Data processing agreement
Last updated 19 October 2026
This agreement applies where a business ("the controller") uses Help by DeltaBreen to handle messages from its own customers, and so has DeltaBreen Limited (the operator of Help by DeltaBreen), a company registered in Ireland with company number 826627, of Gorey, Co. Wexford, Ireland ("the processor") process personal data on its behalf, as Article 28 of the GDPR requires. It forms part of the terms of service, and where the two differ on personal data, this agreement wins. For the controller's own account, sign-in and billing, the processor is a controller itself, as the privacy policy says.
1. What is processed
Subject and purpose: providing the helpdesk the controller uses, as the terms describe. Nature: storing, organising, searching and showing the data to the controller's agents, sending email for the controller, passing data where the controller directs, and deleting it. Data subjects: the controller's customers and others who write to it or whom it copies in, and the controller's agents and other members of its workspace. Personal data: messages the controller's customers send and the controller's replies and notes, and the files sent with them; the identifier the controller gives for each customer, the short facts its site signs about a logged-in customer, and the company a customer works for; an email address where the customer or the controller supplies one; the page a request was sent from, the browser's description of itself and the form's language; ratings and the words with them; the names and signatures agents give, which their customers are shown; time agents log on tickets; the push addresses of the browsers agents switch notifications on in; and the mobile numbers agents add to be texted and called about urgent tickets. What a visitor types before sending is processed only to suggest and find articles, and is neither stored nor logged. The service is not designed for special categories of data. Duration: as long as the controller has a workspace; closed tickets are deleted after the retention period of the controller's plan.
2. Instructions
The processor processes this data only on the controller's documented instructions, which are the terms of service, this agreement and the controller's settings and use of the service, including as to transfers outside the EU, unless the law of the EU or of a member state requires otherwise; it then tells the controller first, unless that law forbids it. The processor tells the controller straight away if, in its view, an instruction breaks data protection law.
3. The controller's part
The controller is responsible for having a lawful basis for the processing, for telling its customers about it, for its instructions being lawful, and for what it chooses to send or connect elsewhere.
4. Data fetched through integrations
Data an integration returns from the controller's own systems, and what a ready-made side panel reads from the controller's own Stripe or Shopify account, is passed to the controller's agent and is not stored or logged by the processor.
5. Confidentiality and security
Everyone the processor lets handle the data is bound by confidentiality. The processor keeps appropriate technical and organisational measures under Article 32 of the GDPR, and improves them over time without lowering the protection they give: data is held on servers in the EU and encrypted in transit; customers' email addresses, secrets and credentials are encrypted at rest; access is limited to those who need it, by role; access by the processor's own staff to ticket content is limited and recorded; the database is backed up nightly; and software is kept up to date and checked for known vulnerabilities. The security page describes the measures in more detail and promises nothing beyond this section.
6. Sub-processors
The controller gives general authorisation to the sub-processors listed in the privacy policy. The processor tells the workspace's owner by email at least 30 days before adding or replacing one. The controller may object on reasonable data protection grounds; if the two cannot resolve it, the controller may end the terms and is refunded the unused part of what it paid in advance. The processor binds each sub-processor by contract to data protection duties at least as protective as these, and remains responsible to the controller for them.
7. Transfers outside the EU
The processor keeps the data in the EU and transfers it outside the EU only to the sub-processors listed, with the safeguard the list names: an adequacy decision, the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
8. Transfers the controller directs
Where the controller sends its data to a webhook, reads it with an API key, connects its own AI assistant, imports tickets from another helpdesk, keeps the files sent with messages in its own Google Drive, Dropbox or storage bucket, sends its customers' emails through its own mail server, texts and calls its agents through its own Twilio or Vonage account, posts alerts to its own chat app, or makes issues in its own tracker, the processor acts on that instruction. The recipient is the controller's choice and not a sub-processor of the processor. A key the controller gives for an import is kept encrypted and only while the import runs.
9. Helping the controller
The processor provides the means to export and delete a customer's tickets, and helps the controller, as far as the nature of the processing and the information it has allow, to answer data subject requests and to meet its duties on security, breach notification, impact assessments and prior consultation with a supervisory authority (Articles 32 to 36 of the GDPR).
10. Breaches
The processor tells the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, with what is known of its nature, the data and people concerned, its likely consequences and the measures taken or proposed, and adds to it as more is known.
11. End of processing
The controller can export its tickets while it has its account. When the account is deleted, its workspaces' data is deleted thirty days later, and leaves the backups within a further thirty days, unless the law of the EU or of a member state requires it to be kept.
12. Audits
The processor makes available the information needed to show it meets this agreement, and allows and contributes to audits, including inspections, by the controller or an auditor it chooses who is bound by confidentiality. An audit is arranged on 30 days' notice, at the controller's cost, at most once a year unless a breach or a supervisory authority calls for another, and may first be answered with documents and answers to questions.
13. Liability and duration
Liability under this agreement follows the terms of service, except where the GDPR does not allow it to be limited. This agreement lasts for as long as the processor processes personal data for the controller.