Data Processing Agreement

Last updated: July 10, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between RyuuGroup, operator of ChannelDesk (“processor”, “we”), and the tenant using ChannelDesk (“controller”, “you”). It governs RyuuGroup’s processing of personal data that you submit to, or connect into, ChannelDesk on behalf of your own customers and end users.

1. Roles of the parties

For personal data that you connect into ChannelDesk from your sales channels, marketplaces, and help desk systems (for example, your customers’ names, contact details, order records, and support ticket contents), you act as the data controller and RyuuGroup acts as the data processor, processing that data only on your documented instructions as set out in this DPA and the Terms of Service. This DPA does not apply to account data where RyuuGroup itself is the controller, which is described in our Privacy Policy.

2. Scope and instructions

RyuuGroup will process personal data on your behalf solely to provide the ChannelDesk service, including displaying connected channel and help desk data, generating AI-assisted draft suggestions, and supporting features you configure. Your use of ChannelDesk’s configuration options (for example, which channels you connect and which AI drafting features you enable) constitutes your instructions for this purpose. Any additional processing instruction outside this scope should be agreed with us in writing.

3. Sub-processors

You authorize RyuuGroup to engage the sub-processors listed on our Sub-processors page to assist in providing the service. We remain responsible for each sub-processor’s performance of its data protection obligations. We will update that page when we add or remove a sub-processor, with advance notice by email where reasonably practicable.

4. Data retention and deletion

Personal data connected into ChannelDesk from your sales channels and help desk integrations (customer names, contact details, order data, ticket contents) is retained for up to 180 days on a rolling basis, after which older records are automatically purged from active systems. When you terminate your account, whether voluntarily or for cause, deletion cascades across ChannelDesk: connected channel data, cached orders and tickets, AI draft history, and associated tenant user records are permanently removed, subject only to any residual copies retained in encrypted backups for a limited period before they, too, are purged.

5. Security measures

RyuuGroup maintains technical and organizational measures appropriate to the risk, including:

• Per-tenant data encryption at rest using AES-256-GCM, so that one tenant’s connected data cannot be read using another tenant’s key.
• Encrypted connections (TLS) for all data in transit between your browser, ChannelDesk, and connected third-party services.
• Role-based access control within workspaces, and internal access controls limiting employee access to tenant data to what is necessary to operate and support the service.
• Rate limiting and monitoring on authentication endpoints to reduce the risk of unauthorized access.

6. International transfers

Where personal data originating in the UK, EEA, or other regions with data transfer restrictions is transferred to sub-processors located outside those regions, including United States-based providers such as Anthropic, Stripe, and Resend, RyuuGroup relies on appropriate transfer mechanisms, including Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework (DPF), to safeguard that data.

7. Breach notification

If RyuuGroup becomes aware of a personal data breach affecting your data processed under this DPA, we will notify you without undue delay after becoming aware of it, and will cooperate with you in good faith, including by providing information reasonably available to us, to help you meet your own breach notification obligations to regulators or affected individuals.

8. Assistance with data subject requests

Where a data subject exercises a right (such as access, correction, deletion, or export) directly with RyuuGroup regarding data we process on your behalf, we will refer the request to you and provide reasonable assistance to help you respond, taking into account the nature of the processing and the information available to us.

9. Audit and compliance

On reasonable written request, and no more than once per year absent a specific security concern, RyuuGroup will provide information reasonably necessary to demonstrate compliance with this DPA, which may include a summary of security measures or responses to a reasonable security questionnaire.

10. Contact us

RyuuGroup, operator of ChannelDesk. For any question about this DPA, or to request a signed copy for your records, email privacy@channeldesk.app.