Updated: 2026
1. Parties and acceptance
This Data Processing Agreement ("DPA") is between bigWebApps, Inc. d/b/a SherpaDesk ("SherpaDesk") and the customer that has agreed to the SherpaDesk Terms of Service ("Customer"). It forms part of the Terms of Service at https://www.sherpadesk.com/terms-of-service (the "Agreement").
1.1 This DPA takes effect on the earlier of (a) Customer's acceptance of the Agreement, or (b) the date both parties sign below. A signature is not required for this DPA to be binding. Customers who need a countersigned copy may request one at privacy@sherpadesk.com.
1.2 SherpaDesk contact for privacy matters: privacy@sherpadesk.com, PO Box 66181, Los Angeles, CA 90066, +1-866-996-1200.
2. Definitions
Capitalized terms not defined here have the meaning given in the Agreement.
- "Customer Data" means Personal Data that Customer or its Authorized Users submit to the Services, or that SherpaDesk processes on Customer's behalf, including ticket content, end-user contact details, attachments, asset records and time entries.
- "Data Protection Laws" means all laws that apply to the processing of Customer Data under the Agreement, including the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), and the comprehensive consumer privacy laws of other US states (together, "US State Privacy Laws").
- "GDPR" means Regulation (EU) 2016/679.
- "Personal Data" means information relating to an identified or identifiable natural person, and includes "personal information" and "personal data" as defined in Data Protection Laws.
- "Controller", "Processor", "Data Subject", "Processing" and "Supervisory Authority" have the meanings given in the GDPR. "Controller" includes "business", and "Processor" includes "service provider" and "contractor", as defined in US State Privacy Laws.
- "Sell" and "Share" have the meanings given in the CCPA.
- "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data.
- "Subprocessor" means a third party engaged by SherpaDesk that processes Customer Data.
- "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
- "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), as amended.
3. Roles, scope and instructions
3.1 Roles. Customer is the Controller (or, where Customer processes data for its own clients, such as a managed service provider, a Processor acting for those clients). SherpaDesk is Customer's Processor, or Subprocessor where Customer is itself a Processor. For SherpaDesk's own account administration, billing and marketing data about Customer's business contacts, SherpaDesk acts as an independent Controller under its Privacy Policy, and this DPA does not apply.
3.2 Instructions. SherpaDesk will process Customer Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration and use of the Services are Customer's complete instructions. Additional instructions require written agreement. SherpaDesk will promptly tell Customer if it believes an instruction infringes Data Protection Laws, but has no duty to monitor Customer's legal obligations.
3.3 Legal requirement. If law requires SherpaDesk to process Customer Data other than on Customer's instructions, SherpaDesk will inform Customer before processing, unless the law prohibits that notice.
3.4 Customer responsibilities. Customer is responsible for the lawfulness of the Customer Data and its instructions, including providing required notices and obtaining any required consents. Customer will not submit special categories of data (health, biometric, government ID numbers, payment card numbers and similar) to the Services except where the Services are configured for it.
3.5 Details of processing. The subject matter, duration, nature, purpose, data types and data subjects are described in Annex I.
3.6 Records. SherpaDesk will keep records of its processing activities as required by Article 30(2) GDPR.
4. US state privacy law terms
4.1 Business purpose. SherpaDesk processes Customer Data only for the limited and specified business purpose of providing, supporting, securing and improving the Services under the Agreement, as described in Annex I.
4.2 Restrictions. SherpaDesk will not:
- Sell or Share Customer Data;
- retain, use or disclose Customer Data for any purpose (including any commercial purpose) other than the business purpose in 4.1, or outside the direct business relationship with Customer;
- combine Customer Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as the CCPA permits for service providers; or
- attempt to re-identify any de-identified data it receives.
4.3 Compliance. SherpaDesk will comply with applicable US State Privacy Laws and provide the same level of privacy protection they require of Customer. SherpaDesk will notify Customer if it determines it can no longer meet its obligations under them.
4.4 Customer rights. Customer may take reasonable and appropriate steps to ensure SherpaDesk uses Customer Data consistently with Customer's obligations, and, on notice, to stop and remediate any unauthorized use. Section 8 (audits) describes how.
4.5 Flow-down. SherpaDesk will bind each Subprocessor to written terms at least as protective as this Section 4.
4.6 Certification. SherpaDesk certifies that it understands and will comply with the restrictions in this Section 4.
5. Confidentiality, security and AI features
5.1 Personnel. SherpaDesk will limit access to Customer Data to personnel who need it to provide the Services. Each is bound by written confidentiality obligations, receives security and privacy training, and is background-checked where local law allows.
5.2 Security measures. SherpaDesk will implement and maintain the technical and organizational measures in Annex II. SherpaDesk may update them over time, provided the update does not materially lower the overall protection of Customer Data.
