Data processing summary
Last updated
For workspace owners. You decide what goes into your workspace and who sees it, so you are the controller of that data. Axiom Trail processes it on your behalf, only to run Ayedesk for you. This page summarises how.
Roles
- Controller: the workspace owner, meaning you, or the organization that owns the workspace.
- Processor: AXIOM TRAIL - FZCO, Dubai, United Arab Emirates, which operates Ayedesk.
For the data we need to run your account itself (your sign-in, and the waitlist), Axiom Trail is the controller, as described in the privacy policy.
A signed data processing agreement, including the EU Standard Contractual Clauses, is available on request at [email protected].
What we process and why
| Purpose | Hosting, storing, showing and sending your workspace content to the people and agents you allow, so Ayedesk works for you. Nothing else. |
|---|---|
| Instructions | These terms, your workspace settings and what you and your members do in the app. |
| People concerned | Workspace members and guests, and anyone named in workspace content. |
| Data | Names and email addresses of members and guests, and their roles; workspace content (cards and checks, notes and decisions, docs, work items, milestones, comments, attachments); the activity record; agent usage metadata (token names, scopes, when they were last used and what they did). |
| Special categories | Not intended. Please don't put health, biometric or similar sensitive data into a workspace. |
| Duration | While the workspace exists. When it is closed, we first mark it as deleted, so a mistake can be undone, and erase its content within 30 days, backups included (backups roll over after 14 days). |
What we commit to
- Process workspace content only on your instructions, and never sell it or use it for advertising.
- Limit access to the people at Axiom Trail who need it to run the service, under confidentiality.
- Keep the technical and organizational measures described on the security page.
- Help you answer requests from the people whose data is in your workspace, such as access or deletion.
- Tell workspace owners without undue delay, and within 72 hours of becoming aware of it, if a personal data breach affects your workspace.
- Delete your workspace content when the workspace is closed, unless the law requires us to keep it.
- Give you, on reasonable request, the information you need to show that this processing complies with the law.
Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| Amazon Web Services | Hosts the app, its database and attachments | eu-west-3, Paris (EU) |
| Cloudflare, Inc. | Carries all traffic to the app (CDN, proxy and tunnel) before it reaches AWS | Cloudflare's global network |
The app sends no email today: invitations and password resets use one-time links that the workspace owner shares. If it starts sending email, we will add the provider to this list first. (The waitlist confirmation that ayedesk.com sends is not workspace content; the privacy policy covers it.)
We will tell workspace owners at least 30 days before we add or replace a sub-processor. An owner who objects can write to [email protected], and can close the workspace if we cannot resolve the objection.
Where the data lives
Workspace content is stored with Amazon Web Services in the eu-west-3 region (Paris, France). Axiom Trail is established in the United Arab Emirates, so our access to support and run the service is a transfer outside the EU. These transfers are safeguarded by the EU Standard Contractual Clauses.
What we ask of you
- Have a lawful basis for the personal data you and your agents put into the workspace, and tell your members and guests how it is used.
- Share projects only with the people who need them, keep admin roles and workspace-wide access to those who need to see every project, and review guests and their access.
- Scope agent tokens to the projects they need, and revoke the ones you no longer use.
Contact
Data protection questions from workspace owners: [email protected].