1. Scope and definitions
1.1This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Terms”) between Denwen Ltd (“Denwen”, the “Processor”) and the Customer. It applies whenever Denwen processes Customer Personal Data in providing the Service.
1.2Data Protection Law means the UK GDPR and the Data Protection Act 2018 and, where they apply to the processing, Regulation (EU) 2016/679 (“EU GDPR”) and laws implementing or supplementing it. Customer Personal Data means personal data in Customer Data (as defined in the Terms) that Denwen processes on the Customer’s behalf. Terms such as controller, processor, data subject, personal data breach, processing and supervisory authority have the meanings given in Data Protection Law.
1.3Capitalised terms not defined here have the meanings given in the Terms.
2. Roles of the parties
2.1The Customer is the controller of Customer Personal Data and Denwen is its processor, except where clause 2.2 applies.
2.2Managed service providers. Where the Customer uses the Service to provide services to its own clients, the client is normally the controller, the Customer is the client’s processor, and Denwen is a sub-processor. In that case the Customer warrants that it has authority from each client to appoint Denwen, and the Customer must flow down to its clients terms that are no less protective than this DPA. Denwen accepts that the obligations it owes to the Customer under this DPA are the obligations of a sub-processor under Article 28(4), and will provide the Customer with the information and assistance it needs to meet its own obligations to its clients.
2.3The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis for monitoring, remote access and session recording, and for informing data subjects as required by Article 13 and 14. The details of processing are set out in Annex 1.
3. Documented instructions — Article 28(3)(a)
3.1Denwen will process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless required to do otherwise by UK law or (where EU GDPR applies) EU or Member State law to which Denwen is subject. In that case Denwen will inform the Customer of that legal requirement before processing, unless that law prohibits it on important grounds of public interest.
3.2The Customer’s documented instructions are: the Terms and this DPA; the configuration and actions its Users make in the Service (for example, enrolling Endpoints, running scripts, starting and recording sessions, setting retention periods and connecting integrations); and any other written instructions agreed between the parties.
3.3Denwen will inform the Customer immediately if, in its opinion, an instruction infringes Data Protection Law.
4. Confidentiality — Article 28(3)(b)
4.1Denwen will ensure that every person it authorises to process Customer Personal Data has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality, and processes it only as needed to provide the Service.
4.2Denwen limits access by its personnel as described in clause 6.
5. Security of processing — Article 28(3)(c) and Article 32
5.1Denwen will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the matters in Article 32(1). The measures in place at the date of this DPA are summarised in Annex 2.
5.2Denwen may update those measures over time, provided that the overall level of security is not reduced.
5.3The Customer is responsible for the security measures within its control, including its Users’ credentials, the roles it assigns, enforcing multi-factor authentication for its Tenants, and the security of its Endpoints and of the third-party services it connects.
6. Provider access
6.1No standing access. Denwen personnel (“Provider Staff”) have no standing access to the Customer’s Tenants, Endpoints or Customer Personal Data.
6.2Support access grants. Provider Staff may access a Tenant through the Service only under a support access grant created by one of the Customer’s administrators (in Administration → Provider access), or requested by Provider Staff and approved by one of the Customer’s administrators. Each grant has a level — View (read-only), Manage (read and act, for example run scripts or change settings) or Control (Manage plus remote desktop) — a separate choice whether session recordings are included, a reason or ticket reference, and a fixed duration, after which it expires automatically. Provider Staff may request a duration of between one hour and 30 days. The Customer’s administrators may grant, approve or renew a grant for up to 365 days, for example to match a support contract, and may record the contract reference on it. A grant may be limited to one named member of Provider Staff. The Customer may revoke a grant at any time, with immediate effect.
6.3Emergency access. In a security emergency affecting the Customer, or where necessary to comply with a legal obligation, a Denwen administrator may open emergency access to a Tenant for no more than four hours, with a written reason. The Customer’s administrators are notified by email immediately, the access is recorded in the Customer’s audit log, and each use is reviewed by Denwen afterwards.
6.4Accountability. All actions by Provider Staff in a Tenant are recorded in that Tenant’s audit log, marked “Provider staff”. The audit log is append-only.
6.5Remote sessions. A remote desktop session started by Provider Staff to an Endpoint where a person is signed in and the Endpoint is unlocked always shows the end-user consent prompt, whatever the Customer’s own consent setting. Where nobody is signed in or the Endpoint is locked, the Customer’s grant is the authorisation. Provider Staff cannot change the Customer’s consent settings.
6.6Account controls. Provider Staff accounts require multi-factor authentication, cannot use remembered-device trust, have shorter session lifetimes, and can be restricted to approved IP addresses. Platform-level API keys cannot reach Customer Personal Data. Alerts from the Customer’s Endpoints are delivered only to the Customer’s own notification channels and PSA integrations, never to Denwen.
6.7Infrastructure administration. A limited number of authorised Denwen personnel administer the servers, databases and backups on which the Service runs. That work is subject to clause 4, and is not used to view or act on Customer Personal Data except as strictly necessary to operate, secure, back up or restore the Service.
