Data Processing Agreement

For the data your visitors send through the widget, you (the customer) are the personal information controller and Mewdesk is the personal information processor, in the sense of the Data Privacy Act of 2012, and controller and processor in the sense of the GDPR where it applies to you. For the data of your own admins and agents we act as a controller, as described in the Privacy Policy.

• We process visitor data only on your documented instructions, which are: these terms, your settings in the dashboard, and the ordinary operation of the product. We will tell you if we believe an instruction breaks the law.
• Everyone with access to customer data at Mewdesk is bound by confidentiality.
• We keep the technical and organisational measures in section 5 and will not lower them during the agreement.
• We help you answer data-subject requests: an admin can delete any conversation from the dashboard, and we assist with anything the dashboard cannot do.
• We help you with security assessments and privacy impact assessments by answering reasonable questions about how the service works.

You authorise us to use these sub-processors. We remain responsible for their work.

We will email workspace admins at least 14 days before adding or replacing a sub-processor that handles visitor data. If you object on reasonable data-protection grounds and we cannot resolve it, you may close the affected workspace and we will refund the unused part of your current billing period.

• Encryption in transit for every connection, including the widget.
• Passwords stored only as bcrypt hashes; sessions in signed, HTTP-only cookies.
• Every query scoped to one workspace; a row from another workspace is treated as not existing.
• Payment notifications verified by signature before they change anything; card and PayPal details never touch our servers.
• Rate limiting on sign-in, signup and widget traffic.
• An activity log of staff sign-ins and account changes, kept 180 days, to investigate incidents.
• Hosting and database providers with their own certified security programmes (see the sub-processor list).

If we become aware of a breach affecting your visitor data we will notify your workspace admins by email without undue delay and in any case within 72 hours, with what we know about the nature of the breach, the data and people affected, the likely consequences and the measures taken. We will keep you updated as we learn more and will help you with any notification you must make to the National Privacy Commission or another authority.

Visitor data is stored and processed in the locations listed for our sub-processors. Where a transfer out of the Philippines or out of the European Economic Area takes place, it relies on the sub-processor’s contractual safeguards, including standard contractual clauses where those apply.

You can delete any conversation, website or your whole workspace at any time from the dashboard or by asking us. On termination we delete all visitor data within 30 days, and from backups within 60 days, unless the law requires us to keep something. Before that, you may ask for an export of your conversations.

Once a year, or after a breach, you may ask us for the information needed to show we comply with this agreement, and we will answer in writing. An on-site audit may be arranged at your cost, on reasonable notice, by an auditor bound by confidentiality, no more than once a year.

Liability under this agreement is subject to the limits in the Terms of Service. If this agreement and the Terms conflict on a point about personal data, this agreement wins.