Data processing agreement

1.Public DPA template

This is the public data processing agreement template offered to business customers. The customer’s identity, contact details and conclusion of the agreement are recorded separately. Reading this page does not sign the agreement or record acceptance.

2.About this document

This document states DeskGrade’s terms and commitments. It is not legal advice.

3.Backups and recovery

Uploaded files (Storage objects) are not backed up or recoverable as part of DeskGrade. Customers must keep their original files outside the service. Database backups contain file metadata, not the uploaded file contents; restoring a database does not restore a lost file. No future file-backup service is promised.

Our database-backup commitment is daily backups with seven-day retention, without point-in-time recovery. This is not an uninterrupted-availability or recovery-time guarantee. Authorised restoration must include downtime and post-restore checks and preserve or reapply deletions. Return and deletion of active customer data follow the data processing agreement; backup expiry and legally required retention are handled separately.

4.Purpose and scope

• (a) The purpose of these Clauses is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR).
• (b) The controller and the processor listed in Annex I have agreed to these Clauses. In this agreement the customer is the controller and Pilotify is the processor.
• (c) These Clauses apply to the processing of personal data as specified in Annex II.
• (d) Annexes I to IV are an integral part of the Clauses.
• (e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of the GDPR.
• (f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of the GDPR.

5.Use of this adapted agreement

• (a) These are adapted contractual terms. Any agreed additions or updates must preserve the controller’s and processor’s mandatory obligations and data subjects’ rights under applicable data protection law.
• (b) This does not prevent the parties from including these Clauses in a broader contract, or from adding other clauses or additional safeguards, provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

6.Interpretation

• (a) Where these Clauses use the terms defined in the GDPR, those terms have the same meaning as in the GDPR.
• (b) These Clauses are read and interpreted in the light of the provisions of the GDPR.
• (c) These Clauses are not interpreted in a way that runs counter to the rights and obligations provided for in the GDPR or in a way that prejudices the fundamental rights or freedoms of the data subjects.

7.Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the parties, existing when these Clauses are agreed or entered into thereafter, these Clauses prevail.

8.Docking clause

• (a) Any entity that is not a party to these Clauses may, with the agreement of all the parties, accede to them at any time as a controller or a processor by completing the Annexes and signing Annex I.
• (b) Once the Annexes in (a) are completed and signed, the acceding entity is treated as a party to these Clauses and has the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.
• (c) The acceding entity has no rights or obligations under these Clauses for the period before it became a party.

9.Description of the processing

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

10.Obligations of the parties

7.1 Instructions

• (a) The processor processes personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In that case, the processor informs the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. The controller may give further instructions throughout the duration of the processing. These instructions are always documented.
• (b) The processor immediately informs the controller if, in the processor’s opinion, instructions given by the controller infringe the GDPR or other applicable Union or Member State data protection provisions.
• (c) The controller’s agreement for DeskGrade, these Clauses, and the way the controller and its authorised users configure and use DeskGrade, including the tasks they give to AI agents within the permissions DeskGrade grants them, are the controller’s documented instructions.

7.2 Purpose limitation

The processor processes the personal data only for the specific purposes of the processing set out in Annex II, unless it receives further instructions from the controller.

7.3 Duration of the processing

Processing by the processor takes place only for the duration specified in Annex II.

7.4 Security of processing

• (a) The processor implements at least the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the parties take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.
• (b) The processor grants members of its personnel access to the personal data undergoing processing only to the extent strictly necessary for implementing, managing and monitoring the agreement. The processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.5 Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor applies the specific restrictions and/or additional safeguards set out in Annex II.

7.6 Documentation and compliance

• (a) The parties are able to demonstrate compliance with these Clauses.
• (b) The processor deals promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.
• (c) The processor makes available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from the GDPR. At the controller’s request, the processor also permits and contributes to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.
• (d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and are, where appropriate, carried out with reasonable notice.
• (e) The parties make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority on request.

7.7 Use of sub-processors

• (a) The customer gives general authorisation for sub-processors. Before adding or replacing a directly connected provider, Pilotify gives tenant administrators at least 30 days’ notice in-app and by email, with the effective date, change summary and information needed to object. Silence during that period means acceptance on the effective date; no fresh acceptance click is required. The customer may object through our legal contact during the notice period. If the objection cannot be resolved, it may terminate the affected service without penalty. An urgent security or availability replacement may begin immediately with prompt notice, subject to mandatory law and the same objection and exit rights. Published versions retain the change history; changing a gateway’s underlying provider list is tracked through that gateway’s linked list and our routing preference, not a new direct-connection row.
• (b) Where the processor engages a sub-processor for carrying out specific processing activities on behalf of the controller, it does so by way of a contract that provides for, in substance, the same data protection obligations as those imposed on the processor in accordance with these Clauses. The processor ensures that the sub-processor complies with the obligations to which the processor is subject under these Clauses and the GDPR.
• (c) At the controller’s request, the processor provides a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secrets or other confidential information, including personal data, the processor may redact the text of the agreement before sharing a copy.
• (d) The processor remains fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor notifies the controller of any failure by the sub-processor to fulfil its contractual obligations.
• (e) The processor agrees a third-party beneficiary clause with the sub-processor whereby, in the event that the processor has factually disappeared, ceased to exist in law or has become insolvent, the controller has the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

