Data Processing Agreement

§ 1Parties and conclusion

This data processing agreement (“DPA”) is concluded between

and the customer who uses ZeroDesk as a business (Unternehmer within the meaning of § 14 BGB) and thereby processes personal data for which it is the controller within the meaning of Art. 4(7) GDPR – hereinafter the “Controller”.

This DPA supplements the ZeroDesk Terms of Service (the “Main Agreement”) and takes effect when the Controller accepts them. It applies to all plans, including the free plan. This DPA does not apply to consumers who use ZeroDesk solely for personal or household purposes.

§ 2Subject matter and duration

(1) The subject matter of this DPA is the processing of personal data by the Processor on behalf of and on the instructions of the Controller in the course of providing ZeroDesk under the Main Agreement.

(2) This DPA does not cover data that the Processor processes as a controller in its own right, in particular the customer’s account, contract and billing data and data used to prevent abuse. Our Privacy Policy applies to such data.

(3) The term of this DPA corresponds to the term of the Main Agreement. The obligations under § 13 (deletion and return) and § 8 (confidentiality) continue to apply after the end of the agreement for as long as the Processor processes personal data of the Controller.

§ 3Nature and purpose of the processing

(1) Nature of the processing: storing, hosting, organising, providing, transmitting (for example by email notification), backing up, restoring and deleting data, as well as the technical processing required to operate ZeroDesk’s features (for example indexing for search, generating previews, and live transcription of meetings where used).

(2) Purpose of the processing: hosting and operating the Controller’s ZeroDesk workspace, providing the modules and integrations, data backup, ensuring security and availability, and support at the Controller’s request.

(3) Processing generally takes place in data centres within the European Union. Transfers to third countries take place only in accordance with § 15.

§ 4Types of personal data

The Controller determines which data is processed through its use of ZeroDesk. Typically this includes:

• User master data (name, email address, profile picture, role, workspace membership)
• Communication content (chat messages, channels, comments, reactions, notifications)
• Documents, files and attachments, including any personal data contained in them
• Tasks, projects, planning and calendar data
• Contact, CRM and lead data (for example names, contact details, company affiliation, notes)
• HR data from the HR module (for example department, absences, time-off requests); this may include special categories of personal data under Art. 9 GDPR (for example sick notes) if the Controller stores such data
• Applicant data from the recruiting module (for example CVs, application documents, evaluations)
• Audio and video data from meetings and transcriptions, where these features are used
• Integration data (for example from connected GitHub, Google Calendar, Gmail or Telegram accounts), where the Controller enables integrations
• Metadata and log data (for example timestamps, IP addresses, device and browser information, activity history)

§ 5Categories of data subjects

• Employees, members and other users of the Controller’s workspace
• Guests and DocGuests invited by the Controller
• Customers, prospects (leads), suppliers and other contacts of the Controller
• Job applicants
• Other persons whose data is contained in workspace content (for example meeting participants, persons named in documents)

§ 6Instructions

(1) The Processor processes personal data only on documented instructions from the Controller, unless it is required to do so by Union or Member State law. In such a case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

(2) The instructions are set out in the Main Agreement, this DPA and the Controller’s use and configuration of ZeroDesk (for example creating, editing, sharing, exporting and deleting content, inviting users, enabling integrations). The Controller issues any further individual instructions in text form to info [at] kotova.io. Instructions that go beyond the agreed scope of services are treated as a change request.

(3) If the Processor considers that an instruction infringes the GDPR or other data protection provisions, it informs the Controller without delay. It may suspend the execution of the instruction until the Controller confirms or changes it.

§ 7Obligations of the Controller

(1) The Controller is solely responsible for the lawfulness of the processing, in particular for having a legal basis, informing the data subjects and safeguarding their rights. This applies in particular if it stores special categories of personal data (Art. 9 GDPR) or data about applicants and employees in ZeroDesk.

(2) The Controller assigns roles and access rights in its workspace on its own responsibility, decides on inviting guests and sharing content via public links, and protects its login credentials.

(3) The Controller informs the Processor without delay if it discovers errors or irregularities in the processing.

§ 8Confidentiality

The Processor ensures that all persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. These persons have access to the Controller’s data only to the extent necessary to perform their tasks. The obligation of confidentiality continues after their engagement ends.

§ 9Technical and organisational measures

(1) The Processor takes all technical and organisational measures required under Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures in place at the time the agreement is concluded are described in Annex 1.

(2) The measures are subject to technical progress and further development. The Processor may replace them with equivalent or better measures, provided the level of security is not reduced. Significant changes are documented.

§ 10Sub-processors

(1) The Controller grants the Processor general authorisation to engage other processors (“sub-processors”). The sub-processors engaged at the time the agreement is concluded are listed in Annex 2 and are deemed approved.

(2) The Processor informs the Controller at least 30 days in advance, by email or in the app, of any intended addition or replacement of a sub-processor. The Controller may object to the change in text form within 14 days of receiving the information on important data protection grounds. If no agreement is reached, the Controller may terminate the Main Agreement with effect from the date the change takes effect.

(3) The Processor imposes on each sub-processor, by contract, substantially the same data protection obligations as set out in this DPA, in particular sufficient guarantees for appropriate technical and organisational measures. It remains liable to the Controller for the sub-processor’s compliance with these obligations in accordance with Art. 28(4) GDPR.

(4) Ancillary services used by the Processor that do not involve access to the Controller’s personal data (for example telecommunications services) are not sub-processing within the meaning of this provision. Payment service providers such as PayPal process payment data as independent controllers and are not sub-processors.

