Data Processing Agreement
Last updated: October 30, 2026
1. Parties and incorporation
This Data Processing Agreement ("DPA") is entered into between Deskfound Software Inc., a British Columbia company with its registered office at 1200 – 900 West Hastings Street, Vancouver, British Columbia V6C 1E5, Canada ("Deskfound"), and the customer identified in the signature block below or in the applicable Order Form ("Customer").
1.1 This DPA forms part of the Deskfound Terms of Service at https://www.deskfound.com/terms, or any other written agreement between the parties for the Services (the "Agreement"). It applies whenever Deskfound processes Customer Personal Data in providing the Services.
1.2 Order of precedence. For the processing of Customer Personal Data, this DPA prevails over the Agreement and over Deskfound's Privacy Policy. Where Annex 4 or Standard Contractual Clauses apply, they prevail over the rest of this DPA. The entire-agreement clause of the Agreement includes this DPA.
1.3 Effective date. This DPA takes effect on the later of the date it is signed by both parties and the Effective Date of the Agreement, and continues for as long as Deskfound processes Customer Personal Data.
2. Definitions
Capitalised terms not defined here have the meaning given in the Agreement.
- "Customer Personal Data" means Personal Data that Deskfound processes on Customer's behalf in providing the Services, as described in Annex 1.
- "Data Protection Laws" means all privacy and data protection laws that apply to the processing of Customer Personal Data, including those listed in Annex 4.
- "Personal Data" means information about an identified or identifiable individual, or any equivalent term (such as "personal information") under Data Protection Laws.
- "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- "Processing" means any operation performed on Personal Data, such as collection, storage, use, disclosure or deletion.
- "Sub-processor" means any third party Deskfound engages that processes Customer Personal Data.
- "Controller", "Processor", "Data Subject" and "Supervisory Authority" have the meanings given in the GDPR. Where other Data Protection Laws use different terms (for example "business" and "service provider" under the CCPA, "organization" under PIPEDA, or "database owner" and "holder" under Israeli law), the equivalent term applies.
3. Roles and processing instructions
3.1 Roles. Customer is the Controller of Customer Personal Data and Deskfound is its Processor. Deskfound is an independent Controller only for account administration, billing, security logging and its own business contact records, which its Privacy Policy covers.
3.2 Instructions. Deskfound will process Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA and Customer's configuration of the Services (for example, enabling Calendar Sync or the Slack integration) are Customer's complete instructions. Deskfound will tell Customer promptly if it believes an instruction breaks Data Protection Laws.
3.3 Legal requirements. If law requires Deskfound to process Customer Personal Data other than on Customer's instructions, Deskfound will tell Customer first, unless the law prohibits it.
3.4 Purpose limitation. Deskfound will use Customer Personal Data only to provide, secure, support and maintain the Services for Customer. Deskfound will not:
- sell or rent Customer Personal Data, or share it for cross-context behavioural advertising;
- disclose Customer Personal Data to advertising partners or use it for advertising, profiling or marketing to Customer's users;
- combine Customer Personal Data with data from other sources, except as needed to provide the Services;
- use Customer Personal Data to train, fine-tune or validate any artificial intelligence or machine learning model without Customer's prior written consent.
3.5 Aggregated data. Deskfound may create aggregated, de-identified usage statistics that cannot reasonably be linked to Customer or any individual, and use them to operate and improve the Services. Deskfound will not attempt to re-identify such data.
3.6 Customer responsibilities. Customer is responsible for having a lawful basis to provide Customer Personal Data to Deskfound and for giving any notices to, and obtaining any consents from, its users that Data Protection Laws require.
4. Personnel, confidentiality and security
4.1 Need-to-know access. Deskfound will limit access to Customer Personal Data to personnel and contractors who need it to provide the Services. Each is bound by written confidentiality obligations that survive the end of their engagement.
4.2 Training. Deskfound will give personnel with access to Customer Personal Data privacy and security training when they start and at least once a year.
4.3 Privacy officer. Deskfound's privacy officer is Christopher Wagner, reachable at privacy@deskfound.com. Deskfound will tell Customer if this changes.