5.3 AI features. Where Customer enables AI features of the Services (including SherpaDesk CoPilot):
- Customer Data is processed only to generate output for Customer, and the output is Customer Data;
- neither SherpaDesk nor its AI model providers will use Customer Data to train or fine-tune foundation models;
- AI model providers are listed in Annex III as Subprocessors and may retain prompts and outputs for no more than 30 days, solely for abuse monitoring, before deleting them; and
- Customer may disable AI features at any time in its account settings.
5.4 Aggregated data. SherpaDesk may create de-identified, aggregated data from use of the Services to operate and improve them, provided it cannot reasonably be used to identify Customer or any individual and SherpaDesk complies with 4.2(4).
6. Subprocessors
6.1 General authorization. Customer authorizes SherpaDesk to engage the Subprocessors listed in Annex III, as updated under Section 6.3 (the "Subprocessor List"). This is a general written authorization under Article 28(2) GDPR and Clause 9(a) Option 2 of the SCCs.
6.2 Subprocessor obligations. Before a Subprocessor processes Customer Data, SherpaDesk will (a) assess its security and privacy practices, and (b) bind it to written terms that protect Customer Data at least as well as this DPA. SherpaDesk remains liable for its Subprocessors' performance, subject to Section 10.
6.3 Notice of changes. SherpaDesk will give at least 30 days' notice before adding or replacing a Subprocessor, by emailing Customer's account owner and any privacy contact Customer has designated. In an emergency (for example, to keep the Services running or secure), SherpaDesk may give notice as soon as practicable.
6.4 Objection. Customer may object in writing on reasonable data protection grounds within the notice period. The parties will discuss in good faith. If SherpaDesk cannot reasonably offer an alternative within 30 days, Customer may terminate the affected Services and receive a pro-rated refund of prepaid fees for the unused term. This is Customer's sole remedy for an objection.
6.5 Customer-enabled integrations. Third-party services that Customer chooses to connect to the Services (for example, Google Workspace, Microsoft 365, QuickBooks, Xero, FreshBooks, remote monitoring tools or Zapier) are not SherpaDesk Subprocessors. Customer's agreement with that provider governs data it receives.
7. Security Incidents
7.1 Notice. SherpaDesk will notify Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident affecting Customer Data. Notice goes to Customer's account owner email and any security contact Customer has designated.
7.2 Content. To the extent known, the notice will describe the nature of the incident, the categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed. SherpaDesk will provide further information in phases as it becomes available.
7.3 Response. SherpaDesk will promptly take reasonable steps to contain, investigate and mitigate the incident, and will reasonably help Customer meet its own breach notification obligations.
7.4 Not an admission. Notice of a Security Incident is not an admission of fault or liability.
7.5 Exclusions. Unsuccessful attempts that do not compromise Customer Data (such as pings, port scans, blocked login attempts or denial-of-service attacks) are not Security Incidents.
8. Data subject requests, assistance and audits
8.1 Data subject requests. The Services let Customer access, correct, export and delete Customer Data. If SherpaDesk receives a request from a data subject about Customer Data, it will refer the requester to Customer and will not respond itself unless Customer authorizes it or the law requires it. Where Customer cannot fulfil a request through the Services, SherpaDesk will provide reasonable help.
8.2 Other assistance. Taking into account the nature of the processing and information available to it, SherpaDesk will provide reasonable help with Customer's data protection impact assessments and prior consultations with Supervisory Authorities.
8.3 Government requests. If SherpaDesk receives a legally binding request from a public authority for Customer Data, it will redirect the authority to Customer where possible, notify Customer unless legally prohibited, challenge requests it reasonably considers unlawful, and disclose only the minimum required.
8.4 Audit reports. On written request, no more than once every 12 months, SherpaDesk will provide (under confidentiality) its most recent third-party penetration test summary, GovRAMP security materials when available, and answers to a reasonable security questionnaire.
8.5 On-site audits. If the materials in 8.4 do not reasonably show compliance, or a Supervisory Authority requires it, or after a Security Incident, Customer may conduct an audit once every 12 months on at least 30 days' notice. The parties will agree on scope, timing, and duration. Audits will be conducted during business hours, by Customer or an independent auditor bound by confidentiality, and at Customer's expense. Audits of cloud hosting facilities are satisfied by the hosting provider's own certifications.
9. International transfers
9.1 Location. SherpaDesk stores and processes Customer Data in the United States. Subprocessors may process it in the locations listed in Annex III.
9.2 Data Privacy Framework. SherpaDesk is certified under the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework. Transfers of Customer Data from the EEA, UK and Switzerland to SherpaDesk rely on that certification while it remains valid.
