This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer that uses PulseDesk ("Customer", the controller) and Londonist Yazılım ve Teknolojileri A.Ş. ("PulseDesk", the processor). It applies whenever PulseDesk processes personal data on the Customer's behalf through the PulseDesk service. It takes effect when the Customer accepts the Terms and needs no separate signature; a countersigned copy is available on request.
1. Definitions
- Data Protection Laws means all laws on personal data that apply to the processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK"), India's Digital Personal Data Protection Act 2023 and other national laws.
- Customer Personal Data means personal data processed by PulseDesk on behalf of the Customer in providing the service.
- Sub-processor means a third party engaged by PulseDesk to process Customer Personal Data.
- Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- Terms such as "controller", "processor", "data subject" and "processing" have the meanings given in the GDPR (and the equivalent terms in other Data Protection Laws, such as "data controller" and "data processor" in KVKK).
2. Roles and scope
- The Customer is the controller and PulseDesk is the processor of Customer Personal Data. Where the Customer is itself a processor for another controller, PulseDesk is its sub-processor and the Customer remains responsible towards that controller.
- The subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
3. Customer instructions
- PulseDesk processes Customer Personal Data only on the Customer's documented instructions. These Terms, this DPA and the Customer's configuration and use of the service (for example the features it enables, its retention settings and the permissions it grants) are the Customer's complete instructions.
- PulseDesk will tell the Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the instruction until it is confirmed or changed.
- If the law requires PulseDesk to process Customer Personal Data otherwise, it will inform the Customer first unless the law forbids it.
4. Customer obligations
The Customer is responsible for the lawfulness of the processing it instructs. In particular, the Customer warrants that:
- it has a valid lawful basis for monitoring and processing the data of its employees and other users, and has carried out any data protection impact assessment that is required;
- it has informed the data subjects clearly and in advance - in its own privacy notice - about the data collected through PulseDesk, the purposes, the retention periods and who can access it, and has obtained any consents or employee representative approvals that are needed;
- it uses the service only on devices it owns or is entitled to manage and does not use it for covert monitoring, in line with the Acceptable Use Policy;
- it configures the service proportionately (for example screenshots, location and meeting recordings) and keeps its permission settings appropriate;
- it registers with or notifies supervisory authorities where its local law requires it (for example VERBİS registration under KVKK).
5. PulseDesk obligations
PulseDesk will:
- process Customer Personal Data only for the purposes set out in Annex 1 and never for its own marketing, advertising or profiling, and not sell it;
- ensure that its personnel with access to Customer Personal Data are bound by confidentiality and only access it where needed to provide or support the service;
- implement and maintain the technical and organisational measures described in Annex 2, which may be updated as long as the overall level of protection is not reduced;
- assist the Customer, taking into account the nature of the processing, with data subject requests, security, breach notifications, data protection impact assessments and prior consultations with supervisory authorities.
6. Data subject requests
The service lets the Customer view, export and delete the data of its users. If PulseDesk receives a request directly from a data subject relating to Customer Personal Data, it will forward it to the Customer without undue delay and will not respond itself except to confirm that the request has been passed on, unless the Customer authorises otherwise.
7. Sub-processors
- The Customer gives PulseDesk general authorisation to engage Sub-processors. The current list is published on our Sub-processors page.
- PulseDesk will impose data protection obligations on each Sub-processor that are no less protective than this DPA, and remains responsible for their performance.
- PulseDesk will give at least 30 days' notice of a new Sub-processor by updating the list and notifying organisation owners. The Customer may object on reasonable data protection grounds within 15 days of the notice. The parties will discuss the objection in good faith; if it cannot be resolved, the Customer may terminate the affected part of the service without penalty and receive a refund of prepaid fees for the remaining period.
8. International transfers
Customer Personal Data is hosted in the United Kingdom. PulseDesk and its Sub-processors may process it in other countries listed on the Sub-processors page. For any transfer that requires safeguards under Data Protection Laws, PulseDesk will put in place an appropriate transfer mechanism, such as the EU Standard Contractual Clauses (module two or three as applicable), the UK International Data Transfer Addendum, and for transfers subject to KVKK the standard contracts and notification required by article 9 of KVKK, together with supplementary measures where needed.
