Data Processing Agreement

Last updated: 14 July 2026

This Data Processing Agreement ("DPA") forms part of, and is governed by, the Terms of Servicebetween you ("Customer") and Ascendz Digital Limited, operated by Toni Martin ("Kestry", "we", "us"). It applies where we process personal data on your behalf in the course of providing the Kestry platform.

Where this DPA conflicts with the Terms of Service, this DPA prevails in respect of the processing of personal data.

1. Roles of the parties

For the personal data contained in your help desk - the content of conversations, the contact details of the people who write to you, and the records of your agents' activity - you are the controller and we are the processor. You decide why and how that data is processed; we process it only to provide the Service to you.

We are an independent controller for the limited data we need to run our own business: your account and billing records, and our security and service logs. That processing is described in our Privacy Policy.

2. Our obligations as processor

We will:

• process personal data only on your documented instructions, which include your use of the Service and its settings, unless we are required to do otherwise by law (in which case we will tell you first, unless the law forbids it);
• ensure that anyone authorised to process the data is bound by an appropriate duty of confidentiality;
• implement appropriate technical and organisational security measures (section 5);
• assist you, so far as is reasonable, with data subject requests, data protection impact assessments, and consultations with a supervisory authority;
• notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties;
• make available the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits (section 7);
• delete or return your personal data at the end of the Service, as set out in section 8.

We will not sell your data, and we will not use the contents of your conversations to train machine-learning models.

3. Your obligations as controller

You are responsible for ensuring you have a lawful basis for the personal data you put into the Service and for the instructions you give us, for providing any notices your own customers are due, and for the accuracy of the data. You must not use the Service to process special category data (for example health, biometric or political data) or criminal offence data unless you have told us first and we have agreed in writing.

4. Sub-processors

You give us general authorisation to appoint the sub-processors listed below. Each is bound by written terms imposing data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will give you at least 30 days' notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, you may terminate the affected part of the Service without penalty, with a pro-rata refund of any prepaid fees.

5. Security

We maintain technical and organisational measures appropriate to the risk, including:

• Tenant isolation in two independent layers.Every record carries an organisation identifier which the application scopes on every query, and PostgreSQL Row Level Security independently refuses to return another tenant's rows even if a query were ever to omit that scope.
• Encryption in transit (TLS) and at rest for the database and file storage.
• Credential protection. Passwords are hashed with bcrypt; any API key you store with us is encrypted (AES-256-GCM).
• Access control. Role-based access within your organisation, with optional per-brand and per-inbox restrictions. Administrative access on our side is limited to those who need it.
• Sanitisation of untrusted input. Inbound email HTML is sanitised before it is stored or rendered.
• Signed, authenticated webhooks for inbound mail, delivery events and payments, which reject unverified requests.
• Backups of the database, held by our hosting provider.

6. International transfers

Some sub-processors are located outside the UK and EEA. Where personal data is transferred out of the UK or EEA, that transfer is made under an approved transfer mechanism - the UK International Data Transfer Addendum or the EU Standard Contractual Clauses - together with any supplementary measures required to give the data an essentially equivalent level of protection.

7. Audit

On reasonable written request, and no more than once a year (unless required by a supervisory authority or following a personal data breach), we will provide the information reasonably necessary to demonstrate compliance with this DPA. Where an on-site audit is genuinely necessary, it will be at your cost, during business hours, subject to reasonable confidentiality obligations, and arranged so as not to disrupt the Service or other customers.

8. Retention, deletion and return

You may export your data at any time while your account is open. On termination, you may request the return of your data within 30 days. After that period we will delete it from our live systems, and it will fall out of our provider backups in line with their retention cycle, unless we are required by law to keep it.

Deleting a conversation, contact or organisation within the Service deletes the associated records, subject to the backup cycle above.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA limits any liability that cannot be limited under applicable data protection law.

10. Annex - details of processing

• Subject matter: provision of a help desk, shared inbox, knowledge base and project management platform.
• Duration: for as long as your account is open, plus the deletion window in section 8.
• Nature and purpose: receiving, storing, organising, displaying, searching, analysing and transmitting customer support communications and related records, so that you can respond to and manage them.
• Categories of data subject: your customers and other people who contact you; your own agents and administrators.
• Categories of personal data: names, email addresses, company and job information, message content and attachments, notes, any custom fields you define, IP addresses and technical metadata, and activity/audit records. Message content is free text, so it may contain whatever the sender chooses to include.
• Special category data: none is requested or required, and it must not be processed through the Service except as agreed under section 3.

11. Contact

Questions about this DPA, or requests to exercise the rights in it, should go to privacy@kestry.co.