Data Processing Agreement
For customers who need Article 28 terms in place before they can buy. Available on request, and summarised here so you know what you're signing.
Last updated 25 July 2026
This page summarises our DPA. The executable agreement is [TO CONFIRM] pending the company's formation. Ask and we will send the current draft. We would rather tell you that than publish a contract signed by a company that does not exist yet.
Roles
You are the data controller. You decide who to contact and what to say. OleaDesk is a processor, acting on your instructions, with one architectural quirk in your favour: your mailbox never reaches us, so for most of your data we are not a processor at all.
What we process on your behalf
- Your account details: name, email, plan, billing status.
- Business contact records your agents collect: company name, published business address, the reasoning for the match.
- Usage metering: how many AI calls, which feature, what they cost.
What we commit to
- Process personal data only on your documented instructions.
- Keep the sub-processor list current and give notice before adding one.
- Help you answer access, deletion and portability requests.
- Tell you without undue delay if there is a breach affecting your data.
- Delete or return your data when the agreement ends.
- Never use your data to train models. Never sell it.
International transfers
Our AI sub-processors are in the United States, so text sent for an AI task crosses borders. Transfers rely on Standard Contractual Clauses. If that is a problem for your compliance posture, tell us before you buy rather than after.
Contact
hello@oleadesk.com. A person reads it, and abuse reports are answered before anything else.