Whether we need a data processing agreement depends on the specific job.

When a data processing agreement makes sense

If I process personal data on your behalf, e.g. in an internal tool, an automation workflow, an employee process, a customer dataset, a CRM integration, an AI workflow, or a hosted application, roles and a data processing agreement under GDPR Article 28 need to be agreed before the actual processing starts. That's a process we follow for each job, not a guarantee that an agreement already exists for all future work.

Where the roles stand today

• The public DeskDude Services site doesn't process personal data on behalf of a client. Visitors aren't a client's end users.
• The Ask Malte assistant answers the visitor's own questions and doesn't process data on behalf of a client.
• A free ebook download triggers a redacted, hashed event to DeskDude Ops for my own operations, not on behalf of a client.
• Future client work is decided case by case. If a job requires me to process a client's personal data, we agree on roles and a data processing agreement before that happens.

What we should clarify first

• Who's the controller, who's the processor, and whether there are subprocessors.
• What categories of personal data are involved.
• Whether sensitive data, employee data, customer data, or confidential business data is involved.
• Where data is stored, transferred, logged, and backed up.
• Who needs access, and how that access is removed again afterward.
• What we expect around retention, deletion, handover, security, and incident handling.

My practical approach

I'd rather not receive live production data, employee data, customer exports, or sensitive material before the scope and division of responsibility are clear. For early scoping, we prefer anonymised examples, synthetic data, screenshots with sensitive parts removed, or rough workflow descriptions wherever that's possible.

Restaurant Training

Restaurant Training has its own product-specific DPA page, which lives at /restaurant-training/en/dpa. This page only covers DeskDude Services and future scoped client work.