--- title: "GDPR & Compliance | ThriveDesk" canonical: "https://www.thrivedesk.com/gdpr/" author: ThriveDesk description: "Where ThriveDesk stands on GDPR: our checklist for a help desk, data requests, the DPA, subprocessors, security and how we handle breaches." categories: [legal] --- # GDPR & Compliance How ThriveDesk handles your customers' data, and where we stand on GDPR. [Request your data](https://www.thrivedesk.com/gdpr/data-requests/) [Read the DPA](https://www.thrivedesk.com/gdpr/dpa/) - [Data requests Ask for a copy of your data, or have it corrected or deleted.](https://www.thrivedesk.com/gdpr/data-requests/) - [Data Processing Agreement The DPA we sign with customers, and how to get a copy.](https://www.thrivedesk.com/gdpr/dpa/) - [Subprocessors The companies that help us run ThriveDesk, and where they are.](https://www.thrivedesk.com/legal/subprocessors/) - [Security Encryption, access controls and how we protect your data.](https://www.thrivedesk.com/security/) - [Data breaches How we respond to a breach and when we tell you.](https://www.thrivedesk.com/gdpr/data-breaches/) Checklist ## Where we stand on GDPR What we've done for each part of GDPR, and what we haven't yet. Open any item to see the details. ### Lawful basis and transparency 3 of 3 done - [Map the personal data we handle](https://www.thrivedesk.com/gdpr/checklist/data-map/) - [Have a lawful basis for processing](https://www.thrivedesk.com/gdpr/checklist/lawful-basis/) - [Explain it clearly in a privacy policy](https://www.thrivedesk.com/gdpr/checklist/privacy-policy/) ### Customer conversations and AI 5 of 5 done - [Keep conversations only as long as needed](https://www.thrivedesk.com/gdpr/checklist/conversation-retention/) - [Delete a customer's data on request](https://www.thrivedesk.com/gdpr/checklist/delete-customer-data/) - [Export a customer's data on request](https://www.thrivedesk.com/gdpr/checklist/export-customer-data/) - [Use AI without giving away your data](https://www.thrivedesk.com/gdpr/checklist/ai-and-your-data/) - [Say where your data is hosted](https://www.thrivedesk.com/gdpr/checklist/data-location/) ### Data security 5 of 5 done - [Build privacy into the product](https://www.thrivedesk.com/gdpr/checklist/privacy-by-design/) - [Encrypt data in transit and at rest](https://www.thrivedesk.com/gdpr/checklist/encryption/) - [Have a breach response plan](https://www.thrivedesk.com/gdpr/checklist/breach-response/) - [Keep an internal security policy](https://www.thrivedesk.com/gdpr/checklist/security-policy/) - [Assess risky processing first](https://www.thrivedesk.com/gdpr/checklist/impact-assessments/) ### Accountability and governance 1 of 3 done - [Appoint a data protection officer](https://www.thrivedesk.com/gdpr/checklist/data-protection-officer/) - [Sign DPAs with every processor Not done](https://www.thrivedesk.com/gdpr/checklist/vendor-agreements/) - [Appoint an EU representative In progress](https://www.thrivedesk.com/gdpr/checklist/eu-representative/) ### Privacy rights 7 of 7 done - [Right of access](https://www.thrivedesk.com/gdpr/checklist/right-of-access/) - [Right to rectification](https://www.thrivedesk.com/gdpr/checklist/right-to-rectification/) - [Right to erasure](https://www.thrivedesk.com/gdpr/checklist/right-to-erasure/) - [Right to restrict processing](https://www.thrivedesk.com/gdpr/checklist/right-to-restrict/) - [Right to data portability](https://www.thrivedesk.com/gdpr/checklist/right-to-portability/) - [Right to object](https://www.thrivedesk.com/gdpr/checklist/right-to-object/) - [Rights around automated decisions](https://www.thrivedesk.com/gdpr/checklist/automated-decisions/) ## Data protection contact For GDPR questions or a signed DPA, contact Parvez Akther, Managing Director. Email [parvez@thrivedesk.com](mailto:parvez@thrivedesk.com) Phone [+1 929 633 7144](tel:+19296337144) Data requests [help@thrivedesk.com](mailto:help@thrivedesk.com) [Email us](mailto:parvez@thrivedesk.com?subject=Data%20protection) FAQ ## Questions about GDPR Anything else? [Talk to us](https://www.thrivedesk.com/contact/). ### Is ThriveDesk GDPR compliant? Yes. We follow the GDPR as a processor for your customers' data and as a controller for your account data. The checklist on this page shows where we stand on each item, including the two that aren't finished. ### Is ThriveDesk a controller or a processor? Both, for different data. For the conversations and contacts in your account, you are the controller and we are your processor. For your own account and billing details, we are the controller. ### Where is my data stored? All ThriveDesk servers are in the United States. Each service that handles data, and where it is based, is listed on our Subprocessors page. ### Do you sign a Data Processing Agreement? Yes. Read the DPA on this site, then email parvez@thrivedesk.com for a signed copy. ### How long do you keep conversation data? Up to five years while your account is active, unless you delete it sooner. After an account closes, we keep its data for 30 days so it can be exported, then delete it. Backups clear within 60 days. ### Can I delete all the data about one of my customers? Yes. Find the person by email, delete their conversations and then their contact record. If anything is left that you cannot delete yourself, email us and we will remove it. ### Does Neo train AI models on my conversations? No. Neo looks up the sources you choose at the moment it answers, and we do not train or fine-tune AI models on your conversations. The AI providers we use are listed as subprocessors. ### What happens if there is a data breach? We contain it, investigate it and tell affected customers without undue delay, with updates as we learn more. The full process is on our Data breaches page. ### Who can see my data at ThriveDesk? Only team members whose role needs it, and only when a support request or an incident requires it. Access is controlled by permission levels.