dskerooData Processing Agreement
Last updated: 14 November 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Oxana Ktoridou ("Processor", "dskeroo") and the Customer ("Controller") and applies where dskeroo processes personal data on the Customer's behalf. It is designed to meet Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Details of processing
| Subject matter | Provision of the dskeroo desk booking service. |
|---|---|
| Duration | For the term of the Customer's account, plus the deletion period below. |
| Nature and purpose | Hosting, storing, displaying and organising data so Users can book desks, see colleagues' bookings and admins can manage workspaces and view reports. |
| Data subjects | The Customer's employees, contractors and other people it invites (Users). |
| Personal data | Name, email address, profile photo URL, Google or Microsoft account identifier, role, invite records, desk bookings (desk, date, timestamps), last sign-in time, technical logs (IP address, user agent). |
| Special categories | None. The Customer must not enter special-category data into the Service. |
2. Processor obligations
dskeroo will:
- process personal data only on the Customer's documented instructions — the Terms, this DPA and the Customer's use of the Service's features are those instructions — unless required by law, in which case it will inform the Customer unless the law prohibits it;
- ensure that people authorised to process the data are bound by confidentiality;
- implement the security measures in section 5;
- respect the conditions for engaging sub-processors in section 4;
- taking into account the nature of processing, assist the Customer in responding to data subject requests, including through the Service's self-service export and deletion tools;
- assist the Customer with security, breach notification, data protection impact assessments and prior consultation, as far as relevant to the Service;
- at the end of the Service, delete personal data as described in section 7;
- make available the information needed to demonstrate compliance with this DPA, and allow for audits as described in section 8.
3. Customer obligations
The Customer is responsible for the lawfulness of the processing, including having a valid legal basis, providing information to its Users, and the accuracy of the data it enters.
4. Sub-processors
The Customer gives general authorisation for dskeroo to engage sub-processors. dskeroo imposes data protection obligations on each sub-processor equivalent to this DPA and remains responsible for their performance. Current sub-processors:
| Sub-processor | Purpose | Location / transfer mechanism |
|---|---|---|
| Cloudflare, Inc. | Application hosting (Workers), database (D1), content delivery, DDoS and bot protection | Global network; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Google LLC / Google Ireland Ltd | User authentication (Sign in with Google) | EU/US; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Microsoft Corporation / Microsoft Ireland Operations Ltd | User authentication (Sign in with Microsoft) | EU/US; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. | Subscription billing, payment processing, invoicing and VAT calculation for the Customer's billing contact | EU/US; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Delivery of sign-in and invite emails | US; Standard Contractual Clauses |
We'll give at least 30 days' notice of new sub-processors by updating this page and emailing company owners who have asked to be notified at privacy@dskeroo.com. The Customer may object on reasonable data protection grounds; if we can't address the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.
5. Security measures
- Encryption in transit (TLS) for all traffic and encryption at rest by the hosting provider.
- Logical separation of each Customer's data; every query is scoped to the Customer's account.
- Authentication via Google or Microsoft OAuth 2.0 with PKCE, or single-use email sign-in links that expire after 15 minutes and are rate-limited; session tokens stored only as SHA-256 hashes; HttpOnly, Secure, SameSite cookies; origin checks on state-changing requests.
- Role-based access control within each workspace (owner, admin, member).
- Least-privilege access for dskeroo staff; access to production limited to what's needed for operation and support.
- Point-in-time database recovery provided by the hosting platform, with backups overwritten within 30 days.
- DDoS protection and web application security through Cloudflare.
6. Personal data breaches
dskeroo will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will include the information reasonably available to help the Customer meet its own obligations.
7. Return and deletion
The Customer can export booking data at any time, and can delete individual users or its entire company from the Service. On deletion, or 30 days after termination of the account, dskeroo deletes Customer personal data from live systems; residual backup copies are overwritten within a further 30 days, unless law requires longer retention.
8. Audits
dskeroo will answer reasonable written security questionnaires once per year. If that is not enough to demonstrate compliance, or if a supervisory authority requires it, the Customer may carry out an audit on 30 days' notice, during business hours, at its own cost, and subject to confidentiality.
9. International transfers
Where processing involves a transfer of personal data outside the EEA or UK to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module 2 or 3, as applicable), and the UK Addendum where relevant, are incorporated by reference.
10. Precedence
If this DPA conflicts with the Terms on data protection matters, this DPA prevails.
Processor
Oxana Ktoridou, an individual trading as dskeroo, Keryneias 20, 2008 Nicosia, Cyprus. Contact: privacy@dskeroo.com.