Data Processing Agreement

Effective version: 22 October 2026

This Data Processing Agreement (DPA) forms part of the DeskJoey Terms of Service between each business that uses DeskJoey as controller ("Business") and Ashley Paul Hurlow, trading as DeskJoey as processor ("DeskJoey") when we process that business's end-customer personal data.

1. Subject matter, duration and instructions

Processing concerns enquiries, appointments, quotations, customer communication and related service records supplied by the Business during its use of DeskJoey. It lasts for the account relationship and any lawful return, deletion or retention period. The Business's documented instructions include its use of the service, configuration settings and written support requests. We will process personal data only on those instructions, including instructions for international transfers, unless UK law requires otherwise; if it does, we will inform the Business where legally allowed.

2. Categories of data and individuals

Individuals include customers, prospective customers, staff and contacts of the Business. Data may include names, emails, telephone numbers, service addresses/postcodes, appointment dates, requested jobs, estimates, notes, and related communication. The Business must avoid submitting special-category or other high-risk personal data unless it has an appropriate lawful basis and protections.

3. Security and confidentiality

We will take technical and organisational measures appropriate to the risk, including access restrictions, encrypted communications, account controls and appropriate recovery measures. Persons authorised to process data will be bound by confidentiality duties.

4. Sub-processors

The Business gives general authorisation to engage the sub-processors needed to operate DeskJoey, currently including Hostinger for hosting and Resend for transactional email. Where the Business chooses optional Google Calendar functionality, Google is involved under the connected service arrangements. Optional business AI receptionist and WhatsApp pilot features, if deliberately enabled, may involve OpenAI for generating replies and Twilio for WhatsApp messaging. Stripe may be used for DeskJoey's separate owner-initiated subscription billing. We will provide notice of intended additions or replacements to sub-processors and a reasonable opportunity for the Business to object. We are responsible for imposing appropriate equivalent data-protection obligations on our sub-processors in accordance with applicable law.

5. Individual rights and compliance assistance

Taking account of the nature of processing and information available to us, we will reasonably assist the Business with access, correction, restriction, portability, erasure and other rights requests and with its data protection impact assessments, security and reporting obligations when required under UK data protection law.

6. Personal data breaches

We will notify the Business without undue delay after becoming aware of a personal data breach affecting its personal data, and provide reasonably available information and assistance so the Business can assess any required notifications.

7. International transfers

Restricted international transfers must be made on the Business's documented instructions and meet applicable UK transfer requirements, including adequacy routes or appropriate safeguards where necessary. We will make relevant transfer information available to the Business on request.

8. Return and deletion

At the Business's choice after the service ends, we will return or delete the personal data processed on its behalf and delete existing copies unless retention is required by law. We currently handle export and deletion requests through support@deskjoey.com, rather than a self-service account tool. Any residual backup copies must remain protected and be dealt with through the applicable retention cycle. Where immediate destruction of backup copies is technically impracticable, we will restrict their use and delete them as the cycle permits, subject to legal requirements.

9. Demonstrating compliance

We will make available information reasonably necessary to demonstrate compliance with Article 28 and permit and contribute to appropriate audits or inspections, including those conducted by an auditor mandated by the Business, subject to reasonable safeguards for confidentiality, security and other customers.

10. Unlawful instructions

If in our opinion a documented instruction infringes applicable data protection law, we will inform the Business unless we are legally prohibited from doing so. The Business remains responsible for lawful collection, fair notice to its customers, data minimisation and the accuracy of its instructions.

11. Contact

Data protection contact: support@deskjoey.com; correspondence: 157 Heol Gwyrosydd, Swansea, Wales, United Kingdom.

Questions? Contact support@deskjoey.com.