Data Processing Agreement
Effective 17 October 2026 · Version 2026-10-17
This agreement is between your business (the controller) and SerbiDesk (the processor). It covers the personal data your business puts into SerbiDesk about other people, such as customers, clients and staff. It meets the requirements for outsourcing in the Data Privacy Act of 2012 and its rules. It is part of our Terms of Service, and the business owner or an admin accepts it for the business.
What data and why
We process this data only to provide the SerbiDesk apps your business uses, for as long as your business uses them.
| Who the data is about | Typical data |
|---|---|
| Your customers and clients | Name, phone, email, address, bookings, services, invoices, payments, notes you write |
| Your staff | Name, phone, email, role, schedule, sales and commission figures |
| Units and sites you service | Location and details you record, linked to a customer |
We act only on your instructions
We process the data only to run the service as you use it, and as these terms describe. We do not use it for our own purposes, sell it, or combine it with other businesses' data. If the law requires us to do something else with it, we will tell you first unless the law forbids that.
Your duties as controller
- Have a lawful reason to collect and use the data.
- Tell the people concerned how you use their data, for example with a privacy notice. SerbiDesk shows a short notice on the public pages it runs for you.
- Collect only what you need and keep it correct.
- Decide who on your team can see it, and remove access when someone leaves.
Confidentiality
Only people who need access to run or support the service can reach the data, and they are bound to keep it confidential. Our platform administrators see business totals only, not your customers' records.
Security measures
- Each business's data is kept separate by database rules that are tested automatically.
- Connections are encrypted.
- Sign-in is protected, and staff only see what their role allows.
- Changes are recorded in an audit log.
- Backups are encrypted and stored off-site.
Sub-processors
You allow us to use the sub-processors on our Sub-processors page. Each is bound by a contract that protects the data at least as well as this agreement. We will update that page and tell owners by email at least 15 days before adding a new one. If you object for a good reason, you may cancel and get a refund of unused paid time.
Breaches
If we learn of a breach affecting your data, we will tell you without undue delay, and within 72 hours, with what we know: what happened, what data, what we are doing, and what you should do. We will help you notify the National Privacy Commission and the people affected if that is required.
Help with requests
If one of your customers or staff asks to see, fix or delete their data, you can do most of it in the app. If you cannot, we will help. If they contact us directly, we will send them to you.
When the service ends
When your business closes its account, you can export the data for 30 days. After that we delete it, except copies the law requires us to keep and copies in backups, which are replaced within 8 weeks.
Showing that we comply
On reasonable request, we will give you the information you need to check that we meet this agreement. Write to [email protected].