Data processing agreement

Version beta-2026-10-24 · effective from the date of publication

This agreement, under Article 28 of Regulation (EU) 2016/679 (GDPR), forms part of the terms of sale and applies to customers who buy the Walkie Desk subscription as a company or professional (“Customer”). It is accepted on the Customer’s behalf by the person making the purchase. The processor is iDev S.r.l., Via Luigi Goia 102, 27036 Mortara (PV), Italy, VAT no. 02656830185 (“iDev”).

1. Roles

For the personal data it processes to provide Walkie Desk to the Customer’s PCs and people, described in section 2, iDev acts as processor and the Customer as controller. For the data needed to manage the account, the subscription, invoicing, the security of the service and abuse prevention, iDev is an independent controller, as described in the privacy notice.

2. Subject matter and processing

• Subject matter and duration: provision of the Walkie Desk remote desktop service, for the term of the contract and for the time needed to delete the data under section 9.
• Nature and purpose: registration of the Customer’s PCs, coordination and relaying of connections, session log, assistance with QuickSupport, technical support requested by the Customer.
• Categories of data subjects: users of the Customer’s account (employees and collaborators), people using PCs managed by the Customer, people assisted by the Customer with QuickSupport.
• Categories of data: names and emails of technicians shown on controlled PCs; name, identifier and technical data of the PCs; date, time, duration and technical data of sessions; IP addresses in the relay server logs; content of abuse reports concerning the Customer. Session content (screen, keyboard, mouse, clipboard) is end-to-end encrypted between devices: iDev does not access or store it. The Customer must not entrust special categories of data to iDev through the service’s fields (for example PC names).

3. Customer’s instructions

iDev processes the data only on the Customer’s documented instructions, which are this agreement, the terms of sale and of use and the settings the Customer chooses in the service, unless EU or Italian law requires otherwise; in that case iDev informs the Customer before processing, where the law allows. If it considers that an instruction infringes data protection law, iDev informs the Customer immediately.

4. Confidentiality

iDev authorises only the persons who need the data to provide the service to process it, and they are instructed and bound by confidentiality.

5. Security

iDev takes appropriate technical and organisational measures under Article 32 GDPR, including: end-to-end encryption of session content and encryption of connections with the servers; mandatory second authentication factor for accounts; passwords stored only as a cryptographic hash; signed programs; servers and backups in the European Union; access to systems limited to authorised staff. The measures are described on the Security page and may be updated without reducing the level of protection.

6. Sub-processors

The Customer authorises iDev to engage the following sub-processors: Aruba S.p.A. (Italy), service servers, relay server, service email and backups in Italy; Scaleway SAS (France), second backup copy in the European Union. iDev imposes on them data protection obligations equivalent to those of this agreement and is liable for their performance. iDev notifies the Customer by email of any addition or replacement of a sub-processor at least 30 days in advance; within that period the Customer may object on data protection grounds and, if no solution is found, cancel the subscription with a refund of the part already paid and not used.

7. Transfers

iDev and the sub-processors process the data under this agreement in the European Union. Any transfer outside the Union will take place only with the safeguards of Chapter V GDPR and with the notice provided in section 6.

8. Assistance to the Customer and personal data breaches

• iDev assists the Customer, with appropriate measures and insofar as possible, in responding to data subject requests (Articles 15–22 GDPR) and with the obligations of Articles 32–36 (security, breach notification, impact assessments and prior consultation), taking into account the information available to it. Some operations, such as removing a PC from the account, the Customer performs directly from the user area.
• iDev informs the Customer without undue delay, and where possible within 48 hours of becoming aware of it, of a personal data breach affecting the data under this agreement, with the information available for notification to the supervisory authority.

9. End of processing

At the end of the contract the Customer can ask, by writing to info@walkiedesk.app, for a copy of the data under this agreement in a commonly used format; iDev then deletes the data under this agreement within the periods of the privacy notice (as a rule within 90 days of the account being closed and, for backups, within the following 30 days), unless the law requires it to be kept.

10. Information and audits

iDev makes available to the Customer the information needed to demonstrate compliance with this agreement and allows audits, including inspections, by the Customer or an auditor it appoints who is bound by confidentiality, with at least 30 days’ notice, during business hours, no more than once a year except in case of a data breach or a request from an authority, at the Customer’s expense. Audits must not compromise the security of the service or other customers’ data.

11. Final provisions

This agreement lasts as long as the subscription contract and, for the obligations of section 9, until the data is deleted. Liability is governed by the terms of sale, except where Article 82 GDPR cannot be derogated from. In case of conflict with the terms of sale or of use, this agreement prevails as regards data protection. Governing law and jurisdiction are those of the terms of sale.