4.4 Security measures. Deskfound will implement and maintain the technical and organisational measures in Annex 2, appropriate to the risk of the processing. Deskfound may update those measures, provided the overall level of protection does not decrease.
4.5 Confidentiality of Customer data. Deskfound will treat Customer Personal Data, and any calendar content synced through the Services, as Customer's Confidential Information under the Agreement. This obligation does not expire while Deskfound holds the data.
5. Sub-processors
5.1 Authorisation. Customer authorises Deskfound to use the Sub-processors listed in Annex 3 and at https://www.deskfound.com/sub-processors.
5.2 Sub-processor terms. Before a Sub-processor processes Customer Personal Data, Deskfound will put a written agreement in place that imposes data protection obligations no less protective than this DPA. Deskfound will assess each Sub-processor's security before engaging it.
5.3 Changes. Deskfound will give Customer at least 30 days' notice before adding or replacing a Sub-processor, by email to Customer's account contact or through a subscription on the sub-processor page.
5.4 Objection. Customer may object on reasonable data protection grounds within that 30-day period. The parties will discuss the objection in good faith. If Deskfound cannot reasonably avoid using the new Sub-processor for Customer, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused term.
5.5 Responsibility. Deskfound remains responsible to Customer for the acts and omissions of its Sub-processors as if they were its own.
6. International transfers
6.1 Where data is processed. Deskfound is based in Canada and its Sub-processors are based mainly in the United States, as listed in Annex 3. Customer Personal Data may be processed in those countries.
6.2 Transfer safeguards. Deskfound will only transfer Customer Personal Data across borders in compliance with Data Protection Laws. Where a transfer mechanism is required, the mechanisms in Annex 4 apply, including:
- for transfers from the EEA to Canada, the European Commission's adequacy decision for Canada (commercial organisations subject to PIPEDA);
- for onward transfers to Sub-processors in countries without adequacy, the EU Standard Contractual Clauses (Module 3, processor to processor) or the EU-U.S. Data Privacy Framework where the Sub-processor is certified;
- for the UK and Switzerland, the equivalent mechanisms described in Annex 4.
6.3 Changes in law. If a transfer mechanism is invalidated, the parties will cooperate to put an alternative in place.
7. Data subject requests and assistance
7.1 Requests to Deskfound. If Deskfound receives a request from a Data Subject about Customer Personal Data, it will forward the request to Customer within 3 business days and will not respond to it except to direct the individual to Customer, unless Customer instructs otherwise or law requires it.
7.2 Helping Customer respond. The Services let Customer's administrators access, correct, export and delete user data. Where Customer cannot do this itself, Deskfound will provide reasonable help within the timelines Data Protection Laws set.
7.3 Authority requests. If a Supervisory Authority, regulator or law enforcement body asks Deskfound for Customer Personal Data, Deskfound will tell Customer promptly unless the law prohibits it, and will disclose no more than the law requires.
7.4 Other assistance. Taking into account the nature of the processing, Deskfound will give Customer reasonable help with data protection impact assessments, prior consultations with Supervisory Authorities, and Customer's security obligations.
8. Personal Data Breach
8.1 Notice. Deskfound will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach.
8.2 Content. The notice will describe, as far as then known: what happened; the categories and approximate number of individuals and records affected; the likely consequences; the steps Deskfound has taken or will take; and a contact for more information. Deskfound will send updates as it learns more.
8.3 Response. Deskfound will take reasonable steps to contain, investigate and remedy the breach, and will help Customer meet any obligation to notify regulators or individuals.
8.4 No public statements. Deskfound will not name Customer in any notice to regulators, individuals or the public about the breach without Customer's prior agreement, unless law requires it.
8.5 No admission. Notifying a breach is not an admission of fault or liability.
9. Deletion, audits, liability and general terms
9.1 Deletion and return. Customer can export its data through the Services at any time. Within 30 days after the Agreement ends, or after Customer's written request, Deskfound will delete Customer Personal Data from its production systems. Backup copies will be overwritten in the normal backup cycle, within 90 days. On request, Deskfound will confirm the deletion in writing.
9.2 Retention required by law. If law requires Deskfound to keep any Customer Personal Data, Deskfound will tell Customer, keep it only as long as required, and continue to protect it under this DPA.