9.3 SCCs as fallback. If the DPF certification lapses or the framework is invalidated or does not cover a transfer, the SCCs are incorporated by reference and apply automatically, completed as follows:
SCC term | Selection |
|---|---|
| Modules | Module 2 (Controller to Processor) where Customer is a Controller; Module 3 (Processor to Processor) where Customer is a Processor |
| Clause 7 (docking) | Included |
| Clause 9(a) | Option 2, general authorization, 30 days' notice (Section 6) |
| Clause 11(a) | Optional independent dispute body not included |
| Clause 13 | Supervisory Authority of the Member State where Customer is established; if not in the EEA, of the Member State where its EU representative is established; otherwise Ireland's Data Protection Commission |
| Clause 17 | Option 1, law of Ireland |
| Clause 18(b) | Courts of Ireland |
| Annexes I, II, III | Annexes I, II and III of this DPA |
| Clause 8.9 / 8.5 (audit, deletion) | Met through Sections 8 and 10 of this DPA |
9.4 UK transfers. For transfers subject to UK data protection law, the UK Addendum applies. Table 1 parties and Tables 2 and 3 are completed from Section 9.3 and the Annexes. For Table 4, either party may end the UK Addendum as allowed by its Section 19.9.5 Swiss transfers. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR mean the FADP; the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; "Member State" includes Switzerland so data subjects there may sue at their habitual residence.
9.6 Conflict. If the SCCs or UK Addendum conflict with this DPA, they prevail for the transfers they cover.
10. Deletion, liability, term and precedence
10.1 Return and deletion. Customer may export Customer Data through the Services at any time during the term. Within 30 days after the Agreement ends, Customer may request an export. SherpaDesk will then delete Customer Data from production systems within 60 days, and from backups within 90 days as backups rotate, and will certify deletion on request. SherpaDesk may keep Customer Data where the law requires, in which case this DPA continues to protect it.
10.2 Liability. Each party's liability arising out of or relating to this DPA (including the SCCs, to the extent the law allows) is subject to the exclusions and limitations of liability in the Agreement. Nothing in this DPA limits either party's liability to data subjects under the SCCs.
10.3 Term. This DPA lasts as long as SherpaDesk processes Customer Data. Confidentiality and deletion obligations survive.
10.4 Precedence. If there is a conflict, this order applies: (1) the SCCs and UK Addendum, for the transfers they cover; (2) this DPA; (3) the Agreement. Except as changed by this DPA, the Agreement stays in full effect.
10.5 Changes. SherpaDesk may update this DPA to reflect changes in Data Protection Laws or the Services, with 30 days' notice, provided the update does not materially reduce protection of Customer Data.
10.6 Governing law. Except where the SCCs or UK Addendum require otherwise, this DPA is governed by the law that governs the Agreement.
Signatures (optional; see 1.1)
Customer | bigWebApps, Inc. d/b/a SherpaDesk |
|---|---|
| Signature | |
| Name | Patrick Clements |
| Title | Chief Executive Officer |
| Date | |
| Privacy contact | privacy@sherpadesk.com |
Annex I: Parties and description of processing
A. PartiesData exporter | Data importer | |
|---|---|---|
| Name | Customer, as named in its SherpaDesk account | bigWebApps, Inc. d/b/a SherpaDesk |
| Address | As in Customer's account | PO Box 66181, Los Angeles, CA 90066, United States |
| Contact | Customer's account owner | Patrick Clements, CEO, privacy@sherpadesk.com |
| Role | Controller (Module 2) or Processor (Module 3) | Processor (Module 2) or Subprocessor (Module 3) |
| Activities | Use of the SherpaDesk help desk and PSA Services | Provision of the Services under the Agreement |
| Signature and date | By accepting the Agreement, or signature under Section 10 | By offering the Agreement, or signature under Section 10 |
Item | Description |
|---|---|
| Data subjects | Customer's Authorized Users (technicians, agents, admins); Customer's end users and requesters; Customer's clients and their staff (for MSP customers); vendor and contractor contacts stored by Customer |
| Personal Data | Name, business email, phone, job title, department, company and location; login credentials (hashed passwords, SSO identifiers); ticket and chat content, email messages and attachments sent into the Services; asset and device records linked to users (hostname, IP address, serial number); time entries, schedules and project records; invoice and billing records Customer creates for its clients; usage logs, IP addresses and device data from the web and mobile apps; content submitted to and generated by AI features |
| Sensitive data | None intended. Customer may not submit special category data except as allowed in Section 3.4. Any that reaches ticket content gets the full protections of Annex II. |
| Frequency | Continuous, for the term of the Agreement |
| Nature of processing | Hosting, storage, organization, retrieval, transmission, display, reporting, automation, AI-assisted summarization and drafting, backup, support and deletion |
| Purpose | Providing, supporting and securing the SherpaDesk Services as described in the Agreement |
| Retention | Term of the Agreement plus the deletion periods in Section 10.1 |
| Subprocessor transfers | Same subject matter and nature as above, limited to each Subprocessor's function in Annex III, for the term of the Agreement |
C. Competent Supervisory Authority As set out in Section 9.3 (Clause 13).
Annex II: Technical and organizational measures
SherpaDesk maintains a written information security program covering the measures below.