7.8 International transfers

• (a) Any transfer of data to a third country or an international organisation by the processor is done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject, and takes place in compliance with Chapter V of the GDPR.
• (b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7 for carrying out specific processing activities on behalf of the controller, and those processing activities involve a transfer of personal data within the meaning of Chapter V of the GDPR, the processor and the sub-processor can ensure compliance with Chapter V by using standard contractual clauses adopted by the Commission under Article 46(2) of the GDPR, provided the conditions for the use of those standard contractual clauses are met. Where a sub-processor is certified under the EU–US Data Privacy Framework, the transfer may also rely on that adequacy decision.

11.Assistance to the controller

• (a) The processor promptly notifies the controller of any request it has received from the data subject. It does not respond to the request itself, unless authorised to do so by the controller.
• (b) The processor assists the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor complies with the controller’s instructions.
• (c) In addition to the processor’s obligation to assist the controller under Clause 8(b), the processor furthermore assists the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor: (1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a data protection impact assessment) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons; (2) the obligation to consult the competent supervisory authority prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk; (3) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated; (4) the obligations in Article 32 of the GDPR.
• (d) The parties set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause, as well as the scope and the extent of the assistance required.

12.Notification of personal data breach

In the event of a personal data breach, the processor cooperates with and assists the controller for the controller to comply with its obligations under Articles 33 and 34 of the GDPR, taking into account the nature of processing and the information available to the processor.

9.1 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor assists the controller:

• (a) in notifying the personal data breach to the competent supervisory authority, without undue delay after the controller has become aware of it, where relevant (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);
• (b) in obtaining the following information which, under Article 33(3) of the GDPR, is stated in the controller’s notification, and must at least include: (1) the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (2) the likely consequences of the personal data breach; (3) the measures taken or proposed to be taken by the controller to address the breach, including, where appropriate, measures to mitigate its possible adverse effects. Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification contains the information then available, and further information is provided subsequently, as it becomes available, without undue delay;
• (c) in complying, under Article 34 of the GDPR, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor notifies the controller without undue delay after the processor has become aware of the breach. Such notification contains, at least:

• (a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);
• (b) the details of a contact point where more information concerning the personal data breach can be obtained;
• (c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification contains the information then available, and further information is provided subsequently, as it becomes available, without undue delay. The parties set out in Annex III all other elements to be provided by the processor when assisting the controller in complying with Articles 33 and 34 of the GDPR.

13.Non-compliance with the Clauses and termination

• (a) Without prejudice to any provisions of the GDPR, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor promptly informs the controller in case it is unable to comply with these Clauses, for whatever reason.
• (b) The controller is entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if: (1) the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension; (2) the processor is in substantial or persistent breach of these Clauses or its obligations under the GDPR; (3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority regarding its obligations pursuant to these Clauses or to the GDPR.
• (c) The processor is entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1(b), the controller insists on compliance with the instructions.
• (d) Following termination of the contract, the processor, at the choice of the controller, deletes all personal data processed on behalf of the controller and certifies to the controller that it has done so, or returns all the personal data to the controller and deletes existing copies, unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor continues to ensure compliance with these Clauses. The processor carries out the controller’s choice within 30 days after termination. Active copies will be returned or exported as the customer chooses and deleted within that period; database backups expire after seven days. Legally required retention is limited to the necessary data and purpose.

14.Liability and governing law

This Clause is added by the parties and does not modify Clauses 1–10. Liability between the parties under these Clauses follows the limitation of liability in the controller’s agreement for DeskGrade or, if it has none, in our terms of use. This does not limit either party’s liability towards data subjects under Article 82 of the GDPR, administrative fines, or liability for damage caused intentionally or through gross negligence, which Finnish law does not allow to be excluded. These Clauses are governed by Finnish law, and disputes are settled as the controller’s agreement or our terms of use set out.

15.Annex I — List of parties

16.Annex II — Description of the processing

Categories of data subjects

• The controller’s users: employees and other people to whom the controller gives access to its DeskGrade workspace, including administrators.
• Guests the controller invites to shared rooms, including guests who join without an account.
• The controller’s contacts and other people its users record in the workspace, such as CRM contacts, meeting participants and people mentioned in messages, notes, files and room content.
• People who exchange messages with the controller’s agents through a channel the controller connects, such as Slack.

Categories of personal data

• Account and access data: name, email address, profile picture, language and other preferences, workspace memberships and roles, sign-in method and session data.
• Communications: messages, voice messages and their transcripts.
• Room data: room content, guest email addresses and guest sessions and, where the controller switches it on, records of guests’ visits and of which pages and files they open.
• CRM data: names, work email addresses, phone numbers, LinkedIn profile addresses and company roles, and public company details from the Finnish Trade Register.
• Meeting data: meeting details and participants. DeskGrade does not record meetings or produce meeting transcripts.
• Notes and files that users create or upload.
• Agent data: what personal agents remember about a user’s work, conversations with agents, and the actions agents propose or carry out, with who approved them.
• Connected account data: access tokens and the data needed for a calendar, Slack or GitHub connection the controller or its users set up.
• Email delivery records: which service emails were sent to whom and whether they were delivered.
• Security and audit records: who did what and when, technical error data and request-origin information needed for security or attribution. Hosting providers receive IP addresses; relevant records can include origin information.