9.3 Audits. Deskfound will make available the information reasonably needed to demonstrate compliance with this DPA, including completing Customer's security questionnaire once a year. If that information is not enough, or a Supervisory Authority requires it, Customer may conduct an audit once every 12 months. Customer must give at least 30 days' notice, conduct it during business hours with minimal disruption, keep its findings confidential, and bear its own costs.
9.4 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow such a limitation.
9.5 Term and survival. This DPA ends when Deskfound no longer processes Customer Personal Data. Sections 4.5, 8, 9.1 and 9.2 survive until then.
9.6 Governing law. This DPA is governed by the laws of British Columbia and the federal laws of Canada that apply there, except where Annex 4 or the Standard Contractual Clauses require another law.
9.7 Changes. Deskfound may update this DPA to reflect changes in Data Protection Laws or the Services, with 30 days' notice. Updates will not reduce the protection given to Customer Personal Data. A signed DPA can only be amended in writing signed by both parties.
Signing. This DPA applies automatically to every customer under the Agreement. Customers who need a signed copy can request one at privacy@deskfound.com.
Annex 1 – Processing details
| Item | Details |
|---|---|
| Subject matter | Providing Deskfound's desk, room, parking and office booking Services under the Agreement |
| Duration | The term of the Agreement plus the deletion period in Section 9.1 |
| Nature of processing | Collection, storage, display, synchronisation, transmission and deletion as needed to run the Services |
| Purpose | Letting Customer's users book desks, rooms and parking, see who is in the office, organise office events, and receive booking notifications |
| Data Subjects | Customer's employees, contractors and other authorised users; guests and visitors Customer registers; and attendees Customer's users invite to meeting-room bookings, who may be outside Customer |
| Account data | First and last name, email address, profile photo, role, status, home office location, time zone and preferences; sign-in through Google, Microsoft or email |
| Booking data | Desk, parking and pet reservations, recurring series, check-ins, dates and times; favourite desks |
| Meeting-room bookings | For rooms booked through Deskfound: title, description, start and end time, organiser, attendee email addresses and video-call link |
| Workplace content | Office events, polls and votes, lunch places and likes, pet names and photos, guest names and email addresses |
| Slack data (if enabled) | Slack user ID, team ID and the channel used for notifications |
| Google Calendar data (if enabled) | The workspace's meeting-room list (read-only). For each user who connects their calendar: events Deskfound creates on that user's own calendar for their bookings, and, when the room view is open, the times and titles of events on room calendars, read live and not stored |
| Technical data | IP address, browser and device information, and access and error logs |
| Special categories | None. Customer should not upload special-category data, government IDs or payment card numbers into the Services |
| Sub-processors | As listed in Annex 3 |
Annex 2 – Technical and organisational measures
| Area | Measures |
|---|---|
| Encryption | TLS for all data in transit; AES-256 encryption at rest for the database, file storage and backups |
| Secrets | Google and Slack access tokens stored encrypted in a dedicated secrets vault, never in ordinary database tables |
| Tenant isolation | Every customer's data is separated by database row-level security, so one customer's users cannot query another's data |
| Access control | Sign-in through Google, Microsoft or email; role-based admin permissions in the Services; staff access on least privilege with MFA and a password manager |
| Calendar scope | Calendar access is optional and granted by each user. Deskfound writes only to the user's own calendar, invites rooms and attendees by email, and reads room calendars only to show availability. It does not use domain-wide delegation |
| Infrastructure | Hosted on Supabase and Cloudflare, both with SOC 2 Type II reports; no Deskfound-run physical servers; DDoS protection through Cloudflare |
| Environments | Separate test and production databases; production deploys run only through an automated, approved pipeline |
| Backups and recovery | Automatic daily encrypted database backups; restore procedures reviewed at least yearly |
| Logging and monitoring | Access and error logging on production systems; logs retained only as long as needed for security and troubleshooting |
| People | Confidentiality agreements for all staff and contractors; annual privacy and security training |
| Vendor management | Sub-processors reviewed for security before use and bound by written data protection terms |
| Incident response | Documented process to detect, contain and notify Personal Data Breaches, with a breach log |
Annex 3 – Sub-processors
Deskfound is moving from its current platform (built on Bubble) to a new platform. "Current" providers stop processing Customer Personal Data at cutover; "New" providers start then. The live list is at https://www.deskfound.com/sub-processors.
