Data Processing Agreement
Last updated: [date]
1. Who this is for
Your agency ("Customer", the data controller) enters candidate and client personal data into Deskspark. Deskspark ("we", the data processor) processes that data only on Customer's instructions, to provide the Deskspark service. This agreement sets out how we do that — it supplements the Terms of Service and Privacy Policy, and applies automatically once a workspace is created.
2. What we process
Candidate and client contact details, employment history, notes, interview outcomes, and any other personal data Customer chooses to store in Deskspark — exactly the data described in the Privacy Policy's "What we collect" section, nothing beyond it.
3. Sub-processors
We use the following sub-processors to run Deskspark: Vercel (application hosting), Supabase (database, authentication, file storage), and Anthropic and ElevenLabs (AI text and voice generation for the Vicki assistant). Data is currently hosted in the United States (AWS us-east-1, via Vercel and Supabase). We'll give reasonable notice before adding a new sub-processor that would materially change this.
4. International transfers
Where Customer or the individuals in its pipeline are in the UK or EU and data is processed in the US, the transfer is safeguarded by [Standard Contractual Clauses / other transfer mechanism — to be finalized with legal counsel].
5. Security
Data is encrypted in transit and at rest, access is scoped per-workspace via row-level security so one customer's data is never visible to another, and access to production data is limited to what's needed to operate the service.
6. Sub-processor changes and audits
Customer may request reasonable information to verify our compliance with this agreement. On termination, Customer's data can be exported in full at any time (Settings → Export All Data) and is deleted from active systems within [retention period] of account closure.
7. Contact
Questions about this agreement, or to request a signed copy for your own records: privacy@deskspark.example.