Data Processing Agreement

Data Processing Agreement

Version: 1.0-draft | Last updated: 26 August 2026

This Data Processing Agreement ("DPA") forms part of the agreement for the provision of the StrataDesk hosted service (the "Service") between:

together the "Parties", and is entered into to satisfy Article 28(3) of Regulation (EU) 2016/679 ("GDPR").

1. Definitions

Terms such as "personal data", "processing", "data subject", "supervisory authority", "personal data breach" have the meanings given in the GDPR. "Instance" means the Controller's isolated deployment of the Service operated by the Processor.

2. Subject matter, duration, nature and purpose

2.1 The Processor processes personal data on the Controller's behalf solely to provide, maintain, and support the Service (hosting of the Controller's Instance, ticketing, contact management, asset management, backups, and related support).

2.2 Duration: for the term of the Service agreement, plus the wind-down period in Section 10.

3. Categories of data and data subjects (Annex A)

3.1 Data subjects: the Controller's staff (agents/technicians), the Controller's clients' staff and end users who submit or are referenced in tickets.

3.2 Categories of personal data: names, business contact details (email, phone), user account data, ticket content and attachments as submitted by data subjects, time-tracking records, IP addresses and technical logs.

3.3 The Service processes whatever the Controller and its users submit, and a helpdesk cannot prevent a user typing clinical or other special-category detail into a ticket. The Processor therefore makes no claim that special categories of data (Art. 9 GDPR) are excluded in practice. Where the Controller's use involves such data — for example a healthcare provider whose tickets reference patients — the Controller shall inform the Processor, and the Parties shall agree any additional safeguards in writing before that use begins. Counsel: confirm this framing suits Romanian practice; it deliberately does not rely on a prohibition the Processor cannot enforce.

4. Controller instructions

4.1 The Processor processes personal data only on documented instructions from the Controller, including this DPA, the Service agreement, and the Controller's use of the Service's configuration options, unless required otherwise by EU or Member State law (in which case the Processor informs the Controller before processing, unless prohibited).

4.2 The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR.

5. Confidentiality

Persons authorized by the Processor to process the personal data are bound by contractual or statutory confidentiality obligations.

6. Security (Art. 32) — Annex B

Taking into account the state of the art and the nature of processing, the Processor implements appropriate technical and organizational measures, including at minimum those in Annex B, notably: a dedicated PostgreSQL database per end-client within the Controller's Instance; container-level isolation per Instance; encrypted backups with configurable retention; access limited to authorized personnel; EU-located infrastructure.

7. Sub-processors (Annex C)

7.1 The Controller grants general authorization for the sub-processors listed in Annex C.

7.2 The Processor gives the Controller prior written notice (email suffices) of intended additions or replacements, at least 30 days in advance. The Controller may object on reasonable data-protection grounds; if no resolution is found, the Controller may terminate the affected Service.

7.3 The Processor imposes data-protection obligations on sub-processors equivalent to this DPA and remains liable for their performance.

8. Assistance

8.1 Data subject rights: taking into account the nature of processing, the Processor assists the Controller with appropriate technical and organizational measures — including per-Instance data export, search, rectification and deletion capabilities — to respond to data subject requests. Requests received directly by the Processor are forwarded to the Controller without undue delay.

8.2 Arts. 32–36: the Processor assists the Controller, insofar as information is available to it, with security, breach notification, and data protection impact assessments.

9. Personal data breach

The Processor notifies the Controller without undue delay and in any case within 72 hours after becoming aware of a personal data breach affecting the Controller's Instance, providing the information reasonably required for the Controller's obligations under Arts. 33–34 (nature of the breach, categories and approximate numbers affected, likely consequences, measures taken). Where the full information is not available within that period, the Processor notifies on what is known and supplements it in phases, so that the Controller's own 72-hour period under Art. 33 is not spent waiting.

Awareness begins when the Processor has reasonable grounds to believe a breach has occurred, not on conclusion of its investigation.

