Data Processing Agreement

Last updated: 2 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Rezero Consulting Ltd, trading as Rezero Software (company number 11240887), registered office Ground Floor, Dearing House, 1 Young Street, Sheffield, S1 4UP, United Kingdom ("Rezero", "Processor"), and the organisation using ShuffleDesk ("Customer", "Controller").

It applies whenever Rezero processes personal data on the Customer's behalf in providing ShuffleDesk. You don't need to sign anything for it to apply. If your organisation needs a signed copy, email hello@shuffledesk.io.

1. Definitions

  • Data Protection Laws: the UK GDPR, the Data Protection Act 2018, and, where they apply, the EU GDPR and any other data protection law applicable to the processing.
  • Customer Personal Data: personal data that Rezero processes on the Customer's behalf in providing ShuffleDesk, as described in Schedule 1.
  • Sub-processor: a third party Rezero engages to process Customer Personal Data.
  • "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the Data Protection Laws.

2. Roles

The Customer is the controller of Customer Personal Data, and Rezero is its processor. Rezero is a controller only for the limited data described in its Privacy Policy for which it decides the purposes, such as billing records, website analytics and service security.

3. Customer's responsibilities

The Customer is responsible for:

  • having a lawful basis for using ShuffleDesk with its people;
  • giving them the information the Data Protection Laws require;
  • making sure its instructions to Rezero comply with the Data Protection Laws.

The Customer should not use ShuffleDesk to collect special category data, such as health information.

4. Rezero's obligations

Rezero will:

  1. process Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise, in which case Rezero will tell the Customer first unless the law prohibits it. The Terms of Service, this DPA, and the Customer's use and settings of ShuffleDesk are the Customer's instructions. Rezero will tell the Customer if it believes an instruction breaks the Data Protection Laws;
  2. make sure everyone authorised to process Customer Personal Data is bound by confidentiality;
  3. take the technical and organisational security measures set out in Schedule 2;
  4. help the Customer, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights. If Rezero receives such a request directly, it will pass it to the Customer without undue delay;
  5. help the Customer with its obligations on security, breach notification, data protection impact assessments and consultation with regulators, taking into account the nature of the processing and the information available to Rezero;
  6. notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information the Customer reasonably needs to meet its own obligations;
  7. at the end of the service, delete Customer Personal Data within 90 days, unless the law requires it to be kept. Before the workspace closes, the Customer can ask for a copy of its data;
  8. make available the information the Customer reasonably needs to show compliance with this DPA, and allow audits as set out in section 7.

5. Sub-processors

  • The Customer gives Rezero general authorisation to use the sub-processors listed in Schedule 3.
  • Rezero will tell workspace admins by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If we can't resolve the objection, the Customer may end the affected service and receive a refund of prepaid fees for the unused period.
  • Rezero will impose data protection terms on each sub-processor that protect Customer Personal Data to the same standard as this DPA, and remains responsible for its sub-processors' performance.

6. International transfers

Rezero hosts Customer Personal Data in the United Kingdom. Where a sub-processor processes Customer Personal Data outside the UK or EEA, Rezero will make sure a valid transfer mechanism is in place. This may be an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU standard contractual clauses.

7. Audits

On request, Rezero will answer the Customer's reasonable written questions about its data protection practices. If that isn't enough to show compliance, or a regulator requires it, the Customer may audit Rezero's compliance with this DPA:

  • no more than once a year;
  • with at least 30 days' written notice;
  • during business hours, at the Customer's cost;
  • in a way that doesn't compromise the security or confidentiality of other customers' data.

8. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service. If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA takes priority. This DPA is governed by the law of England and Wales.

