Data Processing Agreement (DPA)

1. Conclusion of the agreement

By creating an Organization on deskandpark.com and accepting the Agreement, the Terms of Service and the Privacy Policy, the Customer, acting as the controller of personal data (in particular the data of its employees and contractors), entrusts Pixel of Software sp. z o.o., registered office: ul. Adama Mickiewicza 37/58, 01-625 Warszawa, KRS 0001261874, NIP 5253103170 (“Desk & Park”, the “Provider” or the “Processor”), with processing that data on the terms of this agreement.

This data processing agreement is part of the Agreement (Annex D) and is concluded together with it, with no separate signature required. As regards the Customer's billing data and contact persons' data, the Provider is a separate controller, as described in the Privacy Policy.

2. Scope of processing

• Subject matter: provision of the Service under the Agreement.
• Nature and purpose: storing and making data available for booking office resources (desks, parking spots, meeting rooms) and recording attendance.
• Categories of data subjects: the Customer's employees and contractors; visitors registered by the Customer.
• Special categories of data: not processed. The Customer undertakes not to enter such data.

The data processed may include:

• first and last name, work e-mail address, department and team;
• optionally, phone number and profile photo;
• booking and attendance data;
• IP address and session identifier;
• authentication data (password hash, 2FA and passkey data);
• mobile device token for push notifications;
• content of support tickets, including attached screenshots.

Each Organization's data is stored in that Organization's own, isolated database.

3. Desk & Park's obligations as Processor

Desk & Park undertakes to:

• process data only on the Customer's documented instructions, which include the Agreement;
• ensure that persons authorised to process the data are bound by confidentiality;
• apply the security measures described in § 10(2) of the Agreement, in particular: transport encryption (TLS), separation of customer data into separate databases, role-based access control, mandatory multi-factor authentication for platform operator accounts, two-factor authentication (TOTP) and passkeys available to every User, logging of administrative events, and daily backups of the Organization database (unless the Administrator turns them off in the settings);
• assist the Customer in responding to data subject requests, including through the export function available in the Service and by deleting the Organization at the Customer's request;
• notify the Customer of a personal data breach without undue delay and no later than 24 hours after becoming aware of it (§ 8(3) of the Agreement);
• delete the data after the Agreement ends, in accordance with § 11(5) of the Agreement (section 7 below);
• make available the information necessary to demonstrate compliance with Article 28 GDPR.

4. Sub-processors

The Customer grants general authorisation for the use of the following sub-processors. Desk & Park gives 30 days' notice of an intended change; the Customer may object on reasonable grounds and, if no solution is found, terminate the Agreement with immediate effect and a refund for the unused period.

5. Right to audit

On the Customer's written request, made no more than once a year, Desk & Park makes available the information necessary to demonstrate that the processing complies with the GDPR. An on-site audit requires the date and scope to be agreed in advance and is carried out at the Customer's expense.

6. Transfers outside the EEA

Customer Data may be transferred outside the European Economic Area only to the extent that the sub-processors listed in section 4 process it, and only on the basis of an adequacy decision or other safeguards under Chapter V GDPR, in particular standard contractual clauses. Desk & Park informs the Customer in advance of any other transfer.

7. Retention and deletion

• After the Agreement ends, the Customer can obtain its data in the export format provided by the Service for 30 days; after that, the data and the Organization database are permanently deleted (§ 11(5) of the Agreement).
• On withdrawal from the Agreement, the data and the Organization database are permanently deleted 14 days after the notice of withdrawal (Annex C, section C.5).
• Files uploaded to the Service, the Organization's data in the Service's central database and backups are deleted in accordance with Annex C, section C.5(3) of the Agreement. Billing and contract records are kept for the period required by accounting and tax law.

The Customer can at any time submit an Organization deletion request in the Service or write to hello@pixelofsoftware.com.

8. Term

This data processing agreement remains in force for the term of the Agreement and for the deletion periods set out in section 7.

9. Liability

The parties' liability is governed by § 9 of the Agreement. The limitations of liability do not apply where liability cannot be limited under mandatory law, including breaches of data protection law. Desk & Park is not liable for the Customer's actions in its role as controller.

10. Contact

For questions about this data processing agreement, please write to hello@pixelofsoftware.com.