Data Processing Agreement (DPA)

  1. Home /
  2. Data Processing Agreement (DPA)

1. Introduction

This Data Processing Agreement (“DPA”) is entered into between Acudesk (“Processor”) and the customer entity agreeing to the Acudesk Terms of Service (“Customer” or “Controller”). This DPA forms part of the Terms of Service and governs Acudesk’s processing of personal and business data on behalf of the Customer.

2. Scope and Purpose

Acudesk provides AI-based grounding services that require structured data to be processed from customer-provided sources, including file uploads, APIs, and direct database connections. This DPA sets out the parties’ obligations with respect to data privacy and security, in compliance with applicable laws.

3. Data Categories and Processing Activities

  • Data Subjects: Individuals whose data may appear in Customer-provided datasets.
  • Data Types: Textual business knowledge and optionally personal information contained in fields such as phrase, category, meaning or custom-configured equivalents.
  • Purpose of Processing: To perform AI grounding and knowledge retrieval as part of the Acudesk platform.
  • Duration: For as long as the Customer uses the Services or until deletion is requested.

4. Data Access and Processing Policy

The full Acudesk Data Access and Processing Policy is incorporated into this DPA as Annex 1. This includes:

  • File-based datasets are stored securely on Acudesk servers.
  • API and direct database integrations do not result in data storage by default.
  • Users may enable storage of grounding data explicitly.
  • Customers must provide read-only, non-production, and cached database access where applicable.
  • All access occurs over encrypted channels (SSL/TLS).
  • Access credentials must be scoped to minimum necessary permissions.

(See full details in Annex 1: Acudesk Data Access and Processing Policy.)

5. Legal Basis and Customer Consent

  • The Customer affirms it has the right to share the data with Acudesk and has obtained necessary consent or other lawful basis.
  • By enabling integrations within the Acudesk platform, the Customer accepts this DPA via clickwrap agreement.

6. Compliance with Applicable Law

Acudesk complies with the following laws and frameworks:

POPIA (South Africa):
  • Acudesk is an “operator” under POPIA.
  • Data is processed only as instructed, with secure handling and encryption.
GDPR (EU/EEA):
  • Acudesk is a “processor” under GDPR Article 4(8).
  • Processing is based on lawful basis (contract or consent).
  • Acudesk supports access, rectification, and erasure rights.
  • Cross-border transfers are handled using Standard Contractual Clauses and supplementary measures.
HIPAA (United States):
  • Acudesk is not a Business Associate by default.
  • If PHI will be processed, a separate signed Business Associate Agreement (BAA) is required.

7. Subprocessors

Acudesk may use subprocessors (e.g., cloud hosting providers) with appropriate data processing agreements and security audits in place. A list of subprocessors is available upon request.

8. Security Measures

Acudesk maintains appropriate technical and organizational measures, including:

  • Encryption of data in transit and at rest.
  • Access controls and credential management.
  • Monitoring, logging, and breach response processes.

9. Data Subject Rights

Acudesk will assist the Customer in responding to data subject requests (access, deletion, rectification, etc.) within the scope of the Services.

10. Breach Notification

In the event of a data breach affecting Customer data, Acudesk will notify the Customer without undue delay and provide all relevant information to support compliance efforts.

11. Return or Deletion of Data

Upon termination of the Services, Acudesk will delete or return Customer data within 30 days, unless otherwise legally required to retain it.

12. Governing Law

This DPA is governed by the same laws as the Acudesk Terms of Service unless otherwise required by applicable data protection laws.

Annex 1: Acudesk Data Access and Processing Policy

1. Overview

This document outlines Acudesk’s data access, processing, and storage practices, in accordance with applicable data protection laws and best security standards. It governs the conditions under which Acudesk accesses customer datasets for the purpose of AI grounding, and specifies the roles and responsibilities of both Acudesk and the customer in this process.

2. Storage and Access Principles
  • File-Based Datasets: When users upload files directly to Acudesk (e.g., CSV, Excel, JSON), these datasets are stored securely on Acudesk’s servers. Access to these files is governed by Acudesk’s internal access controls and encryption policies.
  • API and Remote Database Integrations: Datasets configured via remote API or direct database access are not stored on Acudesk’s servers by default. Instead, data is queried at scheduled intervals and used only in-memory for grounding tasks, unless the user explicitly enables caching or storage.
  • User-Controlled Grounding Storage: Users have the option to enable storage of grounding data on Acudesk’s servers. This must be explicitly opted in via the platform interface. If enabled, the grounding dataset will be persisted securely and versioned to support rollback and auditing.
3. Security Requirements for Remote Database Integrations

Customers who choose to integrate their databases with Acudesk agree to the following conditions:

  • Read-Only Credentials: All access credentials provided to Acudesk must be scoped to read-only privileges. Acudesk will never write, modify, or delete customer data.
  • Dedicated Database or Cached Views: Customers must provide access to a replicated, non-production database, or a view/table that is separate from their production environment. This view should contain only the necessary fields required for grounding (typically phrase, category, and meaning).
  • Least Privilege Access: Database credentials must be limited in access scope, IP-restricted, and rotated on a periodic basis as per customer policy.
  • Secure Transmission: All data access must occur over encrypted channels (e.g., SSL/TLS). Acudesk supports encrypted connection strings and does not support plain-text DB access.
4. Compliance with Data Protection Laws

Acudesk complies with the data privacy and protection obligations imposed by the following regulations:

  • POPIA (South Africa):
    • Acudesk acts as an “operator” under POPIA when processing customer data.
    • We process data only for the purpose for which it was provided (grounding), under clear and informed consent.
    • All data subjects’ information is protected via encryption at rest and in transit.
  • GDPR (European Union):
    • Acudesk acts as a “processor” under Article 4(8) of the GDPR.
    • A lawful basis (typically contractual necessity or consent) is required and documented at the point of integration.
    • Customers retain full control over the data shared and may exercise rights of access, rectification, and deletion.
    • Cross-border transfers (e.g., to the U.S. or other locations) are protected through standard contractual clauses and transfer impact assessments, where applicable.
  • HIPAA (United States):
    • Acudesk does not process or store Protected Health Information (PHI) unless under a signed Business Associate Agreement (BAA).
    • Customers intending to share health-related datasets must execute a BAA before integration.
5. Customer Responsibilities

By integrating with Acudesk, the customer agrees to:

  • Ensure that only necessary data is made accessible to Acudesk for grounding purposes.
  • Validate that all shared data complies with the customer’s internal data governance and legal obligations.
  • Obtain any necessary consents or lawful basis for Acudesk to process the data, particularly when personal information is involved.
  • Notify Acudesk promptly in case of any suspected breach, credential leak, or access misconfiguration.
6. Consent and Agreement

Customers accept this Data Access and Processing Policy by enabling remote database access or file-based data ingestion within the Acudesk platform. Consent is documented via explicit checkbox confirmation and stored for audit purposes. The policy is incorporated by reference into Acudesk’s Terms of Service and Data Processing Agreement (DPA), available at https://acudesk.com/legal/dpa.

For any questions or custom compliance requirements, please contact compliance@acudesk.com.