Legal

Data processing agreement

The terms on which CloudDesk processes personal data for customers. Last updated the 12th of June.

Parties and scope

This agreement applies where CloudDesk processes personal data on behalf of a customer workspace. It supplements the terms of service and takes precedence where the two conflict.

Processing instructions

CloudDesk processes personal data only to provide the workspace service, to secure it, and to respond to documented instructions from the customer. We do not sell personal data and we do not use customer workspace content to train models.

Security measures

Measures include encryption in transit and at rest, unprivileged application containers, read-only secret mounts, role based access control, audit logging and annual third-party penetration testing.

Sub-processing

The customer authorises the use of the sub-processors listed in the current schedule. We impose equivalent data protection obligations on every sub-processor and remain liable for their performance.

International transfers

Where data leaves the European Economic Area, transfers rely on the European Commission's standard contractual clauses or an equivalent adequacy mechanism selected by the customer.

Assistance and audits

We assist the customer with data subject requests, breach notification within 72 hours, and one documentation-based audit per year. On-site audits are available on the Enterprise plan.