| Sub-processor | Purpose | Data processed | Location | Platform |
|---|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage and backups | All Annex 1 data | United States (AWS us-east-1) | New |
| Cloudflare, Inc. | Application hosting and compute, DNS, TLS and DDoS protection | All Annex 1 data in transit and in processing | United States, with global edge network | Both |
| Twilio Inc. (SendGrid) | Email notifications and sign-in links | Name, email, booking details in notifications | United States | Both |
| Stripe, Inc. | Payment processing | Billing contact and payment details (admins only) | United States | Both |
| HubSpot, Inc. | Customer relationship management and in-app support chat | Account owner's name and email; user count; name and email of users who open support chat | United States | Both |
| Bubble Group, Inc. | Application hosting and platform | All Annex 1 data | United States | Current, until cutover |
| Amazon Web Services, Inc. | Database storage behind Bubble | All Annex 1 data | United States | Current, until cutover |
| Intercom, Inc. | In-app support messaging | Name, email, support conversations | United States | Current, until cutover |
Google Maps Platform (office addresses and map display) and WeatherAPI.com (office location coordinates) receive office locations, not personal data. Google Workspace, Microsoft and Slack connect only when Customer enables those integrations and are Customer's own providers.
Annex 4 – Jurisdiction-specific terms
Each part below applies only where that law applies to the processing of Customer Personal Data.
A. EEA (GDPR). This DPA is the contract required by Article 28(3) GDPR. Transfers to Deskfound in Canada rely on the European Commission's adequacy decision for Canada. For onward transfers to Sub-processors in non-adequate countries, Deskfound will use the Standard Contractual Clauses (Commission Decision 2021/914, Module 3) or the EU-U.S. Data Privacy Framework. If Customer is required to sign SCCs directly with Deskfound, Module 2 applies, Clause 7 (docking) applies, Clause 9 option 2 applies with the notice period in Section 5.3, Clause 17 is governed by Irish law, and Clause 18 courts are those of Ireland. Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA.
B. United Kingdom. The UK GDPR and Data Protection Act 2018 apply in place of the GDPR. Where needed, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, with Table 4 allowing either party to end it. Transfers to the US may also rely on the UK Extension to the Data Privacy Framework.
C. Switzerland. References to the GDPR include the Federal Act on Data Protection, the Federal Data Protection and Information Commissioner is the competent authority, and Swiss data subjects may bring claims in Switzerland.
D. United States. Under the California Consumer Privacy Act (as amended by the CPRA) and similar state laws, Deskfound is a "service provider" or "processor". Deskfound will not sell or share Customer Personal Data, retain, use or disclose it outside the business purpose in Annex 1 or the direct relationship with Customer, or combine it with other data except as those laws allow. Deskfound will tell Customer if it can no longer meet these obligations, and Customer may take reasonable steps to stop unauthorised use.
E. Canada. Deskfound will process Customer Personal Data in line with PIPEDA, British Columbia's Personal Information Protection Act and, for Quebec users, the Act respecting the protection of personal information in the private sector. Deskfound will help Customer with any privacy impact assessment Customer must complete before transferring data outside Quebec.
F. Australia. Deskfound will handle Customer Personal Data in a way consistent with the Australian Privacy Principles, including APP 8 for cross-border disclosures and APP 11 for security, and will give Customer the information it needs to assess a breach under the Notifiable Data Breaches scheme.
G. Israel. Deskfound acts as a "holder" for Customer, the database owner, under the Privacy Protection Law, 5741-1981 and the Privacy Protection (Data Security) Regulations, 5777-2017. This DPA sets out the matters Regulation 15 requires: the data and purposes (Annex 1), the systems Deskfound may access (the Services and, if enabled, Customer's Slack workspace and Google Calendar resources), the security measures (Annex 2), confidentiality (Section 4), Sub-processor terms (Section 5), breach notice (Section 8), deletion (Section 9.1), and audit and reporting (Section 9.3). Transfers outside Israel comply with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. On request, Deskfound will give Customer an annual written report on its compliance with this DPA.