Area | Measures |
|---|---|
| Governance | Named owner for security and privacy; written policies reviewed at least annually; risk assessment annually; enrolling in GovRAMP's Progressing Security Snapshot program |
| Personnel | Confidentiality agreements; background checks where lawful; security and privacy training at hire and annually; access removed at offboarding |
| Hosting and physical security | Production hosted in Microsoft Azure data centers in the United States; physical controls provided and certified by the hosting provider (ISO 27001, SOC 2); no Customer Data stored in SherpaDesk offices |
| Access control | Role-based access, least privilege; MFA for all administrative and production access; unique accounts; access reviews quarterly; customer-side SSO (Google, Microsoft) and MFA options |
| Encryption | TLS 1.2 or higher in transit; AES-256 encryption at rest for databases, file storage and backups; secrets held in a managed key vault |
| Application security | Secure development practices; code review before release; dependency and vulnerability scanning; separate development, test and production environments; no production Customer Data in test without masking; annual third-party penetration test |
| Tenant isolation | Logical separation of each customer's data by account identifier, enforced at the application and data layers |
| Logging and monitoring | Centralized logs of system and administrative access; alerting on suspicious activity; audit trail of changes within the Services |
| Resilience | Automated backups with daily frequency and 30-day retention, stored encrypted in a separate location; documented disaster recovery plan tested annually |
| Incident response | Written incident response plan; on-call escalation; customer notice per Section 7 |
| Vendor management | Security review of Subprocessors before onboarding and periodically after; written data protection terms with each |
| AI features | AI requests sent only to providers in Annex III under no-training terms; prompts scoped to the requesting customer's data; OpenAI retains prompts and outputs for up to 30 days for abuse monitoring, then deletes them |
| Data subject rights | In-product tools for export, correction and deletion; support assistance per Section 8.1 |
| Deletion | Deletion per Section 10.1; secure disposal of storage media handled by the hosting provider under its certified procedures |
Annex III: Subprocessors
Customer authorizes the Subprocessors below. The current list is available on request at privacy@sherpadesk.com.A. Subprocessors that process Customer Data
Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Microsoft Corporation (Azure) | Cloud hosting, database, file storage, backups; error and performance monitoring (Azure Application Insights) | All Customer Data; diagnostic logs that may contain user IDs, IPs, and request data | United States |
| OpenAI, L.L.C. (OpenAI API) | CoPilot AI features: summarization, drafting, classification | Ticket content and other data a user sends to an AI feature | United States |
| Mailgun Technologies, Inc. | Sending and receiving ticket emails and notifications | Email addresses, names, message content, attachments | United States |
| Amazon Web Services, Inc. (Amazon SES) | Sending ticket emails and notifications | Email addresses, names, message content, attachments | United States |
| Intercom, Inc. | In-app messaging, product announcements, outage notices, onboarding, support chat | Authorized User name, email, account details, support conversations | United States |
| 650 Industries, Inc. (Expo) | Push notifications for the SherpaDesk mobile app | Device push tokens, notification text | United States |
| DotNet Report | Embedded reporting | Report queries over Customer Data | United States |
| Twilio Inc. | SMS notifications | Phone numbers, notification text | United States |
B. Service providers for SherpaDesk's own account and billing data (listed for transparency)
SherpaDesk is the Controller for this data (Section 3.1). These providers do not receive ticket or end-user data.
Provider | Purpose | Data | Location |
|---|---|---|---|
| Maxio (formerly Chargify) | Subscription billing | Billing contact, plan, invoices | United States |
| Authorize.Net (Visa Inc.) | Payment processing | Billing contact, card data (tokenized) | United States |
| HubSpot, Inc. | CRM, quotes and renewals, marketing email | Business contact details, deal and renewal records | United States |
| Intuit Inc. (QuickBooks Online) | SherpaDesk's own invoicing and accounting | Billing contact, invoices, payments | United States |
| Zapier, Inc. | Automation between HubSpot and QuickBooks | Billing contact, invoice data | United States |
C. Removed from the 2021 list
Google, Microsoft (calendar and sign-in), Intuit QuickBooks, Xero and FreshBooks were listed in 2021 as Subprocessors for customer-connected integrations. They are customer-enabled integrations under Section 6.5, not Subprocessors, unless SherpaDesk itself uses them to host Customer Data.
