on the EU–US DPF and equivalent frameworks.

If these mechanisms are replaced or invalidated, Deskbolt will adopt an alternative lawful transfer solution and update this DPA accordingly.

This DPA is governed by the laws of Spain, and disputes shall be subject to the jurisdiction of the courts of Madrid, Spain, unless otherwise required by mandatory data protection law.

For all privacy and data protection inquiries, please contact:

Deskbolt (MEDIASWAPP SL)

Attn: Data Protection Officer

Calle Hermosilla 48, 1-DR

28001 Madrid, Spain

Email: hello@deskbolt.com