Data Processing Addendum
This DPA applies when an OhMyDesk customer — a coworking space operator — processes personal data about its own members, visitors, and leads through OhMyDesk. In that relationship the operator is the controller and OhMyDesk is the processor. It forms part of our Terms of Service.
Last updated:
1. Definitions
Terms such as “personal data”, “controller”, “processor”, “data subject”, and “processing” have the meaning given in the EU General Data Protection Regulation (GDPR). “Customer” means the operator using OhMyDesk. “OhMyDesk” means the OhMyDesk coworking management product, available at ohmydesk.app, operated by Obod Soft EOOD (trading as Obod Soft LTD), jk Lazur 39 v.1 f.2 ap.5, Burgas, Bulgaria, company ID 207892162, VAT BG207892162, managing director Oleksandr Bodrov (“Obod Soft”).
2. Roles
- The Customer is the controller of the personal data it uploads or processes about its members, visitors, leads, and contacts (“Customer Personal Data”).
- Obod Soft, through the OhMyDesk service, is the processor of Customer Personal Data and processes it only on the Customer’s documented instructions, which include using the service as configured.
3. Scope of processing
| Subject matter | Provision of the OhMyDesk coworking management service |
|---|---|
| Duration | For the term of the Customer’s account |
| Nature & purpose | Storing and managing members, bookings, invoices, leads, and tasks; generating AI concierge replies and answering the Customer’s questions in the AI assistant; sending notifications; issuing smart-lock access codes where the Customer connects locks |
| Types of data | Names, e-mail addresses, phone numbers (where the Customer enters them), booking history and notes, billing details (including company name, address and VAT ID entered at booking), message content, lead notes, door access codes and door-entry events (where smart locks are connected) |
| Categories of data subject | The Customer’s members, prospective members, visitors, and contacts |
| Special category data | Not intended; the Customer must not upload special-category data unless agreed in writing |
4. OhMyDesk’s obligations
Obod Soft will, through OhMyDesk:
- process Customer Personal Data only on the Customer’s instructions, unless required by law;
- ensure persons authorized to process the data are bound by confidentiality;
- implement appropriate technical and organizational security measures (see Section 7);
- engage sub-processors only under the conditions in Section 5;
- assist the Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting its obligations on security, breach notification, and data protection impact assessments;
- notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data;
- at the Customer’s choice, delete or return Customer Personal Data at the end of the service, unless retention is required by law;
- make available information necessary to demonstrate compliance and allow for reasonable audits.
5. Sub-processors
The Customer authorizes Obod Soft to use the sub-processors below. Obod Soft imposes data-protection obligations on each sub-processor and remains responsible for their performance. We will give notice of new sub-processors with a reasonable opportunity to object.
| Sub-processor | Legal entity | Purpose | Location / safeguard |
|---|---|---|---|
| Supabase | Supabase Pte. Ltd., 65 Chulia Street #38-02/03 OCBC Centre, Singapore 049513 | Database, authentication, and file storage | Hosting in the EU (Ireland, AWS eu-west-1); SCCs where applicable |
| Cloudflare | Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Website and application hosting / content delivery | Global network; SCCs and EU–US Data Privacy Framework (DPF) where applicable |
| Resend | Plus Five Five, Inc. (Resend), 2261 Market St #5039, San Francisco, CA 94114, USA | Transactional and notification e-mail | EU region for sending; SCCs |
| Seam | Seam Labs, Inc., 2948 20th St #302, San Francisco, CA 94110, USA | Smart-lock integration, where the Customer connects locks: creating and removing time-limited door codes and receiving lock events (shortened member name and booking number, code, validity window, lock identifiers) | United States; SCCs and EU–US DPF |
| Google (Gemini API) | Google LLC and affiliates (Google Cloud) | AI concierge and operator assistant reply generation, where the Customer uses those features | Global processing under Google’s data processing terms for paid API use; we do not use Customer Personal Data to train Google’s models |
| TypeSafe (Jev) | TypeSafe AI, Inc., USA | AI assistant “Jev”: playbook routing in the operator copilot — receives only the PII-redacted current operator message plus playbook hints; does not generate replies (replies come from Google Gemini). Zero data retention enabled for our TypeSafe organisation (active since 2026-10-08): prompts and outputs are processed in memory and discarded, not stored, backed up, human-reviewed or used for training; only billing/usage telemetry is retained. | United States; EU Standard Contractual Clauses (Modules 2/3) via TypeSafe’s DPA (plus UK Addendum and Swiss terms); sub-processors at trust.typesafe.ai |
| Umami | Umami Software, Inc., 28 Geary St Suite 650 #243, San Francisco, CA, USA | Cookieless, aggregate usage analytics, relayed through our own proxy without the visitor’s IP address | Umami Cloud (EU region); SCCs per Umami’s DPA |
| Google (Google Fonts) | Google LLC and affiliates | Web-font delivery; the visitor’s browser requests fonts from Google | Global; SCCs and EU–US DPF where applicable |
Stripe. When the Customer connects its own Stripe account so members can pay online, Stripe contracts directly with the Customer. Stripe is not our sub-processor for Customer Personal Data processed in that payment flow.
WhatsApp / Meta. When the Customer connects its own WhatsApp Business account for the AI concierge, Meta processes messages under the Customer’s agreement with Meta. Meta is not our sub-processor for that channel.
Independent controllers. Where the Customer optionally connects Telegram for concierge or notifications, or enables Sign in with Google for its team, those providers may act as independent controllers for data they receive directly from users under their own terms.
6. International transfers
Where Customer Personal Data is transferred outside the EU/EEA, Obod Soft relies on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
When operator prompts are sent to TypeSafe (Jev) in the United States for playbook routing, we rely on the EU Standard Contractual Clauses under TypeSafe’s DPA. TypeSafe has zero data retention enabled for our organisation (since 2026-10-08): prompts and outputs are processed in memory and discarded, not stored, backed up, human-reviewed, or used for training.
7. Security measures
Obod Soft maintains measures including: encryption in transit (HTTPS/TLS); hashed passwords; database row-level security; role-based access control; rate limiting and abuse protection; least-privilege service credentials; and logical separation of each Customer’s data by organization.
Backups. Production database backups are managed by Supabase on our hosting plan and stored encrypted.
Logs. Platform request and application logs are retained for the period included with our Supabase hosting plan (varies by plan tier).
Door codes. Where smart locks are connected, time-limited access codes are removed from the lock provider after they expire.
Return and deletion. When the Customer closes its account or ends the service, Customer Personal Data is deleted or returned as described in Section 4, unless we must retain specific records to comply with law.
8. Data-subject requests
If OhMyDesk receives a request directly from a data subject relating to Customer Personal Data, it will refer that person to the Customer and assist the Customer in responding.
9. Liability and term
This DPA is subject to the liability provisions of the Terms of Service and remains in force as long as OhMyDesk processes Customer Personal Data.
10. Contact
Data-protection matters? Email [email protected].