Data Processing Agreement — HelpDash

Version 1.0 · Effective from 06-10-2026 · Approved by BJS on 05-10-2026 (#80271)

Written from what HelpDash's code actually does and stores (#80129). Not legal advice; no lawyer has reviewed this text. Published in English.

---

Preamble

Processor: We make AI work s.r.o., IČO 29697115, Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic ("we", "us"). Controller: the customer organisation that uses HelpDash ("you").

This agreement forms part of, and is subordinate to, the HelpDash Terms and Conditions (https://helpdash.eu/terms). It governs our processing of personal data on your behalf under Article 28 of Regulation (EU) 2016/679 (GDPR).

Plain-language note, and it is binding: following the portfolio's three-voices rule, where this document exists in a formal and a plain version and the two differ, the plain version governs. A customer should never be bound by a clause they could not read.

---

1. Roles

You are the controller. You decide what support data is collected, from whom, and why. We are the processor: we store and handle it to provide the service, and for nothing else.

Where your own end users write to you through HelpDash, they are your data subjects, not ours. We have no relationship with them and will not contact them except as part of delivering your support service.

2. Subject matter, duration, nature and purpose

Subject matter. Provision of the HelpDash support ticketing service. Duration. For as long as you use the service, plus the deletion described in §9. Nature and purpose. Receiving, storing, organising, displaying and transmitting support communications so that you can answer them.

3. Categories of data and data subjects

Data subjects: your end users (customers, employees, or members of the public who contact you), and your own agents who use the product.

Categories of personal data:

The honest statement about support content, which most DPAs omit. We cannot minimize a ticket body. A person describing their problem may write anything at all, including health information, financial details or a government identifier, and no field design prevents it. So the controls are: tenant isolation (§7), never logging bodies (§7), and erasure on your instruction (§8).

You must not deliberately route special-category data (Article 9) through HelpDash without telling us first, because it changes what both of us must do.

4. Our obligations

1. Process personal data only on your documented instructions. Using the service is an instruction; so is a support request from you. If we believe an instruction breaks data-protection law, we will tell you. 2. Ensure everyone we authorise is bound by confidentiality. 3. Implement the technical and organisational measures in §7. 4. Respect §5 on subprocessors. 5. Assist you with data-subject requests (§8), security, breach notification (§10) and impact assessments. 6. Delete or return the data at the end of the service (§9). 7. Make available the information needed to demonstrate compliance, and allow audits (§11).

5. Subprocessors

You give general authorisation for us to engage subprocessors. The current list is published at https://helpdash.eu/subprocessors and is kept current as a condition of the service, not as a courtesy.

Before a new subprocessor starts processing we will notify you and give you 30 days to object on reasonable data-protection grounds. If we cannot resolve your objection you may terminate the affected service.

We remain fully liable to you for the performance of our subprocessors.

6. International transfers

The service runs on EU-owned infrastructure in Paris, France (Scaleway), with content delivery by an EU company on EU edge locations only (Bunny). No transfer of your personal data outside the EEA takes place.

HelpDash has no AI features: no ticket, message or address is sent to an AI provider. Adding a provider that would process your data is a new subprocessor under §5 — you are told first and may object.

7. Security measures

Technical and organisational measures, described at the level a buyer can verify rather than as adjectives:

• Tenant isolation enforced by the database (row-level security on every table holding your data), not by

application filters — a forgotten filter returns nothing rather than another customer's tickets. The application connects as a database role that does not own those tables, so the policies bind it; the service refuses to serve while isolation cannot be verified. Proven by automated tests that have been seen to fail before passing (#80037, #80163).

• Desk-level authorisation inside your organisation, tested to the same standard as tenant isolation.
• Encryption in transit (TLS) for every connection from your browser or your systems, and between the

application and its database.

• Credentials are never stored in clear. API keys, sign-in links and sessions are stored as hashes (API keys

with a keyed blind index); there are no passwords — agents sign in with a single-use link. Webhook signing secrets are encrypted by the application (AES-256-GCM).

• Attachments live in a private object-storage bucket and are downloaded only through short-lived signed

links.

• An audit log on every mutation, recording actor and before/after, with the before state read from the

database rather than from the request. It doubles as your ticket timeline.

• Personal data never appears in logs or error messages. Redaction happens at the logging boundary, not at

call sites, and there are tests asserting that a real connection failure leaks no credential.

• Staff access. The application gives our staff no way into your desks. Direct database access is limited

to our administrators and used only to operate, repair and back up the service, or on your instruction.

8. Data-subject requests

If one of your end users contacts us directly, we will not act on the request. We will tell them to contact you, and tell you it happened.

We will help you answer requests within your legal deadlines. Erasure is self-service through the API (POST /v1/requesters/lookup, GET /v1/requesters/{id}/erasure, DELETE /v1/requesters/{id}): it removes the person's tickets on that desk with their messages, attachments and timeline, their messages on other tickets of that desk, the record of their inbound emails, and the requester record; the audit log keeps ids and counts only. For access and portability requests we provide an export of the person's data on your request; there is no self-service export.

Erasure is per desk (#80225). If the same person contacts two of your desks, erasing them from one does not erase them from the other: the second desk may have its own lawful basis and its own retention obligation, and that is your decision, not ours to make silently.

9. Retention and deletion

• We keep your data for as long as your desk exists. HelpDash has no automatic age-based deletion: you

remove a person's data with the erasure in §8, and we delete further data on your written instruction.

• On termination we delete your organisation's data on your written request, and give you an export of it

first if you ask for one.

• Backups. The database is backed up daily; copies are kept by us and in Scaleway Object Storage in Paris.

Backup copies have no fixed expiry, so data deleted from the service remains in backups taken before the deletion. Backups are used only to restore the service after a fault.

• The raw copy of an inbound email kept by our mail server is not reached by the API erasure; we delete it on

your request.

• The audit log of administrative actions is retained for security purposes and holds ids and counts, not

content.

10. Personal data breach

We will notify you without undue delay and within 48 hours of becoming aware of a breach affecting your data, with what we know at the time: nature, categories and approximate numbers affected, likely consequences, and the measures taken.

We will not delay a notification to make it complete. A partial notification within 48 hours is more useful to you than an accurate one after five days, because the deadline that matters is yours.

11. Audit

We will provide the information needed to demonstrate compliance with Article 28. You may audit no more than once a year, on 30 days' notice, at your cost, under confidentiality — or more often where a supervisory authority requires it or after a breach affecting your data.

12. Liability and precedence

Liability is governed by the Terms and Conditions. Where this agreement and the Terms conflict on data protection, this agreement prevails.

---

Annexes

• Annex I — parties, categories, subjects: §§1–3.
• Annex II — technical and organisational measures: §7.
• Annex III — subprocessors: https://helpdash.eu/subprocessors.

Contact for data protection: support@helpdash.eu · security issues: tech@wemakeai.work.