Data Processing Agreement
1. Scope
This Data Processing Agreement ("DPA") supplements the UnifyDesk Terms of Service and applies when Mirage Informatique Inc. ("UnifyDesk", "we") processes personal data on behalf of the Customer ("Data Controller") as a Data Processor under applicable data protection laws.
2. Definitions
Personal Data: Any information relating to an identified or identifiable natural person, as defined by GDPR Art. 4(1).
Processing: Any operation performed on Personal Data, including collection, storage, modification, retrieval, and deletion.
3. Processing Purpose
UnifyDesk processes Personal Data only on the Customer's documented instructions to provide the Service, including managing contacts, conversations, documents and invoices. Personnel authorized to process Personal Data are bound by confidentiality obligations.
4. Data Categories
- Contact information (names, emails, phone numbers)
- Communication content (emails, conversation messages)
- Business records (invoices, contracts, project data)
- Account metadata (user profiles, activity logs)
5. Sub-Processors
The services below receive data according to their configuration. Mail, calendar, accounting and translation connections require organization setup. Monitoring depends on deployment settings; optional product analytics require user consent.
- Cloud infrastructure - UnifyDesk's server is hosted by OVHcloud in Canada. UnifyDesk operates the application, database, file storage, and system email on that server.
- Monitoring (optional) - error reports when monitoring is configured
- Payments (optional) - Stripe for subscription billing or connected customer invoice payments; receives billing details and payment activity
- Email & calendar providers (optional) - Microsoft 365 or Google Workspace, when a mailbox or calendar is connected; message content and calendar data flow between UnifyDesk and the provider
- Accounting (optional) - QuickBooks or Xero, when your organization connects an accounting integration; receives invoice, customer, and payment records
- Messaging & translation (optional) - Microsoft Teams channel messages and Phrase (Memsource) translation-project sync, when connected
- AI providers (optional) - Anthropic or OpenAI, only for workspaces whose administrator turns AI features on and accepts the AI data-processing notice, using the organization's own API key and under its own account and terms with the provider; receives the conversation, its contact and company, and the workspace's knowledge base articles needed for a suggestion, never attachments
- Product analytics (optional) - usage-event analytics, active only after the user accepts the cookie-consent banner
We will inform the Customer at least 30 days before adding or replacing a sub-processor and give the Customer an opportunity to object. For questions about the services connected to your organization, contact support@unifydesk.app.
6. Security Measures
We implement appropriate technical and organizational measures including:
- Encryption of stored integration credentials
- TLS encryption in transit
- Row-level security for multi-tenant data isolation
- Role-based access controls
- Server-checked workspace permissions
- Session revocation and multi-factor authentication controls
We will notify the Customer of a personal-data breach without undue delay after becoming aware of it.
7. Data Subject Rights
We assist the Customer with requests from individuals exercising their data protection rights. Organization owners can request data exports and organization deletion in Settings → Privacy & Data. Send privacy requests to support@unifydesk.app.
8. Data Transfers
Customer data is hosted in Canada (OVHcloud, Beauharnois, Quebec). For customers in the EU and the UK, Canada has an EU adequacy decision for organizations subject to PIPEDA.
Sub-processors outside Canada and the EU, such as Stripe for payments and the optional AI providers (United States), are covered by the EU Standard Contractual Clauses and the UK Addendum, which this DPA incorporates. Section 5 lists the sub-processors. Connected mail, payment and accounting providers process data for enabled features. Send questions about processing locations to support@unifydesk.app.
9. Audit Rights
We make available the information needed to demonstrate compliance with this DPA. On request, once a year, we provide our security documentation. On-site audits take place only where applicable law requires them, on reasonable notice. Send requests to support@unifydesk.app.
10. Term & Deletion
At the end of the Service, we will, at the Customer's choice, delete or return Personal Data and delete existing copies, unless applicable law requires retention.
Subscription cancellation and organization deletion are separate actions. Organization owners can request a data export or organization deletion in Settings → Privacy & Data. Contact support@unifydesk.app about retention and deletion requests.
11. Changes
We give at least 30 days' notice by email of material changes to this DPA.
12. Contact
Mirage Informatique Inc., 686 Grande Allée E #147, Québec City, Quebec G1R 2K5, Canada. For privacy and data-processing questions, contact support@unifydesk.app.