Data protection and privacy by design

Privacy by Design

Data protection is an integral part of MyDesk's architecture – not an afterthought. We follow the principles of Privacy by Design and Privacy by Default, which means that we minimize data collection and ensure that personal data is only processed for specified, legitimate purposes.

Encryption

All data is encrypted during transport via TLS 1.2 or later. Data at rest is encrypted via Azure Storage Service Encryption (SSE) with AES-256. Encryption keys are managed by Microsoft Azure Key Vault.

Data Processor Agreement (DPA)

MyDesk enters into a data processing agreement with all customers as standard. The agreement is drawn up in accordance with GDPR article 28 and covers all aspects of data processing, including purpose, scope, security measures and sub-processors.

Data subject's rights

MyDesk assists customers in fulfilling the rights of data subjects, including:

• Right to insight (access to own data)
• Right to rectification (rectification of incorrect data)
• Right to erasure ("the right to be forgotten")
• Right to data portability
• Right to restriction of processing
• Right to object

Data minimization and storage limitation

MyDesk only collects the personal data that is necessary to provide the service. Data is deleted automatically in accordance with agreed retention periods. Customers can request deletion of data at any time.

Data processing within the EU/EEA

All personal data is processed and stored within the EU/EEA on Microsoft Azure infrastructure. No data is transferred to third countries without appropriate security measures.