This document is a working draft until it has been reviewed by our lawyers before launch. The binding version will be published here and dated.
Provider: ChaosDesk is provided by ASKEM d.o.o. Sarajevo (ASKEM Društvo sa ograničenom odgovornošću), a company registered in Bosnia and Herzegovina, registration number (MBS) 65-01-0279-26, tax identification number (JIB) 4203628980007.
This summary describes the data processing agreement (DPA) that forms part of the terms of service. It is a draft awaiting legal review: no signed version exists yet, and a signable PDF will be downloadable from the Admin Center before the public launch. If you need a signed DPA now, write to [email protected].
Roles
You (the customer) are the controller of the personal data in your workspace. ASKEM d.o.o. Sarajevo is the processor and processes it only on your documented instructions: to provide, secure and support the service.
Data and purposes
Ticket content, messages, attachments, help-centre accounts, and the names, email addresses, phone numbers and identifiers of your end users and staff, processed to deliver the helpdesk service you configure.
Security measures
Hosting in Germany, TLS for every connection to us and inside the stack, provider-side encryption of disks and object storage at rest, encryption of integration secrets with a key per workspace, workspace isolation enforced by the database, an append-only audit trail, role-based access with optional single sign-on and multi-factor authentication, PII redaction rules, retention policies and erasure requests. The trust centre lists each measure, and says which ones arrive with the production platform rather than today’s private beta.
AI features
AI features are not active: no AI provider is connected to the service, so no ticket text has been sent to one. When you enable them, ticket text is sent to our AI subprocessor after personal data is masked, it is not used to train models, and admins can switch AI off for the whole workspace. We give 30 days’ notice before an AI subprocessor starts processing.
Subprocessors
Listed on the subprocessors page. We announce new subprocessors 30 days in advance, and you may object.
Breaches
We notify you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your workspace, with the facts you need for your own notice under GDPR Article 33(3).
Assistance, audits and deletion
We help you answer data subject requests (export, erasure) and with impact assessments. You may audit our compliance as set out in the final DPA. At the end of the contract you can export your data; we then delete it within 30 days, and backups expire on their normal cycle: database and search backups are kept 30 days, and the host’s whole-disk server backups 7 days.
International transfers
Data is stored in Germany. Transfers to the subprocessors outside the EU named on the subprocessors page use an adequacy decision or the EU Standard Contractual Clauses.