OpsDesk 360 Data Processing Agreement
1. About this agreement
1.1 This Data Processing Agreement ("DPA") forms part of the OpsDesk 360 Terms of Service at /terms (the "Terms").
1.2 It applies where OpsVerse Ltd processes personal data on behalf of a customer in providing OpsDesk 360 (the "Service").
1.3 It is made under Article 28 of the UK GDPR, and of the EU GDPR where that applies.
1.4 OpsVerse Ltd is a company registered in England and Wales with company number 17213522. Correspondence address: 4th Floor Office, 205 Regent Street, London W1B 4HB. Email: moiz@opsverseai.com.
1.5 Words defined in the Terms have the same meaning here. "Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR.
2. Roles
2.1 The customer is the controller of the personal data in its account.
2.2 OpsVerse is the processor.
2.3 The customer is responsible for having a lawful basis for the personal data it puts into the Service.
3. Details of the processing
3.1 Subject matter. Providing the Service to the customer.
3.2 Duration. For as long as the customer's subscription continues, and then until deletion under clause 11.
3.3 Nature and purpose. Storing, organising, displaying and sending reminders about the customer's records, obligations and evidence, so the customer can run and evidence its operations. This includes optional AI and WhatsApp features, only where the customer switches them on.
3.4 Types of personal data.
(a) Names.
(b) Work email addresses.
(c) Phone numbers, for WhatsApp, only where the user has opted in.
(d) Roles.
(e) Item content and attachments that the customer uploads, which may include personal data.
3.5 Data subjects.
(a) The customer's staff and Users.
(b) Counterparties named in the customer's records.
4. Instructions
4.1 We process personal data only on the customer's documented instructions. These Terms, this DPA and the customer's use and configuration of the Service are those instructions.
4.2 If the law requires us to process personal data in another way, we will tell the customer first, unless the law prevents us from doing so.
4.3 We will tell the customer if we believe an instruction breaks data protection law.
5. Confidentiality
5.1 Everyone we authorise to process the customer's personal data is bound by a duty of confidentiality.
6. Security
6.1 We take appropriate technical and organisational measures to protect personal data. These include:
(a) encryption in transit and at rest;
(b) access controlled by role, separately for each organisation;
(c) an append-only history, so records cannot be edited after the fact; and
(d) weekly encrypted backups.
7. Sub-processors
7.1 The customer gives general authorisation for us to use the sub-processors listed in the table below.
7.2 We will give the customer notice by email of any intended addition or replacement of a sub-processor, at least 30 days before the change.
7.3 The customer may object to the change within that notice period. If we cannot resolve the objection, the customer may end its subscription without penalty before the change takes effect, with a full export of its record.
7.4 We will put data protection terms in place with each sub-processor that give the same level of protection as this DPA.
7.5 We remain responsible to the customer for the work of our sub-processors.
| Sub-processor | Purpose | When used | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Always | United Kingdom (London) |
| Vercel | Application hosting | Always | United Kingdom (London) for application functions; content delivery worldwide |
| Stripe | Payments | Always (billing contact data only) | United States (under the provider's data processing terms; see clause 13) |
| Resend | Email delivery | Always | United States (under the provider's data processing terms; see clause 13) |
| Anthropic | AI processing | Only when the customer switches AI features on. No training on customer data | United States (under the provider's data processing terms; see clause 13) |
| Meta Platforms | WhatsApp messages | Only when the customer switches WhatsApp on | United States (under the provider's data processing terms; see clause 13) |
| GitHub | Encrypted backups | Always | United States (under the provider's data processing terms; see clause 13) |
8. Help with data subject requests
8.1 We will help the customer, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights.
8.2 If we receive such a request directly, we will pass it to the customer and will not respond ourselves unless the customer instructs us to.
8.3 Customers can also export their complete record at any time from the Service.
9. Personal data breaches
9.1 We will notify the customer of a personal data breach affecting its data without undue delay, and in any event within 48 hours of becoming aware of it.
9.2 We will give the customer the information it reasonably needs to meet its own obligations, as that information becomes available.
9.3 We will help the customer with its own breach notifications, data protection impact assessments and consultations with the regulator, where they relate to the Service.
10. Onboarding material
10.1 Where the customer gives us raw emails or chat exports to help set up its account, we delete them after 30 days, unless they are kept in the record as evidence.
11. Deletion or return at the end
11.1 The customer can export its complete record at any time, including before its subscription ends.
11.2 After cancellation takes effect, we keep the customer's data for 30 days and then delete it, unless the customer asks for earlier deletion.
11.3 Encrypted backups are kept for up to 90 days. Deleted data leaves our backups within 90 days of deletion.
11.4 If OpsVerse ever stops trading, every organisation will receive a full export of its record.
11.5 We may keep personal data after this only where the law requires us to.
12. Audits and information
12.1 We will make available the documentation reasonably needed to show that we meet our obligations under this DPA.
12.2 We will allow audits by the customer, or an auditor it appoints, on reasonable request, with at least 30 days' notice, no more than once a year (unless a personal data breach has occurred), and at the customer's cost. We first offer our written documentation, which answers most audit requests.
13. International transfers
13.1 Where personal data is transferred outside the UK (or the EEA, where the EU GDPR applies) to a country without adequacy, we will make sure a valid transfer mechanism is in place.
13.2 This will be the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as needed.
14. Liability
14.1 Each party's liability under this DPA is subject to the limits and exclusions in the Terms.
15. Order of precedence
15.1 If this DPA and the Terms conflict on the processing of personal data, this DPA applies.
16. Governing law
16.1 This DPA is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.
Last updated 14 October 2026.