Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Rise By Digital Limited (company number 15320423) (“Processor”, “we”, “us”) and the customer (“Controller”, “you”).

1. Definitions

• Applicable Data Protection Law: the UK GDPR, the Data Protection Act 2018, and any other applicable UK data protection legislation.
• Customer Data: personal data contained in tickets, emails, portal submissions, attachments, calendar data and related content that you or your end-clients submit or that is captured through the Service.
• Personal Data, Controller, Processor, Processing, Data Subject and Supervisory Authority have the meanings given in Applicable Data Protection Law.
• Subprocessor: any third party engaged by us to process Customer Data on our behalf.

2. Roles and scope

You are the Controller of Customer Data. We are the Processor.

We will process Customer Data only:

• On your documented instructions (including those set out in the Terms of Service and this DPA); and
• To provide the Service (shared inbox, ticketing, capacity planning, client portal, AI assist and integrations).

You are responsible for the lawfulness of the processing and for providing any required notices to Data Subjects.

3. Nature, purpose and duration of processing

Subject matter: provision of the Hookdesk Service.
Duration: for the term of your subscription and until Customer Data is deleted or returned in accordance with this DPA.
Nature and purpose: capturing, storing, organising, analysing and displaying Customer Data to deliver ticketing, planning, portal, AI suggestion and integration features.
Types of Personal Data: contact details (name, email), communication content, professional data, calendar and availability data, and any other personal data you or your end-clients include in tickets, emails or portal submissions.
Categories of Data Subjects: your end-clients, their staff and contacts, and your own staff or contractors.

Special category data is not required. If you include it, you confirm you have a lawful basis and have provided any necessary notices.

4. Processor obligations

We will:

• Process Customer Data only on your documented instructions (unless required by law, in which case we will inform you unless prohibited).
• Ensure that persons authorised to process Customer Data are under confidentiality obligations.
• Implement appropriate technical and organisational measures to protect Customer Data (see section 6).
• Assist you with Data Subject requests, data protection impact assessments and prior consultations where required, taking into account the nature of the processing.
• Notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, and provide reasonable information to help you meet your obligations.
• Delete or return Customer Data at the end of the provision of the Service, and delete existing copies unless retention is required by law.
• Make available information necessary to demonstrate compliance and allow for audits as set out below.

5. Subprocessors

You authorise us to engage Subprocessors to provide the Service.

Current categories of Subprocessors include cloud hosting providers, AI model providers (for draft, summary and triage features), payment processors, email delivery providers and support tools. A current list is available on request or will be published at hookdesk.ai/subprocessors.

We will:

• Impose data protection obligations on Subprocessors that are no less protective than those in this DPA.
• Remain responsible for the performance of our Subprocessors.
• Notify you of intended changes to Subprocessors (via email or the Service). You may object on reasonable data protection grounds within 14 days. If the objection is not resolved, you may terminate the affected part of the Service.

6. Security measures

We implement appropriate technical and organisational measures, including:

• Encryption of data in transit and at rest where applicable
• Access controls and least-privilege principles
• Optional or enforced two-factor authentication
• Audit logging (retention according to plan)
• Regular backups and vulnerability management
• Staff training and confidentiality obligations

We may update these measures provided they do not materially reduce the overall level of protection.

7. International transfers

Customer Data is primarily processed in the UK and EEA.

Where we transfer Customer Data outside the UK, we will ensure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any required supplementary measures.

8. Assistance with rights and breaches

We will assist you in responding to Data Subject requests relating to Customer Data, taking into account the nature of the processing. You are responsible for receiving and responding to such requests; we will provide reasonable support on request.

In the event of a Personal Data Breach affecting Customer Data, we will notify you without undue delay and, where feasible, within 72 hours of becoming aware of it, and provide information reasonably required for you to meet your notification obligations.

9. Deletion and return

On termination of the Service or on your written request, we will delete or return Customer Data within 30 days, unless retention is required by Applicable Data Protection Law. Residual copies in backups will be deleted or overwritten on a rolling basis.

10. Audits

You may request information reasonably necessary to demonstrate our compliance with this DPA.

If you require an audit, we will cooperate in good faith. Audits will be conducted with reasonable notice, during business hours, and in a manner that does not unreasonably disrupt our operations. You will bear the costs of any audit unless the audit reveals a material breach of this DPA.

11. Liability

Liability under this DPA is subject to the limitations set out in the Terms of Service, except that nothing limits liability for breaches of Applicable Data Protection Law that cannot be limited.

12. Governing law

This DPA is governed by the laws of England and Wales.

13. Contact

For questions about this DPA:
privacy@hookdesk.ai
or legal@hookdesk.ai

Rise By Digital Limited
Barrington House, Leake Road, Costock, Leicestershire, LE12 6XA
United Kingdom

End of Data Processing Agreement