Sensitive data and safeguards

Special-category and criminal-offence data are excluded by default. Any exception requires a named written agreement on purpose, data categories, access, transfers and deletion safeguards before processing. The protections in Annex III also apply to any other material entered into the service.

Nature of the processing

Hosting and storage; organising, searching and displaying the data in the workspace; sending service emails; transmitting data to services the controller connects; processing by AI models to carry out the tasks users give agents, including text generation, search indexing, voice message transcription and image generation; and erasure.

Purposes of the processing

To provide DeskGrade to the controller under its agreement: workspaces, messaging, shared rooms, CRM, meetings, notes, files and AI agents, together with support, security and prevention of abuse of the service.

Duration of the processing

For the term of the controller’s agreement for DeskGrade and afterwards until the personal data is deleted or returned under Clause 10(d).

Storage periods

• Workspace content (messages, CRM, notes, files, rooms and agent data): until the controller or its users delete it, and at the latest until the end of the agreement under Clause 10(d).
• Temporary identities of guests who join without an account: deleted after seven days unless the guest stays active in a room. Expired invitations are deleted daily.
• Records of guests’ room visits: kept while the room exists, and deleted when the guest switches detailed recording off.
• Agent workspace snapshots: deleted after seven days.
• Security and audit records: necessary event metadata will be retained for 24 months. Diagnostic payloads will be deleted sooner when their purpose ends. Any justified legal or investigation hold will be documented and limited in scope.

Processing by sub-processors

Sub-processors carry out the parts of the processing described for each of them in Annex IV, for the duration of the agreement.

17.Annex III — Technical and organisational measures

• Location: the database, sign-in and file storage are in Stockholm, Sweden, and the service’s server functions run in Stockholm.
• Separation of customers: each customer’s data is kept apart from other customers’ data in the database by access rules enforced in the database itself, and access inside a workspace is limited by role.
• Encryption: we require encrypted transit and encryption at rest for database data and scheduled database backups, within the scope described in the supplier’s data processing addendum.
• Sign-in: passwords are stored only in hashed form by the sign-in provider; users can also sign in with one-time email codes or the customer’s single sign-on. Browser actions are protected against cross-site request forgery, and repeated sign-in and other sensitive requests are rate-limited.
• AI agents: delegated actions are limited by represented-user authority and policy. Dangerous or irreversible actions require approval; ordinary reversible actions may run directly. Relevant actions record the actor and, where approval was required, the approver.
• DeskGrade connects to OpenAI directly, Vercel AI Gateway, OpenRouter as a backup, and Anthropic using our own key through Vercel AI Gateway. We prefer providers with zero retention and no training on customer inputs; this is a routing preference, not a guarantee for every request. Provider terms and the configured route determine processing. Hosting in Stockholm, Sweden does not mean that AI inference, support or all onward processing stays in the EU. EU-only model routing is not currently guaranteed. See the current directly connected providers and each gateway’s published provider list. Pilotify does not train models on customer content.
• Monitoring: error monitoring is configured not to send personal details and records no session replays. Service emails are sent without open or click tracking.
• Public files: images that a customer publishes in a room and profile and agent pictures are stored so that anyone with the link can view them. Other files are available only to users with access to them.
• Backups and recovery: we commit to daily database backups retained for seven days. Point-in-time recovery is not included. An authorised operator will manage restoration, downtime and post-restore checks; deletion state will be preserved or reapplied so erased data is not reactivated. Database backups include file metadata but exclude uploaded files (Storage objects). File backup and recovery are not included: customers must keep their original files.
• Personnel: access to production data is restricted to Pilotify’s owner unless another named person receives explicit, least-privilege authorisation. We will maintain an access register and require confidentiality obligations before granting access.
• Personal data breaches: Pilotify will notify the controller without undue delay after becoming aware of a breach, through the contact in Annex I and under Clause 9.2. The first notice will contain available facts, with updates as the investigation proceeds. No numeric notification target is agreed.
• Data subject requests (Clause 8): Pilotify will assist the controller after verifying identity and tenant scope. Assistance covers export, correction and erasure across relevant data categories, stores and suppliers. We will record actions, lawful exceptions and completion evidence. Assistance may be operator-led and does not require a customer self-service function.

18.Annex IV — List of sub-processors

The controller authorises the sub-processors on our sub-processor list as published when this agreement is concluded, reproduced below. Changes follow Clause 7.7. Services that the controller or its users choose to connect, such as calendars, Slack, GitHub, AI assistants, picture search or video providers whose videos are embedded in rooms, act under their own terms for independent processing; where they process on our behalf, the sub-processor register and notice terms apply.