Conformidad GDPR

1. Our Commitment

ChaosDesk is committed to protecting the privacy and rights of individuals in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). As a Netherlands-based company, we are directly subject to GDPR and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

2. Data Controller and Data Processor

ChaosDesk, based in Rotterdam, the Netherlands, acts as the data controller for personal data related to your account and use of our platform.

When you use ChaosDesk to manage support tickets from your customers (via the embeddable widget or API), you remain the data controller for that customer data, and ChaosDesk acts as a data processor on your behalf.

3. Legal Basis for Processing

We process personal data under the following legal bases:

Processing Activity	Legal Basis	GDPR Article
Account management	Contract performance	Art. 6(1)(b)
Helpdesk & ticket management	Contract performance	Art. 6(1)(b)
Financial record retention	Legal obligation	Art. 6(1)(c)
Widget delivery & API access	Contract performance	Art. 6(1)(b)
Platform security & fraud prevention	Legitimate interest	Art. 6(1)(f)
Marketing communications	Consent	Art. 6(1)(a)

4. Data Subject Rights

Under the GDPR, you have the following rights:

• Right of Access (Art. 15) — request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16) — request correction of inaccurate personal data.
• Right to Erasure (Art. 17) — request deletion of your data, subject to legal retention requirements.
• Right to Restriction (Art. 18) — request that we limit how we process your data.
• Right to Data Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to Object (Art. 21) — object to processing based on legitimate interest.
• Right to Withdraw Consent (Art. 7) — withdraw consent at any time for consent-based processing.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days as required by the GDPR.

5. Data Processing Activities

ChaosDesk processes the following categories of personal data:

• Identity data — name, email, company name
• Support data — ticket content, replies, attachments, customer information
• Technical data — IP addresses, API tokens, browser information
• Usage data — platform interactions, feature usage, API call logs

6. Sub-Processors

We use the following categories of sub-processors to deliver our services:

• Cloud infrastructure — EU-based hosting for data storage and processing
• Payment processing — for subscription billing (PCI DSS compliant)
• Email delivery — for transactional emails and ticket notifications

All sub-processors are bound by Data Processing Agreements (DPAs) and are required to comply with GDPR. A detailed list of sub-processors is available upon request.

7. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Where data transfers outside the EEA are necessary, we rely on:

• EU adequacy decisions (Art. 45)
• Standard Contractual Clauses approved by the European Commission (Art. 46)

8. Data Breach Procedures

In the event of a personal data breach:

• We will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours if the breach poses a risk to individuals' rights and freedoms.
• We will notify affected users without undue delay if the breach poses a high risk.
• We maintain an internal breach register documenting all incidents and response actions.

9. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that may pose a high risk to individuals, in accordance with GDPR Article 35.

10. Contact & Complaints

For data protection enquiries:

• Data Protection Contact: [email protected]
• ChaosDesk, Rotterdam, The Netherlands

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority:

• Autoriteit Persoonsgegevens
• Website: autoriteitpersoonsgegevens.nl
• Phone: +31 (0)88 1805 250