This Data Processing Agreement (“DPA”) is between the Customer and Digital Workspace (“Digital Workspace”, “we”). It forms part of the Terms of Service (or any other agreement under which the Customer uses the Digital Workspace cloud service) and applies automatically, without signature, whenever we process Customer Personal Data. A Customer that needs a countersigned copy can request one at info@digitalworkspace.app.
If this DPA conflicts with the Terms, this DPA wins for matters of data protection. Terms not defined here have the meaning given in the applicable data protection law or the Terms.
1. Definitions
- Data Protection Laws: all laws that apply to the processing of Customer Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws, and the Law of the Republic of Uzbekistan “On Personal Data”.
- Customer Personal Data: personal data in Customer Data (as defined in the Terms) that we process on the Customer’s behalf.
- Subprocessor: a third party we engage to process Customer Personal Data.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
2. Roles and scope
For Customer Personal Data, the Customer is the controller (or a processor acting for its own controllers) and Digital Workspace is the processor (or subprocessor). Under the CCPA, Digital Workspace is a “service provider”. Digital Workspace is a separate controller only for the account, billing and security data described in our Privacy Policy.
This DPA covers the cloud service. On-premise installations run on the Customer’s own servers; there we do not host or access Customer Personal Data, and only receive the licensing data described on our subprocessors page. If the Customer gives us access to an on-premise installation for support, this DPA applies to that access.
3. Details of processing
| Subject matter | Providing, securing and supporting the Digital Workspace service. |
|---|---|
| Duration | The term of the Customer’s subscription, plus the retention and deletion period in section 11. |
| Nature and purpose | Hosting, storage, transmission, display, search, backup and deletion of Customer Data; sending emails the Customer’s users write or launch; support at the Customer’s request. |
| Categories of data subjects | The Customer’s users (employees, contractors); the Customer’s contacts, leads, customers, suppliers and job candidates; people who submit the Customer’s public web forms or sign its documents; other people whose data the Customer puts into the service. |
| Categories of personal data | Names, contact details, job and organization details, CRM and service records, messages and emails, documents and files, signatures and signing audit trails, HR records such as time off, shifts and training, and usage and security logs. |
| Special categories | Only what the Customer chooses to store, for example health-related reasons for time off. The Customer is responsible for having a legal basis for such data. The security measures in Annex 1 apply to it. |
| Frequency | Continuous for the duration of the service. |
4. Processing on instructions
We process Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use and configuration of the service are those instructions. We will tell the Customer if we believe an instruction breaks Data Protection Laws, unless the law forbids us to.
We do not sell or share Customer Personal Data, do not use it for our own purposes or for advertising, do not combine it with personal data from other sources except as needed to provide the service, and do not use it to train generalized artificial-intelligence models. We may process it where the law requires; in that case we will tell the Customer first unless the law forbids it.
5. Confidentiality
Everyone we authorize to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed for the purposes above.
6. Security
We implement and maintain the technical and organizational measures in Annex 1, and review them as risks and technology change. We may update them as long as the overall level of protection does not decrease.
7. Subprocessors
- The Customer gives general authorization for us to use the Subprocessors listed on our subprocessors page.
- We impose data protection obligations on each Subprocessor that are at least as protective as this DPA, and we remain responsible for their performance.
- We will notify the Customer by email at least 30 days before a new Subprocessor starts processing Customer Personal Data. The Customer may object within that period on reasonable data protection grounds. We will then work in good faith to find a solution; if we cannot, the Customer may terminate the affected service and receive a refund of prepaid fees for the unused period.
8. International transfers
Customer Data is stored in the European Union (Frankfurt, Germany). Some Subprocessors may access it from other countries, including the United States, as listed on the subprocessors page.
- For transfers of personal data subject to the GDPR to a country without an adequacy decision, the parties agree to the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, which are incorporated by reference. Clause 7 (docking) applies; in Clause 9 option 2 (general authorization) applies with the notice period in section 7; in Clause 11 the optional language does not apply; Clauses 17 and 18 are governed by the law and courts of Ireland. Annex I is completed by section 3 and Annex II by Annex 1 of this DPA.
- For UK and Swiss personal data, the UK International Data Transfer Addendum and the Swiss amendments to the Standard Contractual Clauses apply in the same way.
- Where a recipient is certified under the EU–US, UK or Swiss–US Data Privacy Framework, we may rely on that certification instead.
- For personal data subject to the Law of the Republic of Uzbekistan “On Personal Data”, data is stored in jurisdictions the Cabinet of Ministers lists as giving adequate protection, or transferred with the safeguards that law requires. We do not store biometric or genetic data in the cloud service.
9. Assistance and data subject requests
- The service lets the Customer access, correct, export and delete Customer Personal Data itself. Where it cannot, we will help the Customer respond to requests from data subjects, at no extra charge where the request is reasonable.
- If a data subject contacts us directly about Customer Personal Data, we will refer them to the Customer and not respond ourselves unless the Customer asks us to or the law requires it.
- We will give reasonable help with data protection impact assessments and consultations with supervisory authorities, taking into account the information available to us.
10. Security incidents
We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident affecting its Customer Personal Data. Notices go to the Customer’s Workspace Administrators by email.
The notice will describe, as far as we know at the time, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will give more information as it becomes available, take reasonable steps to contain and fix the incident, and support the Customer in meeting its own notification duties. Notifying a Security Incident is not an admission of fault.
11. Return and deletion
During the subscription, the Customer can export and delete Customer Data in the service. When the subscription ends, the workspace is paused and its data kept for 60 days so the Customer can return or export it. We then delete Customer Personal Data within a further 30 days, and from rolling backups as they expire, unless the law requires us to keep it. On request, we will confirm deletion in writing.
12. Audits
We will make available the information reasonably needed to show compliance with this DPA, including answers to reasonable security questionnaires and our Subprocessors’ audit reports where available. If that is not enough, or a supervisory authority requires it, the Customer may audit our compliance once a year, with at least 30 days’ written notice, during business hours, under confidentiality, and at its own cost, in a way that does not compromise other customers’ data or our security.
13. Liability and term
Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. This DPA lasts as long as we process Customer Personal Data. We may update it to reflect changes in law or in the service, without reducing the protection it gives; we will notify Customers of material changes. Questions: info@digitalworkspace.app.
14. Annex 1: Technical and organizational measures
- Hosting and encryption: data stored in the EU (Frankfurt) on infrastructure encrypted at rest; all traffic encrypted in transit with HTTPS (TLS).
- Tenant isolation: every query is scoped to one workspace on the server; the database’s direct API is closed on every table (row-level security with no public access).
- Access control in the service: role-based access (System Admin, Workspace Admin, Member), per-module permissions, record-level ownership rules and confidential-document controls, all enforced on the server.
- Authentication: passwords stored only as salted bcrypt hashes; strong-password rules; brute-force throttling on sign-in, sign-up and password reset; revocable server-side sessions with an inactivity timeout, a maximum session length and a limit on devices per person; other sessions signed out when a password changes.
- Secrets: keys and credentials kept in the hosting provider’s encrypted settings, never in the browser; mailbox tokens stored server-side only.
- Internal access: production access limited to authorized staff who need it, on accounts protected by the providers’ multi-factor sign-in.
- Change history: history of changes to CRM records, work items and documents; e-signature audit trails.
- Availability: managed database backups by our database provider; documented restore procedures.
- Incident response: a written breach response procedure with defined notification timelines.
- Subprocessors: chosen for their security practices and bound by written data protection terms.
- Data minimization: cookieless analytics with workspace names, record IDs and one-time links removed; on-premise usage reports contain counts only.