Data protection
Data processing agreement
A signed Demandory DPA is available for contracted customers and is completed with the processing details, locations, and provider schedule applicable to their implementation.
Effective 28 July 2026
Roles and instructions
For customer workspace data, the customer generally acts as controller and Demandory as processor, subject to the signed DPA. Demandory processes data only on documented instructions needed to provide, secure, support, and improve the contracted service.
Confidentiality and safeguards
Access is limited to authorized personnel and approved providers under confidentiality obligations. Tenant isolation, role-based access, audit events, transport encryption, backups, and incident procedures form part of the control set.
Subprocessors and transfers
The applicable subprocessor schedule identifies enabled providers and processing locations. Transfer terms and notice periods are completed in the signed DPA and order.
Deletion and return
At termination, Demandory supports permitted export and applies the agreed retention and deletion schedule, subject to backups and legal obligations.