Last updated 10 October 2026
Data processing agreement
This agreement is part of our terms of service, between the customer (the controller) and Delegmate (the processor), for personal data we process for the customer in providing Delegmate. It is meant to meet Article 28 of the GDPR, the UK GDPR, and Georgia’s Law on Personal Data Protection.
1. What is processed
- Subject matter and duration: running the customer’s teammates, for as long as it uses Delegmate, and deleting the data after, as below.
- Nature and purpose: receiving, storing, reading, writing and sending on the customer’s behalf, through its teammates, so they do the work it gives them.
- People concerned: the customer’s staff, and the people they and the teammates correspond or meet with: customers, suppliers, partners, candidates.
- Kinds of data: names, contact details, roles, and what is in the emails, messages, calendars, files and calls a teammate takes part in. The customer will not give teammates special categories of data unless it needs to and has a lawful basis.
2. Our commitments
- We process the data only on the customer’s documented instructions: these terms, the teammates’ setup, and what its people ask of them. If we think an instruction breaks data protection law, we say so.
- Everyone who can reach the data is bound to confidentiality, and nobody at Delegmate reads it without the customer’s permission, except to keep the service secure or where the law requires.
- We keep the measures on our security page and improve them over time.
- We help the customer answer people exercising their rights (it can also download or delete everything itself, in Settings), and with security, breach notification and impact assessments where it needs us.
- We tell the customer without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting its data, with what we know.
- We make available what is needed to show we meet this agreement, and allow reasonable audits, at most once a year and with notice, by questionnaire first.
3. Subprocessors
The customer authorises the subprocessors listed in our privacy policy. We hold each to data protection terms at least as protective as these, remain responsible for them, and announce new ones there at least 30 days before they start, so the customer can object (and, if we cannot meet the objection, leave with a refund of what it prepaid).
4. Transfers
Where data leaves the EU, the UK or Georgia for a country without an adequacy decision, the European Commission’s standard contractual clauses (module two or three, as fits) or an equivalent safeguard apply, and are incorporated here by reference.
5. The end
When the customer deletes its data in Settings, it is deleted within minutes; when a teammate is removed, its data 30 days later; backups follow within 14 days. Before that, the customer can download all of it. We keep nothing after, except what the law obliges us to.
6. Contact
Questions: [email protected] · Terms · Privacy · Refunds · Data processing · Security