VCDesk Data Processing Agreement

1. Scope and parties

1.1 This Data Processing Agreement ("DPA") is between Voltex Computers Limited (company number 04038413, ICO registration Z1874861), trading as VCDesk ("Processor", "we"), and the customer or reseller that has agreed to the VCDesk Terms and Conditions or a VCDesk Reseller Agreement (the "Agreement") ("Client", "you").

1.2 It forms part of the Agreement and applies whenever we process personal data in Customer Data for you.

1.3 Direct customers. If you buy VCDesk directly, you are the controller and we are your processor.

1.4 Resellers. If you are a reseller, you act as processor for your own customers (the controllers), and we act as your sub-processor. You confirm you are authorised by each of your customers to appoint us. Where this DPA refers to your instructions, it includes the instructions you pass on from your customers.

1.5 This DPA does not cover personal data we process as a controller, such as account and billing data. That is covered by our Privacy Policy.

2. Definitions

Terms such as controller, processor, personal data, personal data breach, data subject and processing have the meanings given in UK GDPR. In addition:

3. Our obligations as processor

3.1 We will:

• process Customer Data only on your documented instructions, including with regard to international transfers, unless the law requires otherwise. If it does, we will tell you first unless the law forbids it. The Agreement, this DPA and your use of the Service's settings are your instructions;
• tell you straight away if we think an instruction breaks Data Protection Law;
• make sure everyone authorised to process Customer Data is bound by confidentiality;
• take the security measures required by Article 32 of UK GDPR, as set out in Annex 3;
• only use sub-processors under clause 4;
• help you, taking into account the nature of the processing, to respond to data subject requests (clause 7);
• help you meet your duties on security, breach notification, data protection impact assessments and prior consultation with the ICO (Articles 32 to 36);
• delete or return Customer Data when the service ends (clause 7);
• make available the information you need to show compliance with Article 28, and allow audits under clause 7.

3.2 Your obligations. You are responsible for: having a lawful basis for the Customer Data; giving data subjects the required privacy information; making sure your instructions are lawful; and choosing settings (such as AI features and retention) that suit your obligations.

4. Sub-processors

4.1 General authorisation. You authorise us to use the sub-processors in Annex 2.

4.2 Changes. We will give at least 30 days' notice before adding or replacing a sub-processor, by email to your account contact and by updating Annex 2.

4.3 Objections. You may object on reasonable data protection grounds within that 30 days. We will then work with you in good faith to find a solution. If we cannot, you may end the affected part of the Service before the change takes effect, without penalty. We will refund any Fees you have paid in advance for the period after termination.

4.4 Flow-down. We will put a written contract in place with each sub-processor. It will impose data protection obligations that are no less protective than this DPA. We remain liable to you for our sub-processors' performance.

4.5 Your own AI provider. If you connect your own AI key (bring your own key), that provider is engaged by you, not by us. It is not our sub-processor.

5. Security and personal data breaches

5.1 We will keep in place the technical and organisational measures in Annex 3. We may update them, provided the overall level of protection is not reduced.

5.2 Notification. We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data.

5.3 Our notice will include, as far as we know at the time: what happened; the categories and approximate number of data subjects and records affected; the likely consequences; and what we have done or propose to do. We will give further information as it becomes available.

5.4 We will take reasonable steps to contain and investigate the breach and reduce its effects. We will not tell data subjects or the ICO about a breach of Customer Data on your behalf unless you ask us to or the law requires it.

5.5 Telling you about a breach is not an admission of fault or liability.

6. International transfers

6.1 We host Customer Data in the United Kingdom. We will not make a Restricted Transfer of Customer Data except to the sub-processors in Annex 2, or as you instruct.

6.2 For each Restricted Transfer, we will make sure a valid safeguard under UK GDPR is in place, such as: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified); the ICO's International Data Transfer Agreement; or the EU Standard Contractual Clauses with the UK Addendum. We will carry out and record a transfer risk assessment.

6.3 If a safeguard stops being valid, we will put another in place, or stop the transfer and tell you.

7. Assistance, audits, deletion and return

7.1 Data subject requests. If a data subject contacts us directly about Customer Data, we will pass the request to you without undue delay. We will not respond ourselves unless you authorise it. The Service lets you find, export, correct and delete Customer Data yourself. Where you need more help, we will provide it within a reasonable time.

7.2 Other assistance. We will give you reasonable help with data protection impact assessments and consultations with the ICO that relate to the Service. If this help goes beyond what the Service and our documentation already provide, we may charge our reasonable costs.

7.3 Audits. We will make available our security documentation and answers to reasonable security questionnaires. If that is not enough to show compliance, you, or an independent auditor bound by confidentiality, may audit us. You must give at least 30 days' notice, audit no more than once a year (unless after a breach or at a regulator's request), audit during business hours, and avoid disrupting the Service or seeing other clients' data. You will pay the cost of the audit.

7.4 Return and deletion. When the Agreement ends, you can export Customer Data for 30 days. After that, we will delete Customer Data from the live Service within a further 30 days, and from backups when they are overwritten within 90 days. We will keep a copy only where the law requires it, and will keep protecting it under this DPA. On request, we will confirm deletion in writing.

8. Liability and order of precedence

8.1 Each party's liability under or in connection with this DPA is subject to the limits and exclusions of liability in the Agreement. This does not limit any party's liability to data subjects under Article 82 of UK GDPR, or anything else that cannot be limited by law.

8.2 If this DPA conflicts with the Agreement on data protection, this DPA prevails. If any transfer safeguard under clause 6 conflicts with this DPA, the safeguard prevails.

8.3 This DPA lasts for as long as we process Customer Data for you. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of processing

Annex 2: Sub-processors

Stripe is not a sub-processor of Customer Data. It processes billing data only, for which VCDesk is a controller (see the Privacy Policy), not Customer Data.

Last updated: 15 October 2026

Annex 3: Technical and organisational measures