Scope
This addendum applies when InnDesk processes personal information in a customer workspace for a subscribed business. The business is the responsible party or controller for that workspace data. InnDesk is the operator or processor.
Workspace data may include guest, customer, staff, supplier, booking, invoice, payment, sales, expense, statement, tax, and operational records entered by the business or its authorised users.
Customer instructions
InnDesk processes workspace data only to provide, secure, maintain, support, improve, and document the platform, or as otherwise instructed by the customer through the product or a written agreement.
The customer is responsible for ensuring it has a lawful basis to collect and enter personal information into InnDesk.
Security measures
InnDesk uses practical technical and organisational controls designed to protect workspace data, including encrypted web access, password hashing, role-based access, account separation, protected configuration files, restricted storage paths, and operational backups.
Customers should also use strong passwords, assign roles carefully, remove users who no longer need access, and export critical records where required for their own continuity plans.
Subprocessors
InnDesk may use hosting, email, payment, support, security, analytics, and infrastructure providers to deliver the service. We remain responsible for selecting service providers that are appropriate for the function they perform.
Where a provider materially changes the way workspace data is handled, we will update customer-facing information where practical.
Data subject requests and incidents
If a guest, customer, staff member, or other data subject contacts InnDesk about workspace data, we may redirect the request to the relevant subscribed business. We will assist the business where reasonably required by law or contract.
If we become aware of a confirmed security incident affecting workspace data, we will notify affected customers without undue delay and provide available information needed for assessment and response.
Return or deletion
On account closure or written request, InnDesk will make reasonable efforts to return, export, delete, or anonymise workspace data, subject to platform limitations, backups, legal retention, accounting duties, dispute handling, and security requirements.
This addendum supports the privacy policy and terms of service. If there is a signed agreement with different terms, that signed agreement controls where legally allowed.