Data Processing Addendum

1. When this applies

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service between Trendifyr Tech (Private) Limited (“Processor”, “we”) and the customer identified in those Terms (“Controller”, “you”).

It applies where you use DeskTunnel under a paid organisational account and we process Personal Data on your behalf in the course of providing the Service. It takes effect automatically on acceptance of the Terms of Service; no signature is required. If your procurement process requires a counter-signed copy, write to [email protected] and we will provide one.

Where this DPA conflicts with the Terms of Service in respect of the processing of Personal Data, this DPA prevails.

2. Definitions

“Data Protection Law” means all law applicable to the processing of Personal Data under this DPA, including Regulation (EU) 2016/679 (the “GDPR”), the UK GDPR and the Data Protection Act 2018, and applicable Pakistani data-protection legislation.

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given in the GDPR.

“Customer Personal Data” means Personal Data we process on your behalf under the Terms of Service, as described in Annex 1.

“Standard Contractual Clauses” means the clauses annexed to Commission Implementing Decision (EU) 2021/914, and where the UK GDPR applies, those clauses as supplemented by the UK International Data Transfer Addendum issued by the Information Commissioner.

3. Roles of the parties

You are the Controller of Customer Personal Data and we are the Processor. You determine the purposes and means of processing; we process only on your documented instructions.

We act as an independent Controller, not as your Processor, in respect of: account and billing data for your account; aggregated and anonymised technical measurements used to operate and improve the Service; data we process to secure the Service and prevent abuse; and data we must process to comply with our own legal obligations. That processing is described in our Privacy Policy.

Session content is outside the scope of this DPA entirely. It is encrypted end to end between the two devices, we hold no key and have no technical ability to access it. We are therefore neither Controller nor Processor of it, and we cannot produce, restore or delete it on request.

4. Subject matter and details

The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subject are set out in Annex 1.

5. Our obligations

We will:

• process only on your documented instructions, which comprise this DPA, the Terms of Service, and your use of the Service’s features — unless required to do otherwise by law, in which case we will tell you before processing unless the law forbids it;
• tell you if, in our opinion, an instruction infringes Data Protection Law;
• ensure confidentiality — everyone we authorise to process Customer Personal Data is bound by a duty of confidence and trained appropriately;
• implement the measures in Annex 2;
• assist you, taking into account the nature of the processing and the information available to us, with data subject requests, security, breach notification, data protection impact assessments and prior consultation;
• make available the information reasonably necessary to demonstrate our compliance with this DPA;
• delete or return Customer Personal Data as set out in section 13.

6. Your obligations

You warrant and undertake that:

• you have a lawful basis for the processing you instruct, and have given the notices and obtained the consents that Data Protection Law requires of you;
• your instructions comply with Data Protection Law, and you are responsible for the accuracy and legality of the Personal Data you supply;
• you have informed your personnel that their use of the Service is recorded in session history and audit logs visible to your administrators, and that you have complied with any employment, works-council or notification requirement applicable to such monitoring;
• you will not supply special categories of Personal Data to the Service, which is not designed to receive them.

7. Security measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. They are described in Annex 2.

We may update those measures provided the level of protection is not materially reduced.

8. Sub-processors

You give general authorisation for us to engage sub-processors. Our current sub-processors are listed at https://www.desktunnel.com/legal/sub-processors.

We will give at least thirty (30) days’ notice before adding or replacing a sub-processor, by e-mail to the account owner and by updating that page. You may object on reasonable data-protection grounds within that period. If we cannot resolve your objection, you may terminate the affected part of the Service without penalty and receive a pro-rata refund of fees paid for the unused period.

We impose on each sub-processor data-protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

9. Data subject rights

The Service gives you the means to access, correct, export and delete Customer Personal Data yourself, which is ordinarily the quickest route.

If a Data Subject contacts us directly about Customer Personal Data, we will not respond substantively except to confirm that their request has been forwarded; we will refer them to you and pass the request on without undue delay. We will assist you in responding, insofar as it is possible and proportionate for us to do so.

10. Personal data breach

We will notify you without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will describe, so far as we are able:

• the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address it and to mitigate its effects;
• a contact point for further information.

Where we cannot provide all of that at once, we will provide it in phases without undue further delay. Notification is not an admission of fault or liability.

Notifying a Supervisory Authority or Data Subjects is your responsibility as Controller; we will provide reasonable assistance.

11. International transfers

We process Customer Personal Data in Pakistan, and may process it in other countries where our infrastructure providers operate.