9. Personal Data Breaches
PulseDesk will notify the Customer without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information may be provided in phases. PulseDesk will take reasonable steps to contain and remedy the breach. The Customer is responsible for notifying supervisory authorities and data subjects where required (for example within 72 hours under the GDPR and KVKK). A notification is not an acknowledgement of fault.
10. Audits
PulseDesk will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including answers to security questionnaires. If this is not sufficient, or if a supervisory authority requires it, the Customer may audit PulseDesk's compliance once in any 12-month period, with at least 30 days' written notice, during normal business hours, at the Customer's cost and under appropriate confidentiality, either itself or through an independent auditor who is not a competitor of PulseDesk. Audits must not compromise the security of other customers' data.
11. Return and deletion
During the subscription the Customer can export and delete Customer Personal Data using the service. After termination, the Customer has 30 days to export its data. PulseDesk will then delete Customer Personal Data from its live systems within a further 30 days and from backups within 90 days, unless the law requires it to be kept, in which case PulseDesk will keep it confidential and process it only for that purpose.
12. Liability and term
The limitations of liability in the Terms apply to this DPA, except where Data Protection Laws do not allow it. This DPA lasts as long as PulseDesk processes Customer Personal Data. If this DPA conflicts with the Terms, this DPA prevails for matters of data protection. It is governed by the same law and jurisdiction as the Terms, except where Data Protection Laws or the transfer clauses require otherwise.
Annex 1 - Details of the processing
Purpose: providing the PulseDesk service to the Customer: automatic time and activity tracking, productivity and attendance analytics, screenshots (if enabled), offline time, projects, work schedules and rota, leave and absence management, public holidays, chat, calls and meetings (including recordings, transcripts and AI summaries if used), documents and drive, announcements, reports, notifications, the Lucy AI assistant, support and security.
Nature of processing: collection through the desktop application and dashboard, storage, organisation, analysis, display to authorised users, transmission, export and deletion.
Duration: for the term of the subscription and until deletion under section 11.
Data subjects: the Customer's employees, contractors, managers and administrators who use PulseDesk; meeting guests invited by users; people mentioned in content the Customer uploads.
Categories of personal data:
- Identity and contact data: name, work email, phone, job title, department, manager, profile photo, language and time zone;
- Account data: password hash, roles and permissions, sign-in and device information, desktop application version;
- Work activity data: working times, arrival and leaving, active applications and window titles, website addresses, idle, away and private time, offline time entries, productivity classifications;
- Screenshots of the screen, if the Customer enables them;
- Approximate location (IP-based or device location), if the Customer enables it;
- Scheduling data: work schedules, rota, leave requests and balances, public holidays and absence reasons;
- Personnel data the Customer chooses to record, such as start date, date of birth, work country, hourly rate and documents;
- Communication data: chat messages and files, call and meeting history, recordings, transcripts and summaries, announcements;
- Assistant data: questions asked to Lucy and the answers produced;
- Technical data: IP addresses, logs and tamper events of the desktop application.
Special categories: PulseDesk is not designed to process special categories of personal data. However, absence reasons, personnel documents or messages entered by the Customer may contain such data (for example health information related to sick leave). The Customer decides whether to record such data and is responsible for having a legal basis.
Annex 2 - Technical and organisational measures
- Encryption in transit: all connections to the dashboard, API and desktop application use HTTPS/TLS.
- Access control: role-based permissions enforced on the server for every request; strict separation of each customer's data; sensitive views (screenshots, personnel files, location) restricted to authorised roles.
- Authentication: passwords stored with a strong one-way hashing algorithm; signed, expiring session tokens; one-time handoff codes for the desktop application.
- Protected files: screenshots and other sensitive files are not publicly accessible and are served through short-lived signed links; screenshots are deleted according to the Customer's retention setting.
- Infrastructure: hosting in a professional data centre in London, United Kingdom; database access restricted to authenticated service accounts; administrative access limited to authorised personnel.
- Backups: regular database backups stored separately to allow restoration.
- Personnel: confidentiality obligations; access on a need-to-know basis; least privilege for administrative access.
- Desktop application integrity: automatic updates; detection and logging of attempts to close or uninstall the application, reported to the Customer's administrators.
- AI features: only data the requesting user may access is sent to the AI provider; the provider does not use it for training; usage is logged without storing conversation content on our servers.
- Incident management: procedures to detect, investigate, contain and notify Personal Data Breaches.
Annex 3 - Sub-processors
The authorised Sub-processors are listed on our Sub-processors page.