Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the agreement between ThriveDesk LLC ("ThriveDesk", "we") and the customer ("you") for the use of ThriveDesk under our Terms & Conditions. It applies when we process personal data on your behalf, and it sets out the terms required by Article 28 of the GDPR and equivalent laws, including the UK GDPR.
To get a copy signed by ThriveDesk, email parvez@thrivedesk.com with "DPA" in the subject line and your company's legal name and address. The DPA applies to your use of ThriveDesk whether or not you sign a copy.
1. Definitions
"Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR. "Customer data" means personal data you or your end users submit to ThriveDesk. "Subprocessor" means a third party we engage to process customer data.
2. Roles
You are the controller of customer data, and we are your processor. Where you act as a processor for someone else, we are your subprocessor, and you confirm your controller has authorised our appointment.
3. Details of the processing
| Subject matter | Providing the ThriveDesk help desk, live chat, help center, AI and related services. |
|---|---|
| Duration | The term of your subscription, plus the deletion period in section 11. |
| Nature and purpose | Hosting, storing, organising, searching, displaying, transmitting and analysing customer data so your team can answer customers, as instructed through your use of the service. |
| Data subjects | Your customers and website visitors who contact you, and your teammates who use ThriveDesk. |
| Categories of data | Names, email addresses, phone numbers, message content, attachments, order and billing details from your integrations, IP addresses, approximate location, browser and device details. |
| Special category data | None intended. Don't send special category data through ThriveDesk unless you have a lawful basis and appropriate safeguards. |
4. Your instructions
We process customer data only on your documented instructions, which are this DPA, the Terms and your use and configuration of the service. If we believe an instruction breaks data protection law, we'll tell you. If the law requires us to process data in another way, we'll tell you first unless the law forbids it.
5. Your responsibilities
You are responsible for having a lawful basis for the customer data you put into ThriveDesk, for giving people the information the law requires, and for the accuracy of that data.
6. Confidentiality
Everyone at ThriveDesk who can access customer data is bound by confidentiality and accesses it only as needed to run the service, support you or meet a legal obligation.
7. Security
We keep appropriate technical and organisational measures to protect customer data, described in our Security Overview. They include encryption in transit and at rest, access controls by role, staff training, monitoring, and backups. We may update these measures as long as the overall level of protection doesn't go down.
8. Subprocessors
You authorise us to use the subprocessors on our Subprocessors page. Each is bound by data protection terms at least as protective as this DPA, and we remain responsible for their work.
We'll tell you by email at least 30 days before a new subprocessor starts processing customer data. You can object on reasonable data protection grounds within that time. If we can't resolve the objection, you may end the affected service and get a refund of any prepaid fees for the remaining term.
9. Assistance
- Data subject requests. The service lets you access, correct, export and delete customer data. Where you can't do something yourself, we'll help. If a data subject contacts us directly, we'll pass the request to you.
- Impact assessments. We'll give you the information you reasonably need for a data protection impact assessment or consultation with a regulator.
10. Personal data breaches
We'll notify you without undue delay, and within 48 hours of confirming a personal data breach affecting customer data. We'll give you the information you need to meet your own obligations and keep you updated. See Data breaches.
11. Deletion and return
You can export customer data at any time while your subscription is active and for 30 days after it ends. After that we delete customer data, with backups clearing within 60 days, unless the law requires us to keep it.
12. Audits
On request, we'll give you the information you reasonably need to show we meet this DPA, such as answers to security questionnaires and summaries of our policies. If a regulator requires it, or that information isn't enough, you may audit our compliance with reasonable notice, once a year, during business hours and under confidentiality, at your own cost.
13. International transfers
All ThriveDesk servers are in the United States, so customer data is stored there. Where customer data is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK addendum where the UK GDPR applies), which are incorporated into this DPA by reference, or by another safeguard GDPR allows.
14. Liability and order of precedence
Each party's liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict on data protection, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win.
15. Term
This DPA lasts as long as we process customer data for you, and ends when that data has been deleted under section 11.
16. Contact
Our data protection contact is Parvez Akther, Managing Director. Email parvez@thrivedesk.com or call +1 929 633 7144. Send data requests to help@thrivedesk.com.