§ 11Assistance to the Controller

(1) Taking into account the nature of the processing, the Processor assists the Controller, insofar as possible, with appropriate technical and organisational measures in fulfilling data subjects’ rights (Art. 12 to 22 GDPR). The Controller can handle many requests itself using ZeroDesk’s features, for example by editing, exporting or deleting content.

(2) If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without delay, where it can be attributed, and does not respond itself unless instructed to do so by the Controller.

(3) Taking into account the information available to it, the Processor assists the Controller in complying with the obligations under Art. 32 to 36 GDPR (security of processing, notification and communication of personal data breaches, data protection impact assessment, prior consultation).

(4) For assistance that goes beyond providing the standard features and is not caused by a breach on the Processor’s part, the Processor may charge reasonable remuneration agreed in advance.

§ 12Notification of personal data breaches

(1) The Processor notifies the Controller of any personal data breach (Art. 4(12) GDPR) affecting the Controller’s data without undue delay after becoming aware of it, if possible within 48 hours, at the email address of the workspace owner.

(2) As far as known, the notification includes in particular:

• a description of the nature of the breach, where possible including the categories and approximate number of data subjects and records concerned,
• the name and contact details of a contact point for further information,
• a description of the likely consequences of the breach,
• a description of the measures taken or proposed to address the breach and to mitigate its possible adverse effects.

(3) Where the information cannot be provided at the same time, the Processor provides it in phases without undue further delay. Notifying the supervisory authority and communicating the breach to data subjects is the Controller’s responsibility.

§ 13Deletion and return after the end of the agreement

(1) The Controller can export its data at any time during the term using ZeroDesk’s export function. We recommend exporting important data before the agreement ends.

(2) After the Main Agreement ends, the Processor deletes the Controller’s personal data no later than 30 days after the end of the agreement, unless Union or Member State law requires storage. At the Controller’s request, to be made in text form before the agreement ends, the Processor assists with returning the data in a common, machine-readable format.

(3) Data in backups is overwritten in the regular rotation cycle and protected from any further processing until then.

(4) The Processor confirms the deletion to the Controller in text form on request.

§ 14Evidence and audits

(1) On request, the Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR, in particular an up-to-date description of the technical and organisational measures.

(2) The Controller, or an auditor appointed by it who is bound by confidentiality and is not a competitor of the Processor, may carry out audits, including inspections. These must be announced with reasonable notice (as a rule at least 30 days), take place during normal business hours, must not disrupt operations unreasonably and are limited to one audit per calendar year, unless there is a specific reason, in particular a personal data breach.

(3) The Controller bears the costs incurred by it and by the Processor as a result of the audit, unless the audit reveals a material breach of this DPA by the Processor. Sub-processors’ data centres are audited by means of suitable evidence (for example certificates or audit reports).

§ 15Transfers to third countries

Personal data is transferred to a country outside the European Union or the European Economic Area only if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified companies) or the European Commission’s standard contractual clauses. The sub-processors concerned and the respective safeguards are listed in Annex 2.

§ 16Liability

(1) The parties are liable in accordance with Art. 82 GDPR for damage suffered by a data subject as a result of an infringement of the GDPR.

(2) Otherwise, the liability provisions of the Main Agreement apply between the parties, insofar as Art. 82 GDPR does not preclude this.

§ 17Final provisions

(1) In the event of conflicts between this DPA and the Main Agreement, the provisions of this DPA take precedence with regard to data protection.

(2) Amendments and additions to this DPA require text form. For amendments by the Processor, the procedure for amending the Terms of Service described in the Main Agreement applies accordingly; the requirements of Art. 28 GDPR remain unaffected.

(3) Should any provision of this DPA be or become invalid, the validity of the remaining provisions remains unaffected. The invalid provision is replaced by a valid provision that meets the requirements of Art. 28 GDPR and comes closest to what was intended.

(4) The law of the Federal Republic of Germany applies. The exclusive place of jurisdiction is Hamburg, provided the Controller is a merchant (Kaufmann), a legal entity under public law or a special fund under public law.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Physical access control: The servers run in data centres of our hosting provider, which controls physical access in accordance with its security standards. The Processor does not operate its own server rooms.
• System access control: Administrative access to the servers exclusively via SSH with key authentication; password login is disabled. Administrative accounts are limited to a small number of named individuals.
• Data access control: Permissions are granted on the principle of least privilege. Within ZeroDesk, the Controller manages access itself through roles and sharing settings.
• Separation control: Logical tenant separation: data of different workspaces is processed separately and is accessible only to the users authorised for the respective workspace.

Integrity

• Transfer control: All connections between end devices and the service are encrypted with TLS; access to the servers from the internet runs through an encrypted tunnel.
• Input control: Server access and administrative logins are logged; server logs are kept for 14 days. Within ZeroDesk, changes to content are traceably documented in the activity history.

Availability and resilience

• Daily backups of workspace data
• Firewall that only permits the ports and services required for operation
• Monitoring of system availability and load
• Regular installation of security updates for the operating system and software (patch and change management)

Procedures for regular testing, assessment and evaluation

• Confidentiality commitment of all persons with access to personal data
• Defined procedure for detecting, assessing, remedying and reporting security incidents (incident response)
• Regular and event-driven review of the measures and of the sub-processors engaged

Annex 2: Sub-processors

PayPal is not a sub-processor. PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, processes payments as an independent controller and receives only the data required for billing, never the content of your workspace.