This DPA forms part of the agreement between SCREENDESK SAS ("Screendesk") and Customer. It applies to personal data in Customer Data processed on Customer's behalf. A separately signed DPA prevails on the same subject. Mandatory data-protection law and applicable standard contractual clauses prevail over conflicting provisions. Defined terms otherwise follow the Terms.
1. Roles and scope
Customer is the controller or a processor acting under its controller's authority. Screendesk is the processor or subprocessor. Customer is responsible for lawful collection, notices, permissions and instructions, including recording and AI processing. Screendesk is responsible for its processor obligations. Controller processing for account administration and our own business operations is described in the Privacy Policy.
"Data Protection Laws" means laws applicable to the processing, including the EU GDPR, French data-protection law, UK GDPR and Data Protection Act, Swiss FADP and applicable US state privacy laws. "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. It does not require proof of fault by Screendesk.
2. Documented instructions
The agreement, this DPA, the Customer's configuration and authorized use of supported features are documented instructions. We process personal data only to provide, secure and support those features, follow additional lawful written instructions, or comply with law. If legally required to process otherwise, we notify Customer beforehand unless prohibited.
We promptly tell Customer if an instruction appears to infringe Data Protection Laws and may pause the affected processing while the parties resolve it. We do not sell or use Customer Personal Data for advertising, train general-purpose AI models with it, or determine unrelated purposes. Customer may request assistance for instructions outside standard functionality; additional reasonable costs must be agreed in advance and cannot prevent compliance with our legal duties.
3. People and security
We restrict access to authorized personnel who need it and are bound by confidentiality duties. We maintain the technical and organizational measures in Annex II: Security Measures, appropriate to the risks and taking account of the nature of processing. Measures may evolve without materially reducing the overall protection during the term. Customer manages its users, devices, sharing permissions and integrations.
4. Assistance and individual rights
We promptly forward requests relating to Customer Personal Data and do not respond substantively without Customer's instructions unless legally required. Taking account of the nature of processing and information available, we provide reasonable technical and organizational assistance with access, correction, deletion, restriction, portability, objections, security duties, breach notifications, impact assessments and prior consultation with regulators.
Customer remains responsible for its decisions and communications to individuals or authorities. We will cooperate with competent supervisory authorities as required by law.
5. Personal-data breaches
We notify Customer without undue delay after becoming aware of a Personal Data Breach affecting its data. We do not wait for a final investigation report before giving an initial notice. We provide the information then available, including the nature of the breach, categories and approximate numbers affected where known, likely consequences, mitigation taken or proposed, and a contact for follow-up. We supplement the notice as facts become available.
We investigate, contain and remediate the breach, preserve relevant evidence and reasonably assist Customer's notification duties. Customer should maintain an up-to-date security or administrative contact. Notification is not an admission of liability. Unsuccessful attacks with no compromise of personal data are not a Personal Data Breach.
6. Subprocessors
Customer gives general authorization for the subprocessors identified in the Subprocessors register, subject to the following safeguards. We impose written obligations no less protective for the relevant processing and remain responsible for their performance.
We give at least 30 days' advance notice of a new or replacement subprocessor to the workspace's designated administrative or privacy contact, with its purpose and processing locations. Posting a change alone does not replace that notice. Customer may object on reasonable data-protection grounds within that period. We will discuss the concern and seek a reasonable alternative or mitigation.
If no reasonable resolution is possible, Customer may terminate the affected service before the new processing begins and receive unused prepaid fees for it. We will not require the objected-to processing to continue while this resolution is pending. If an urgent replacement is necessary to protect service or data, we give as much advance notice as reasonably possible, explain the urgency and preserve the objection and termination rights.
7. International transfers
We do not transfer personal data in breach of Data Protection Laws. For restricted transfers, we use an applicable adequacy decision or a valid safeguard, assess destination-country risks and implement supplementary measures where needed. We put required onward-transfer protections in place with subprocessors. Choosing a media-storage region does not by itself restrict all other processing; any broader residency requirement must be expressly agreed.
Where a transfer directly between Customer and Screendesk lawfully requires and is eligible for the EU clauses, the 2021/914 Standard Contractual Clauses are incorporated without modification: Module Two for a controller exporter and Module Three for a processor exporter. Clause 7 applies; clause 9 uses general authorization with the notice in section 6; the optional clause 11 language is excluded; clause 17 uses French law and clause 18 the courts of France. The competent authority follows clause 13. Annex I is completed by Annex I below and Customer's Order; Annex II is our Security Measures; Annex III is the approved subprocessor schedule where required. Acceptance of this DPA also executes the applicable clauses.