Pakistan is not the subject of an adequacy decision under Article 45 GDPR or the equivalent UK regime. Where Customer Personal Data is transferred from the EEA, the UK or Switzerland to us or to a sub-processor in a country without an adequacy decision:

• the Standard Contractual Clauses (Module Two: controller to processor, or Module Three where onward transfer is to a sub-processor) are incorporated into this DPA by reference and apply to that transfer;
• for the purposes of those clauses, you are the data exporter and we are the data importer; Annex 1 of this DPA populates Annexes I.A and I.B; Annex 2 populates Annex II; the governing law and forum are those of the Member State specified by you or, absent specification, the Netherlands; and the optional docking clause applies;
• for UK transfers, the International Data Transfer Addendum applies, with Tables 1 to 3 populated from this DPA and Table 4 indicating that neither party may terminate;
• we have carried out a transfer impact assessment and will provide a summary on request, and will notify you if we become subject to a legal requirement that prevents us meeting those clauses.

Where the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses prevail.

12. Audit

We will make available the information necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

Reasonably, that means:

• in the first instance we will answer a reasonable written security questionnaire, no more than once in any twelve-month period;
• an on-site inspection requires thirty (30) days’ written notice, must take place during business hours, must not unreasonably disrupt our operations, and is subject to confidentiality undertakings;
• the auditor must not be a competitor of ours, and you bear the cost unless the audit reveals material non-compliance;
• an audit may also be triggered by a Personal Data Breach affecting your data or by a Supervisory Authority’s requirement, without the twelve-month limit.

13. Return and deletion

On termination of the Service, and at your choice, we will delete or return Customer Personal Data and delete existing copies, unless law requires us to keep it.

• you may export your data through the Service at any time before termination and for thirty (30) days afterwards;
• after that period we delete it within ninety (90) days, subject to routine backup cycles, from which it is purged within a further thirty (30) days;
• we retain billing and accounting records for the period required by Pakistani tax and company law, and records needed to establish, exercise or defend a legal claim.

We will certify deletion in writing on request.

14. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service, and the two are not cumulative: the cap applies to all claims in aggregate, however arising.

Nothing in this DPA limits a Data Subject’s rights under Data Protection Law, or either party’s liability to a Supervisory Authority.

15. General

This DPA is governed by the law stated in the Terms of Service, save that where the Standard Contractual Clauses apply, the governing law for those clauses is as stated in section 11. If any provision is held invalid, the rest continues in force. This DPA takes effect on acceptance of the Terms of Service and continues for as long as we process Customer Personal Data.

Annex 1 — Processing details

A. Parties

Data exporter / Controller: the customer identified in the Terms of Service.
Data importer / Processor: Trendifyr Tech (Private) Limited, Pakistan. Contact: [email protected].

B. Description of the transfer

C. Competent Supervisory Authority

The supervisory authority of the EEA Member State in which the data exporter is established or, where the exporter is not established in the EEA, that of the Member State in which its representative is established or in which the relevant Data Subjects are located. For UK transfers, the Information Commissioner’s Office.

Annex 2 — Technical and organisational measures

The measures below are implemented as at the date of this DPA. They may be updated provided the level of protection is not materially reduced.

Encryption

• Session content encrypted end to end with TLS 1.3 using per-session certificates, pinned at both endpoints; TLS session resumption disabled so that pinning cannot be bypassed.
• All connections to our servers encrypted in transit.
• Local application settings encrypted at rest on the device.
• Account passwords hashed with bcrypt; unattended-access passwords derived with PBKDF2-SHA256 and a per-device salt, and proven by HMAC without transmission.

Access control

• Every query in the management API scoped to a single organisation; cross-tenant access treated as a security defect.
• Role-based access control built from a catalogue of granular permissions.
• Access-grant evaluation in which a deny beats an allow and the more specific target wins.
• Short-lived signed connect grants, verified offline by the device, where an organisation requires them.
• Least-privilege access to production systems within our team, reviewed periodically.

Resilience and integrity

• Parameterised database access throughout; no dynamic SQL built from user input.
• Rate limiting and escalating lockouts on authentication and unattended-access attempts.
• Regular backups, with restoration tested periodically.
• Logical separation of customer data by organisation identifier.

Accountability

• Audit logging of management actions, retained for the period of the plan.
• Documented incident-response process, including the 72-hour notification obligation in section 10.
• Confidentiality obligations on all personnel with access to Customer Personal Data.
• Change control and code review for changes affecting security or tenancy boundaries.