Data processing addendum

1.What this page is

This is a summary of the data processing terms that apply when your organisation uses the Remote Desk hosted service. It explains our commitments in plain language. A signed addendum for your organisation is available on request (see the last section), and if the two differ the signed addendum applies.

2.Roles

On the hosted service, your organisation is the controller of the personal data in its workspace: it decides what is put there and why. Remote Desk is the processor and handles that data on your organisation's behalf.

For account administration and security of the service itself, such as sign-in records and abuse prevention, we decide how data is used and act as a controller. The privacy policy describes this.

If your organisation self-hosts Remote Desk, we are not a processor: we receive no data from your instance. See the privacy policy.

3.Instructions

We process workspace data only to provide the service and on your organisation's documented instructions. Using the product and its settings, including turning modules on or off, setting retention periods, and enabling features such as recording or app activity, is your instruction. We will tell you if we think an instruction would break data protection law.

4.Confidentiality

People who can access workspace data for us are bound by confidentiality, and access is limited to what they need to run and support the service. Staff access to a user's account is labelled in the product and recorded in an audit log.

5.Security

We protect workspace data with technical and organisational measures suited to the risk. They include sign-in protections such as email two-factor that an organisation can require, sessions that can be revoked, step-up checks for sensitive changes, permission checks on every capability, room access enforced on the server, IP allow and deny lists, and an exportable audit log. Read more on the security page.

Provider API keys entered by administrators are encrypted at rest, and passwords are stored only as salted hashes.

6.Subprocessors

Your organisation authorises us to use the providers listed on the subprocessors page. We bind each to data protection obligations suited to what it does, and we remain responsible for them. We update that page when providers change, and you can object on reasonable data protection grounds.

7.Personal data breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, disclosure of or access to your workspace's personal data, we will tell your organisation without undue delay, and give the information we have to help you meet your own obligations to authorities and individuals.

8.Helping with people's requests

If someone asks us to access, correct, delete or export their data held in your workspace, we will pass the request to you rather than answer it ourselves, unless the law requires otherwise. Taking account of the nature of the processing, we will help you respond. See your data rights.

9.Deletion and return

When your organisation stops using the service, we will, on request, delete the workspace data or return it to you, and delete existing copies unless the law requires us to keep them. Deleting an organisation in the product deactivates it rather than erasing it immediately, so ask us to erase it permanently if that is what you need. See data retention for what is kept and for how long.

10.Audits and information

We will make available the information reasonably needed to show we are meeting these commitments, and allow and contribute to audits by your organisation or an auditor it appoints, on reasonable notice and in a way that does not compromise other customers' data or the security of the service.

11.International transfers

Where personal data from the UK, the European Economic Area or Switzerland is transferred to a country without an adequacy decision, we will rely on an approved transfer mechanism, such as standard contractual clauses, as set out in the signed addendum.

12.Requesting a signed copy

To request a signed data processing addendum, or to ask a question about these terms, email hello@thehivez.com with your organisation's name and the person who will sign.