For an eligible UK restricted transfer using those clauses, the ICO's International Data Transfer Addendum, version B1.0 effective 21 March 2022 as lawfully revised, applies. Table 1 uses the parties and contacts in Annex I and the Order; Table 2 selects the clauses above; Table 3 uses the same annexes; in Table 4 either party may end the Addendum as its mandatory terms permit. Its mandatory clauses apply and prevail. For Swiss transfers, references include the FADP, the competent Swiss authority and Swiss data-subject enforcement rights where required, without restricting GDPR rights.
These selections do not assume that every transfer to Screendesk in France requires clauses, or authorize an ineligible transfer mechanism. We must execute any other legally required instrument before the relevant transfer. A transfer that loses its lawful basis must be remedied or suspended. Customer may request information about applicable safeguards and transfer assessments, subject to proportionate confidentiality protections.
8. Return, deletion and backups
During the term, Customer may use available controls or request assistance to export or delete data. On termination, Customer may choose return or deletion. Unless earlier deletion is requested, we provide a 30-day export period, then delete Customer Personal Data from active systems within 30 days. For an earlier valid deletion instruction, active deletion occurs within 30 days of that instruction, subject to any expressly agreed shorter period.
Residual backup copies are isolated from normal use and expire within 60 days of active deletion. If restored for recovery, deletion instructions are reapplied. We instruct relevant subprocessors to delete and confirm completion on reasonable request. Lawfully required retention is limited to the required data and period, remains protected, and is not used for unrelated purposes. We explain the legal restriction when permitted. These windows do not extend the retention a customer expressly selects for an individual recording.
9. Demonstrating compliance and audits
We make information reasonably needed to demonstrate compliance available, including relevant independent reports and security responses under confidentiality safeguards. Customer may conduct, or appoint an independent qualified auditor to conduct, an appropriate audit where that information is insufficient.
Routine audits ordinarily occur once a year on at least 30 days' notice during business hours, using methods that protect other customers and service security. Those limits do not prevent audits required by law, a regulator, a material incident or credible evidence of non-compliance. We will reasonably cooperate on scope and timing and may propose equivalent evidence instead of exposing another customer's data or privileged information.
Each party bears its own ordinary costs. Exceptional assistance costs must be reasonable and agreed in advance. We bear our costs of an audit showing our material non-compliance and of remediation. No fee or procedural condition limits mandatory audit rights. We will address substantiated findings within a reasonable risk-based period.
10. US service-provider terms
Where applicable, we act as a service provider or contractor for the specific business purposes in Annex I. We do not sell or share Customer Personal Data, retain, use or disclose it outside those purposes or the direct business relationship except as law permits, or combine it with information from other sources except as permitted by applicable law.
We will comply with applicable obligations, provide the same level of protection required by law, and notify Customer if we can no longer comply. Customer may take reasonable steps to verify compliance and stop and remediate unauthorized use. We certify that we understand and will comply with these restrictions. Subprocessors must be contractually bound to the applicable restrictions.
11. Liability and duration
This DPA continues while we process Customer Personal Data. The agreement's applicable liability provisions govern between the parties, without limiting data-subject rights, mandatory regulatory powers or standard contractual clause liability. The signed-agreement priority rule does not permit either party to contract out of mandatory protections.
Annex I. Processing details
Parties and contacts. Customer is the entity identified in its Order, with the address and privacy or administrative contact it provides. Screendesk is SCREENDESK SAS, 7 allée du Long, 26500 Bourg-lès-Valence, France, SIREN 920 766 383; contact support@screendesk.io. Their roles follow section 1. The agreement's acceptance date is the date of execution for this annex.
Subject matter and purpose. Providing the purchased video communication and issue-resolution service, including capture, upload, storage, playback, sharing, live communication, diagnosis, transcription, AI processing, search, integrations, security, support, export and deletion under Customer instructions.
Nature and frequency. Collection, recording, organization, storage, retrieval, consultation, transformation, transmission, analysis, restriction and erasure. Processing is ongoing during use; individual transfers are triggered by selected features and instructions.
Individuals. Customer's employees, contractors, users, customers, prospects, recording viewers, call participants and other people whose information Customer lawfully includes.
Data categories. Identifiers and contact details; images, voices and screen content; transcripts and communications; work-related content and knowledge sources; URLs, console and network diagnostics; device, browser, usage and security information; integration data; AI inputs and outputs. Only information needed for enabled functions should be provided.
Sensitive data. Not intended for special-category or criminal-offence data without prior written agreement. If incidentally present, apply the DPA, restricted access and prompt assistance to minimize or remove it. Any intentional processing requires documented additional safeguards.
Duration. The service term and limited export, deletion and backup periods in section 8, subject to lawful retention. Subprocessor processing is limited to its assigned purpose and duration.
Supervisory authority. For Screendesk's French establishment, the CNIL; for a transfer, the authority required by clause 13 and applicable law. Annex II is the linked Security Measures. The approved provider schedule and any signed location restrictions complete the relevant subprocessor particulars.