Data Processing Addendum

1. Scope and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Toadhut Technologies LLP, India ("Processor", "we") and the Customer that holds an HDdesk account ("Customer", "you"). It applies when we process personal data contained in Customer Data on your behalf in providing HDdesk (the "Services"). Words defined in the Terms have the same meaning here.

For that personal data, you are the controller (or data fiduciary) and we are the processor. Where you are yourself a processor for a third party, we act as your sub-processor and you are responsible for passing on the relevant instructions.

"Data Protection Law" means the laws that apply to the processing, which may include India's Digital Personal Data Protection Act, 2023, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and the UK Data Protection Act 2018.

2. Instructions

We process personal data only on your documented instructions. The Terms, this DPA, and your configuration and use of the Services (such as the mailboxes you connect, your automations, and your API calls) are your instructions. We will tell you if we believe an instruction breaks Data Protection Law. We process personal data otherwise only where the law requires it, and will tell you before doing so unless the law forbids it.

3. Confidentiality

Everyone we authorise to process personal data is bound by confidentiality obligations. Our staff do not access the content of your emails and tickets except at your request (for example, a support request about a specific ticket), when necessary for security purposes, or to comply with the law.

4. Security

We maintain the technical and organisational measures in Annex 2, and may update them as long as the overall level of protection does not decrease.

5. Sub-processors

• You authorise us to use the sub-processors listed in Annex 3.
• We will give at least 30 days' notice of a new sub-processor by updating Annex 3 and emailing the Account owner. You may object on reasonable data protection grounds within that period. If we cannot address the objection, you may terminate the affected Services and receive a refund of prepaid fees for the remaining period.
• We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for their performance.
• Google, Microsoft and other mail providers whose mailboxes you connect are your own providers, acting under your agreements with them, and are not our sub-processors.

6. Assistance

• Data subject requests. The Services let you find, export, correct and delete personal data (including deleting a contact and their tickets). If we receive a request directly from one of your data subjects, we will refer them to you and not respond ourselves, unless the law requires otherwise.
• Impact assessments and consultations. We will give you reasonable information to help you carry out data protection impact assessments and consult supervisory authorities, where required.

7. Personal data breaches

We will notify you without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting your personal data. The notice will describe, as far as we know, the nature of the breach, the data and data subjects affected, the likely consequences, and the measures taken or proposed. We will take reasonable steps to contain and remedy the breach and keep you informed.

8. Deletion and return

You can export your Customer Data at any time while your Account exists. After your Account is deleted, we delete personal data in Customer Data within 30 days, and from backups as they expire within a further [30] days, unless the law requires us to keep it. Deleting a mailbox connection deletes its credentials and tokens immediately.

9. Audits

On written request, and no more than once a year unless a supervisory authority requires it or there has been a breach, we will make available the information reasonably necessary to demonstrate compliance with this DPA, such as answers to security questionnaires and summaries of third-party assessments. If that information is not enough to meet a legal requirement, you may conduct an audit, at your cost, on 30 days' notice, during business hours, in a way that does not disrupt our operations or compromise other customers' data, and under confidentiality obligations.

10. International transfers

We are based in India, and personal data may be processed in India and in the countries where our sub-processors operate. Where GDPR or UK GDPR applies to a transfer to a country without an adequacy decision, the parties agree to the European Commission's standard contractual clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable) and, for the UK, the International Data Transfer Addendum, which are incorporated by reference with the details in Annex 1. [Clause options, governing law and supervisory authority to be completed.]

11. Google and Microsoft user data

Data received from Google APIs and Microsoft Graph is processed in line with our Privacy Policy, including the Google API Services User Data Policy and its Limited Use requirements. In particular, we use it only to provide the user-facing features of the Services, never for advertising, never sell it, and never use it to train AI or machine learning models.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow them. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If the standard contractual clauses apply and conflict with this DPA, the clauses prevail.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit with TLS for all connections to the Services.
• Mailbox passwords and OAuth tokens encrypted at rest and decryptable only by the mail sync service; API keys and session tokens stored as one-way hashes.
• Logical separation of each Customer's data, with every request checked against the account and the brands the user may access.
• Role-based access for the Customer's agents (Owner, Admin, Supervisor, Agent) and per-brand restrictions.
• Attachments served only after an access check through short-lived signed links.
• Restricted staff access to production systems, protected by Cloudflare Access for administrative tools; audit logs of settings and security events.
• Sign-in by one-time email codes or Google, with no stored passwords; rate limiting and automated abuse checks.
• [To be confirmed when production backups are in place: nightly database backups with point-in-time recovery, stored in Cloudflare R2, with periodic restore tests. Location and retention to be confirmed.]
• Minimal OAuth scopes, with tokens revoked at the provider when a mailbox is deleted.

Annex 3: Sub-processors

Contact