--- title: "Data Processing Agreement | ThriveDesk" canonical: "https://www.thrivedesk.com/gdpr/dpa/" author: ThriveDesk description: Data Processing Agreement under the GDPR at ThriveDesk. categories: [legal] --- # Data Processing Agreement Last updated: 6 October 2026 This Data Processing Agreement ("DPA") forms part of the agreement between ThriveDesk LLC ("ThriveDesk", "we") and the customer ("you") for the use of ThriveDesk under our [Terms & Conditions](https://www.thrivedesk.com/legal/terms/). It applies when we process personal data on your behalf, and it sets out the terms required by Article 28 of the GDPR and equivalent laws, including the UK GDPR. To get a copy signed by ThriveDesk, email [parvez@thrivedesk.com](mailto:parvez@thrivedesk.com) with "DPA" in the subject line and your company's legal name and address. The DPA applies to your use of ThriveDesk whether or not you sign a copy. ## 1. Definitions "Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR. "Customer data" means personal data you or your end users submit to ThriveDesk. "Subprocessor" means a third party we engage to process customer data. ## 2. Roles You are the controller of customer data, and we are your processor. Where you act as a processor for someone else, we are your subprocessor, and you confirm your controller has authorised our appointment. ## 3. Details of the processing - **Subject matter**: Providing the ThriveDesk help desk, live chat, help center, AI and related services. - **Duration**: The term of your subscription, plus the deletion period in section 11. - **Nature and purpose**: Hosting, storing, organising, searching, displaying, transmitting and analysing customer data so your team can answer customers, as instructed through your use of the service. - **Data subjects**: Your customers and website visitors who contact you, and your teammates who use ThriveDesk. - **Categories of data**: Names, email addresses, phone numbers, message content, attachments, order and billing details from your integrations, IP addresses, approximate location, browser and device details. - **Special category data**: None intended. Don't send special category data through ThriveDesk unless you have a lawful basis and appropriate safeguards. ## 4. Your instructions We process customer data only on your documented instructions, which are this DPA, the Terms and your use and configuration of the service. If we believe an instruction breaks data protection law, we'll tell you. If the law requires us to process data in another way, we'll tell you first unless the law forbids it. ## 5. Your responsibilities You are responsible for having a lawful basis for the customer data you put into ThriveDesk, for giving people the information the law requires, and for the accuracy of that data. ## 6. Confidentiality Everyone at ThriveDesk who can access customer data is bound by confidentiality and accesses it only as needed to run the service, support you or meet a legal obligation. ## 7. Security We keep appropriate technical and organisational measures to protect customer data, described in our [Security Overview](https://www.thrivedesk.com/security/). They include encryption in transit and at rest, access controls by role, staff training, monitoring, and backups. We may update these measures as long as the overall level of protection doesn't go down. ## 8. Subprocessors You authorise us to use the subprocessors on our [Subprocessors](https://www.thrivedesk.com/legal/subprocessors/) page. Each is bound by data protection terms at least as protective as this DPA, and we remain responsible for their work. We'll tell you by email at least 30 days before a new subprocessor starts processing customer data. You can object on reasonable data protection grounds within that time. If we can't resolve the objection, you may end the affected service and get a refund of any prepaid fees for the remaining term. ## 9. Assistance - **Data subject requests.** The service lets you access, correct, export and delete customer data. Where you can't do something yourself, we'll help. If a data subject contacts us directly, we'll pass the request to you. - **Impact assessments.** We'll give you the information you reasonably need for a data protection impact assessment or consultation with a regulator. ## 10. Personal data breaches We'll notify you without undue delay, and within 48 hours of confirming a personal data breach affecting customer data. We'll give you the information you need to meet your own obligations and keep you updated. See [Data breaches](https://www.thrivedesk.com/gdpr/data-breaches/). ## 11. Deletion and return You can export customer data at any time while your subscription is active and for 30 days after it ends. After that we delete customer data, with backups clearing within 60 days, unless the law requires us to keep it. ## 12. Audits On request, we'll give you the information you reasonably need to show we meet this DPA, such as answers to security questionnaires and summaries of our policies. If a regulator requires it, or that information isn't enough, you may audit our compliance with reasonable notice, once a year, during business hours and under confidentiality, at your own cost. ## 13. International transfers All ThriveDesk servers are in the United States, so customer data is stored there. Where customer data is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK addendum where the UK GDPR applies), which are incorporated into this DPA by reference, or by another safeguard GDPR allows. ## 14. Liability and order of precedence Each party's liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict on data protection, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win. ## 15. Term This DPA lasts as long as we process customer data for you, and ends when that data has been deleted under section 11. ## 16. Contact Our data protection contact is Parvez Akther, Managing Director. Email [parvez@thrivedesk.com](mailto:parvez@thrivedesk.com) or call [+1 929 633 7144](tel:+19296337144). Send data requests to [help@thrivedesk.com](mailto:help@thrivedesk.com).