Data Processing Agreement

We process personal data only to provide the AlphaDesk service to you, and only on your documented instructions — which, for ordinary use, are the instructions contained in our Terms of Service and this agreement. We will tell you if an instruction appears to breach applicable data protection law.

Subject matter: providing remote desktop access, support and diagnostics.
Duration: for as long as you use AlphaDesk, plus the retention periods in clause 7.
Categories of data subject: your staff and anyone whose device they connect to with consent.
Types of data: device identifiers and names, Windows user names, IP addresses, hardware and operating system details, session records, transfer and clipboard metadata including file names, diagnostic logs, error and crash reports.

We do not process the content of a remote session — screen, keystrokes, file contents or clipboard contents — beyond passing it between the two computers. The one qualification is memory dumps from crash reports, described in our Privacy Policy.

• We process personal data only on your instructions and for no other purpose.
• Everyone we allow to access it is bound by a duty of confidentiality.
• We take appropriate technical and organisational security measures (clause 4).
• We help you respond to requests from individuals exercising their rights.
• We help you with security, breach notification and impact assessments, so far as the data we hold allows.
• We make available the information you need to show we are meeting these obligations.

• You confirm you have a lawful basis — normally consent — for the personal data you put into AlphaDesk.
• You are responsible for telling the people whose data it is what you are doing with it.
• You must not connect to any device without the informed consent of the person responsible for it.
• You are responsible for who you give access to your account and devices.

• Session traffic is encrypted between the two computers.
• Passwords are never stored in a readable form.
• Administrative access is limited to named staff accounts and is not publicly reachable.
• Repeated failed authentication is automatically rate-limited and blocked.
• Production, test and development environments are kept separate.
• Access is removed when a staff member leaves.

You give general authorisation for us to engage subprocessors. The current list is published at /legal/subprocessors, and we update it before any new subprocessor begins work.

You may object to a new subprocessor on reasonable grounds within 14 days of the list changing. We will look for a workable alternative; if none can be agreed, either of us may terminate the affected service. Each subprocessor is bound by data protection obligations no less protective than these, and we remain responsible to you for their performance.

If we become aware of a breach affecting personal data we process for you, we will notify you without undue delay, with the information we have at the time, and will keep you updated as we learn more. We will cooperate with you in investigating and remediating it, and will support any notification you must make to the Data Protection Board of India or to affected individuals.

We keep personal data in line with our Privacy Policy: connection and usage data for 2 years or until consent is withdrawn, memory dumps for 7 days, and everything else only while it serves the purpose it was collected for.

On termination we will delete the personal data we hold for you, except where a law requires us to keep it. We will confirm deletion in writing if you ask.

On reasonable written request, and not more than once a year unless a breach has occurred, we will provide the information you need to verify our compliance with this agreement. Where documentation is not enough, we will accommodate an audit on at least two weeks' notice, during business hours, by you or an auditor bound to confidentiality who is not a competitor of ours.

Our infrastructure is described in our Privacy Policy. Where personal data is transferred outside India, we do so only with appropriate safeguards and in line with applicable law.

This agreement is governed by the laws of India, and the courts of Ahmedabad, Gujarat have exclusive jurisdiction. Where it conflicts with our Terms of Service on the processing of personal data, this agreement prevails. Our liability under it is subject to the limits in the Terms of Service.

For most business customers nothing needs signing — accepting our Terms of Service brings this agreement into effect. If your organisation needs a countersigned copy, email privacy@alphadesk.me and we will arrange it.

Alpha ERP Solutions Private Limited, 819, Times Square Arcade, opp. Rambaug, Thaltej-Shilaj Road, Ahmedabad, Gujarat 380059, India