Data Processing Agreement
For customers who need Article 28 terms in place before they can buy. Available on request, and summarised here so you know what you’re signing.
Last updated 29 August 2026
This page summarises our DPA. Ask and we will send you the executable agreement to sign.
Roles
You are the data controller. You decide who to contact and what to say. OleaDesk is a processor, acting on your instructions, with one architectural quirk in your favour: your mailbox never reaches us, so for most of your data we are not a processor at all.
What we process on your behalf
- Your account details: name, email, plan, billing status.
- Business contact records your agents collect: company name, published business address, the reasoning for the match.
- Usage metering: how many AI calls, which feature, what they cost.
What we commit to
- Process personal data only on your documented instructions.
- Keep the sub-processor list current and give notice before adding one.
- Help you answer access, deletion and portability requests.
- Tell you without undue delay if there is a breach affecting your data.
- Delete or return your data within 90 days of the agreement ending, except records tax and accounting law requires us to keep.
- Never use your data to train models. Never sell it.
International transfers
Our AI sub-processors are in the United States, so text sent for an AI task crosses borders. Transfers rely on Standard Contractual Clauses. If that is a problem for your compliance posture, tell us before you buy rather than after.
Contact
hello@oleadesk.com. A person reads it, and abuse reports are answered before anything else.