Schedule 1: Details of processing

  • Subject matter and purpose: providing ShuffleDesk to the Customer. This means scheduling sessions, pairing people for one-to-one video chats, sending invitations, reminders and calendar invites, collecting optional feedback and check-ins, producing aggregate reports for the Customer's admins, and supporting and securing the service.
  • Duration: for as long as the Customer uses ShuffleDesk, plus the deletion period in section 4.
  • Nature of processing: collection, storage, organisation, matching, analysis into aggregate reports, transmission and deletion.
  • Data subjects: the Customer's admins, employees, contractors and other people the Customer invites.
  • Types of personal data:
    • Identity and contact: name, work email address, time zone, language and country.
    • Profile: optional photo, industry and interests.
    • Workspace: role, invitations and membership.
    • Activity: sessions joined, who was paired with whom, and chat times.
    • Feedback: optional ratings and comments about chats, and reports of misconduct.
    • Check-ins: optional answers, which are only shown to the Customer as averages across at least three people.
    • Technical: IP address, browser and device.
  • Special category data: none intended.
  • Not processed: the audio or video of chats. These go directly between participants' browsers, encrypted in transit, and are never recorded or stored by Rezero.

Schedule 2: Security measures

  • All data encrypted in transit using TLS (HTTPS). Video and audio encrypted between browsers using WebRTC's standard encryption (DTLS-SRTP).
  • Hosting in Amazon Web Services' London region.
  • Rezero Consulting Ltd is not currently certified to ISO 27001. Our hosting provider, Amazon Web Services, operates data centres with independent security certifications such as ISO 27001. Our security practices are informed by ISO 27001 and similar good-practice frameworks.
  • Passwords stored only as salted, one-way hashes.
  • Role-based access in the product. Members see only their own information and their chats. Admins see session reports as totals only: they can't see which sessions a person joined or who they were paired with, what was said, individual ratings, feedback or check-in answers.
  • Check-in results only reported in aggregate, and only once at least three people have answered.
  • Everyone with access to Customer Personal Data is bound by written confidentiality obligations. Access to production systems is limited to a small number of staff who need it to operate ShuffleDesk. Our other staff have no access to Customer Personal Data.
  • Bot protection on public forms, and protection against common web attacks such as cross-site request forgery.
  • The database and file storage are encrypted at rest (file storage using Amazon S3-managed keys, SSE-S3).
  • Daily backups of the database, each kept for 7 days.
  • Application error monitoring and server logging, so we can spot and investigate faults and misuse. Server logs are kept for up to 90 days.
  • Security incidents are the responsibility of our Chief Technology Officer, and alerts go to our senior management team. We notify affected customers of personal data breaches without undue delay and within 48 hours of becoming aware, as set out in section 4.
  • Regular software updates and security patching.

Schedule 3: Sub-processors

Sub-processorPurposeLocationTransfer safeguard
Amazon Web Services EMEA SARLHosting, database and file storageUnited Kingdom (London)None needed (data stays in the UK)
Stripe Payments Europe LtdPayments, invoicing and tax for the Customer's billing contactsEU/USEU: UK adequacy regulations. US: UK Extension to the EU–US Data Privacy Framework, or the UK IDTA/Addendum
Google LLCSTUN servers that help set up video chat connections (processes IP addresses only)GlobalUK Extension to the EU–US Data Privacy Framework, or the UK IDTA/Addendum
Google LLCGoogle Analytics (only if a visitor accepts analytics cookies), Google Fonts (typefaces loaded from Google's servers) and optional "Sign in with Google"GlobalUK Extension to the EU–US Data Privacy Framework, or the UK IDTA/Addendum
Microsoft CorporationOptional "Sign in with Microsoft", used only if a person chooses itGlobalUK Extension to the EU–US Data Privacy Framework, or the UK IDTA/Addendum
Slack Technologies (Salesforce, Inc.)Delivering Shuffle reminders to a Slack channel, only if the Customer connects the Slack integrationUnited StatesUK Extension to the EU–US Data Privacy Framework, or the UK IDTA/Addendum
Cloudflare, Inc.Bot protection (Turnstile) on sign-up and public formsGlobalUK Extension to the EU–US Data Privacy Framework, or the UK IDTA/Addendum
Umami Software, Inc.Cookie-free usage analytics (pages visited, browser, device type, approximate country; IP address is not stored)United StatesUK Extension to the EU–US Data Privacy Framework, or the UK IDTA/Addendum
Functional Software, Inc. (Sentry)Error monitoring (technical error details, which may include account information involved in the error)United StatesUK Extension to the EU–US Data Privacy Framework, or the UK IDTA/Addendum

Emails are sent through NotifiedBy, an email service owned and operated by Rezero and hosted in Amazon Web Services' London region.