Data Processing Addendum

“Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, and “Supervisory Authority” have the meanings in applicable data protection law (including the GDPR). “Customer Personal Data” means personal data within Customer Data that we process on your behalf.

You are the Controller (or a processor acting for your own clients) and we are the Processor. For your end-managed clients, you remain responsible for being a valid controller/processor and for the lawful basis of processing. We process Customer Personal Data only to provide and support the Service and per your documented instructions (including the Terms and your configuration).

• Process Customer Personal Data only on your documented instructions, unless required by law (in which case we notify you where permitted).
• Ensure persons authorized to process are bound by confidentiality.
• Implement appropriate technical and organizational measures (Annex II).
• Assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your obligations for security, breach notification, and data-protection impact assessments.
• Make available information reasonably necessary to demonstrate compliance and allow for audits (§7).
• Not engage subprocessors except as permitted in §5.

We maintain the technical and organizational measures described in Annex II, designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access. We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and provide information reasonably available to help you meet your notification obligations.

You authorize us to engage the subprocessors listed in Annex III and to add or replace subprocessors. We impose data-protection obligations on each subprocessor no less protective than this DPA and remain responsible for their performance. We will give advance notice of new subprocessors; you may object on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the concern.

The Service provides controls (export, correction, deletion) that let you respond to data-subject requests yourself. To the extent you cannot, we will assist you with appropriate measures, taking into account the nature of the processing.

On reasonable prior written request (no more than annually, except following a breach or regulator requirement), we will make available documentation and, where required, support a confidential audit of our compliance with this DPA, subject to reasonable confidentiality and security constraints.

Where processing involves transferring Customer Personal Data out of the EEA, UK, or Switzerland to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (and the UK Addendum / Swiss amendments as applicable), which are deemed completed with the details in the Annexes.

On termination, we will make Customer Personal Data available for export for 30 days, then delete it from active systems; backups expire on a rolling schedule. We may retain data where required by law.

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms.

• Subject matter: provision of the AdminSystem IT-management platform.
• Duration: for the term of the subscription plus the deletion period in §9.
• Nature and purpose: hosting, storing, and processing Customer Data to operate service desk, RMM, documentation, billing, and related features.
• Categories of data subjects: Customer's staff and technicians; Customer's end users / clients and their contacts.
• Categories of personal data: names, business contact details, account credentials (hashed), role and activity logs, device/endpoint telemetry, ticket and communication content, and any personal data the Customer chooses to store.
• Special-category data: not intended; the Customer should not submit special-category data except where it has a lawful basis and appropriate safeguards.

• Encryption of data in transit (TLS) and of sensitive secrets at rest (AES-256-GCM password vault).
• Role-based access control with per-permission overrides and least-privilege internal access.
• Tamper-evident audit logging of administrative and security-relevant actions.
• Multi-factor authentication available on every tier; SSO/SAML on higher tiers.
• Network isolation, rate limiting, and input validation across API surfaces.
• Regular dependency updates and monitoring; error tracking and health checks.
• Backups with defined retention and restoration procedures.
• Personnel confidentiality obligations and access reviews.

• Hosting & database — cloud infrastructure provider (compute, Postgres, object storage).
• Email delivery — Resend (transactional email).
• Payments — Stripe (subscription billing; card data handled by Stripe).
• Error monitoring — Sentry (only when enabled by configuration).
• AI features — Anthropic (only for content you submit to AI features, when enabled).

Replace this list with your finalized subprocessors and their locations before launch.

Data-protection contact: privacy@psadesk.com.