7. Sub-processors — Articles 28(2), 28(3)(d) and 28(4)
7.1General written authorisation. The Customer gives Denwen general written authorisation to engage sub-processors. The sub-processors in use are listed on the sub-processors page (Annex 3).
7.2Notice of changes. Denwen will give the Customer at least 30 days’ notice of any intended addition or replacement of a sub-processor, by email to the account owner and by updating the sub-processors page, except where a change is urgently needed to protect the security or continuity of the Service, in which case Denwen will give notice as soon as practicable.
7.3Right to object. The Customer may object to a change on reasonable data protection grounds by writing to hello@denwen.co.uk within the notice period. The parties will discuss the objection in good faith. If Denwen cannot reasonably accommodate it, the Customer may terminate the affected part of the Service without penalty and receive a pro rata refund of prepaid fees for it.
7.4Same obligations. Denwen will impose on each sub-processor, by written contract, data protection obligations that provide the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Denwen remains fully liable to the Customer for the performance of each sub-processor’s obligations.
7.5Customer-chosen services are not sub-processors. Services the Customer chooses and configures — for example its own SMTP relay, webhooks, PSA system, single sign-on identity provider, or its own AI model provider — are engaged by the Customer and are not Denwen’s sub-processors.
7.6Flow-down by managed service providers. Where clause 2.2 applies, the Customer may pass Denwen’s list of sub-processors and the notices it receives under clause 7.2 to its clients, so that each client’s authorisation and right to object can be exercised through the Customer.
8. Data subject rights — Article 28(3)(e)
8.1Taking into account the nature of the processing, Denwen will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects to exercise their rights under Chapter III of UK GDPR and EU GDPR.
8.2Much of this assistance is built into the Service: the Customer can view and delete device records, recordings and other data from the console, and set its own retention periods. Where the Customer cannot do something itself, Denwen will help on request.
8.3If Denwen receives a request directly from a data subject concerning Customer Personal Data, it will not respond itself (other than to direct the data subject to the Customer) and will forward the request to the Customer without undue delay.
9. Assistance with Articles 32 to 36 — Article 28(3)(f)
9.1Taking into account the nature of the processing and the information available to it, Denwen will assist the Customer in ensuring compliance with its obligations under Articles 32 to 36: security of processing (Article 32), notifying personal data breaches to the supervisory authority and to data subjects (Articles 33 and 34), data protection impact assessments (Article 35), and prior consultation with the supervisory authority (Article 36).
9.2This assistance includes providing the information in this DPA, on the security page and in the security questionnaire, and answering reasonable follow-up questions for a data protection impact assessment.
10. Personal data breaches
10.1Denwen will notify the Customer of a personal data breach affecting Customer Personal Data without undue delay and in any event within 48 hours of becoming aware of it.
10.2The notification will describe, as far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point for more information. Where not all of this is available at once, Denwen will provide it in phases without further undue delay.
10.3Notifications are sent by email to the Customer’s account owner and administrators. Denwen will take reasonable steps to contain and remedy the breach and will cooperate with the Customer’s investigation. Notifying a breach is not an admission of fault.
11. Deletion and return — Article 28(3)(g)
11.1During the term, the Customer can delete Customer Personal Data through the Service. Retention periods set by the Customer are enforced automatically; session recordings are kept for no more than 90 days.
11.2At the end of the provision of the Service, at the Customer’s choice, Denwen will delete or return Customer Personal Data, and will delete existing copies, unless UK law (or, where EU GDPR applies, EU or Member State law) requires their storage. If the Customer does not make a choice, Denwen will delete the data within [TO CONFIRM: deletion period after end of service, e.g. 30 days] of the end of the Service.
11.3Copies held in backups are not restored to use and are overwritten as the backup cycle rotates; Denwen currently keeps 7 nightly backups on the server and 14 on a separate Denwen-owned machine, so data deleted from the live system leaves the backups within approximately 14 days.
11.4On request, Denwen will confirm deletion in writing.
12. Information and audit — Article 28(3)(h)
12.1Denwen will make available to the Customer all information necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, conducted by the Customer or by another auditor mandated by the Customer.
12.2The Customer agrees first to use the information in this DPA, the security questionnaire and Denwen’s written answers to its questions. If that is not sufficient, or where required by a supervisory authority or following a personal data breach, the Customer may carry out an audit on at least 30 days’ written notice (or shorter where a supervisory authority requires), during business hours, no more than once in any 12 months except after a breach or at a supervisory authority’s request, and subject to reasonable confidentiality obligations. The audit must not give access to other customers’ data.
12.3Each party bears its own costs of an audit, except that the Customer will pay Denwen’s reasonable costs of an on-site inspection that is not prompted by a breach or a supervisory authority.
12.4Denwen does not currently hold third-party certifications (such as ISO/IEC 27001 or a SOC 2 report) that could be offered in place of an audit.
13. International transfers
13.1Customer Personal Data is stored and processed in the United Kingdom. Denwen will not transfer Customer Personal Data outside the UK except to sub-processors listed under clause 7, or on the Customer’s instructions.