Counsel: this is deliberately stricter than the Art. 28(3)(f) minimum of "without undue delay". stratadesk.io/security has stated 72 hours to customers since publication, and a DPA promising less than the public page would be the weaker of two documents a customer has already read.

10. Deletion and return

Upon termination of the Service, at the Controller's choice, the Processor: (a) provides a full export of the Instance's databases (standard PostgreSQL dumps) and uploaded files; and/or (b) deletes the Instance in its entirety — containers, databases, file storage, and backups — within 30 days, and confirms deletion in writing; unless EU or Member State law requires longer storage.

11. Audits

11.1 The Processor makes available information reasonably necessary to demonstrate compliance with Art. 28 and allows audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

11.2 Audits require 30 days' notice, occur at most once per calendar year absent a supervisory authority requirement or a breach, are limited to information relevant to the Controller's Instance, and are at the Controller's expense.

12. International transfers

Personal data is stored and processed within the EU/EEA (see Annex C). The Processor does not transfer personal data outside the EU/EEA without the Controller's prior authorization and appropriate safeguards under Chapter V GDPR.

13. Liability and precedence

Liability under this DPA is subject to the limitations and exclusions set out in the Service Agreement between the Parties. This DPA does not create a separate or additional liability regime. Where this DPA and the Service Agreement conflict on the processing of personal data, this DPA prevails.

Counsel — the two questions holding this section open, stated so the review can conclude rather than remain generally pending:

(a) The Service Agreement's liability cap is expressed as a multiple of fees paid. Enterprise buyers commonly require GDPR liability to sit outside that cap, or under a separate and higher one. Confirm which position we take, and whether it is negotiable per deal — a cap that has to be renegotiated in every enterprise conversation is a cap we do not really have.

(b) Art. 82(4) makes controller and processor jointly and severally liable to a data subject. Confirm the recourse position between the Parties, so a claim paid by one is recoverable from the other in proportion to responsibility.

14. Governing law and jurisdiction

This DPA is governed by the law of Romania, and disputes are subject to the competent courts of Bucharest, Romania, without prejudice to mandatory GDPR provisions.

Venue is Bucharest rather than the Processor's registered seat in Ploiești. Cross-border matters are heard there in practice, and a Controller established outside Romania should not have its first procedural question be about a county court it has never heard of.

Counsel: confirm the venue clause is enforceable as drafted against a Controller established in another Member State — in particular that it satisfies Art. 25 Brussels I Recast as a choice-of-court agreement, and that naming Bucharest rather than the Processor's seat does not require anything further under Romanian civil procedure. Exclusive jurisdiction remains a normal thing for a larger counterparty to strike out; if we expect to concede it, the fallback to agree is a neutral EU seat rather than the Controller's.

15. Contacts and notices

Processor's data protection contact: Luiza Badaceanu, Administrator, reachable at hello@stratadesk.io. This is the address for data subject requests forwarded under Section 8, for sub-processor notices under Section 7.2, and for anything else arising from this DPA.

Processor's security contact: Luiza Badaceanu, Administrator, reachable at security@stratadesk.io. Breach notifications under Section 9 are sent by this person, and suspected vulnerabilities should be reported to that address.

Data Protection Officer: the Processor has not appointed one. Art. 37 GDPR requires a DPO of public authorities, of organisations whose core activities consist of large-scale regular and systematic monitoring, and of those processing special categories at large scale; the Processor is none of these. The data protection contact above performs the corresponding function.

Controller's contacts: Controller data protection contact and Controller security contact, to which Section 9 notifications are sent. The Controller keeps these current; a breach notification is only as fast as the address it goes to.

Either Party may change its contacts by written notice.

Annex A — Processing details

As per Section 2 and 3. Complete per customer if specifics differ.

Annex B — Technical and organizational measures (TOMs)

Annex C — Authorized sub-processors

Signature blocks: Processor / Controller, name, title, date.