13.2UK transfers. Where Denwen or a sub-processor makes a restricted transfer of Customer Personal Data from the UK to a country without UK adequacy regulations, the transfer will be made under the UK International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, together with any supplementary measures needed.
13.3EU transfers. Where EU GDPR applies to the Customer’s processing, transfers from the European Economic Area to the UK rely on the European Commission’s adequacy decision for the UK while it is in force. If it ceases to apply, or for onward transfers to a third country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply — Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor — and are incorporated into this DPA by reference, with Annex 1 and Annex 2 of this DPA completing their annexes. For the purposes of those clauses, Clause 7 (docking) applies, the option in Clause 9(a) is general written authorisation with the notice period in clause 7.2 of this DPA, and Clauses 17 and 18 select the law and courts of Ireland [TO CONFIRM: confirm the EU Member State chosen for SCC Clauses 17 and 18].
13.4The safeguard used for each sub-processor is shown on the sub-processors page.
14. Liability, precedence and term
14.1Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not permit such a limitation.
14.2If this DPA conflicts with the Terms on a matter of data protection, this DPA prevails. If it conflicts with Standard Contractual Clauses or a UK transfer instrument incorporated under clause 13, those prevail.
14.3This DPA lasts for as long as Denwen processes Customer Personal Data, and is governed by the law that governs the Terms (England and Wales), except as stated in clause 13.3.
Annex 1 — Details of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Denwen RMM remote monitoring and management service to the Customer. |
| Duration | For the term of the Customer’s subscription, and afterwards until deletion or return under clause 11. |
| Nature and purpose | Hosting, storing, collecting from Endpoints, displaying, transmitting, recording (where enabled), analysing (including by the optional AI assistant, where enabled) and deleting Customer Personal Data, in order to let the Customer monitor, manage, patch, support and remotely access its Endpoints. |
| Types of personal data | Device inventory and telemetry (hardware, operating system, installed software, patch state, performance), which may include usernames and device names; event log entries queried by operators; remote desktop sessions and, where enabled, session recordings — which may show anything on the screen; files transferred; scripts run and their output; alerts and notification delivery logs; PSA ticket mappings; the audit trail of operator actions, including names, email addresses and IP addresses of Users. Special category data is not required by the Service, but may be visible on screen during a session or in files, at the Customer’s direction. |
| Categories of data subjects | The Customer’s (and, for managed service providers, its clients’) employees, contractors and other people who use the Endpoints; the Customer’s Users of the console; any individual whose data appears on an Endpoint’s screen or in its files during a session. |
| Frequency | Continuous, for as long as Endpoints are enrolled. |
| Retention | As configured by the Customer per Tenant; session recordings at most 90 days; deletion at end of service under clause 11. |
| Location | United Kingdom, with sub-processors as listed in Annex 3. |
Annex 2 — Technical and organisational measures
A summary of the measures in place. The security questionnaire gives more detail, including the limits of each.
Encryption
- All connections to the Service — console, agents and relay — use TLS.
- Session recordings are encrypted at rest with AES-256-GCM using envelope encryption under a platform-managed master key. Customers do not hold their own keys.
- Secrets the Customer supplies (webhook secrets, SMTP passwords, single sign-on client secrets, AI provider keys) are sealed at rest and never returned to any console.
- Database encryption at rest: [TO CONFIRM: whether the database volume / disk is encrypted at rest].
Access control
- Role-based access control with editable roles and per-site scope, controlled by the Customer.
- Multi-factor authentication (TOTP), mandatory for Provider Staff and enforceable per Tenant for Customer Users.
- Single sign-on through OpenID Connect, including Microsoft Entra ID.
- Provider access only under customer-controlled, time-limited grants, with emergency access limited to four hours and notified (clause 6).
- Remote sessions end after a period without operator activity (15 minutes by default).
Tenant isolation
- Tenant scoping enforced on the server for every request; a request for another tenant’s resource is answered as if the resource did not exist (HTTP 404).
- API keys act only within the organisation that issued them.
Endpoint and command integrity
- The Windows agent is code-signed, and agent updates are signed installers the agent verifies before installing.
- State-changing commands are signed (ECDSA) and checked on the Endpoint for signature, key, sequence and expiry before they run.
- An end-user consent prompt (Allow/Refuse) for remote sessions, configurable by platform, tenant, site and device, and an on-screen notice whenever a session is recorded.
Logging and accountability
- An audit log of sign-ins, administrative changes and actions on Endpoints, made append-only by a database trigger.
- Provider Staff actions recorded in the Customer’s own audit log.
Availability and resilience
- Nightly backups, with 7 kept on the server and 14 copied, checksum-verified, to a separate Denwen-owned machine in the United Kingdom. No third-party storage provider is used.
Organisational measures
- Confidentiality obligations on all personnel with access to Customer Personal Data.
- A documented route for vulnerability reports: security@denwen.co.uk.
- Breach notification to customers within 48 hours (clause 10).
Annex 3 — Sub-processors
The current list of sub-processors, with the data each receives, where, and the transfer safeguard, is published on the sub-processors page and forms this Annex.