Data Processing Terms

These terms form part of the Terms of Service when a business (the “customer”) uses Task5 and the customer is the controller of personal data in its workspaces. Georgi Dragomirov, trading as Task5, is the processor. They are intended to meet Article 28 of the UK GDPR.

1. Scope

• Subject matter and duration: providing Task5 for as long as the customer uses it, plus the deletion period below.
• Nature and purpose: hosting, organising and analysing workspace content, and sending it to the AI provider the customer selects, to turn sources into tasks and run agents.
• Data subjects: the customer's users, and people who appear in its email, calendars, meetings, chats and documents.
• Personal data: names, contact details, message and meeting content, and any other personal data the customer brings into a workspace. The customer should not bring in special category data unless it has a lawful basis.

2. Our commitments

• We process personal data only on the customer's documented instructions, which are these terms and its use of the service.
• People who can access customer data are bound by confidentiality.
• We apply appropriate technical and organisational measures: encryption in transit and at rest, additional encryption of tokens and keys, workspace isolation, least-privilege access, audit logging and two-step verification for our own accounts.
• The customer authorises the subprocessors on our subprocessors page. We will give notice of new subprocessors, and the customer may object on reasonable grounds. Each subprocessor is bound by data protection terms at least as protective as these. AI providers used with the customer's own API key act under the customer's own agreement with them.
• We help the customer respond to data subject requests, mainly through the export and delete tools in the app.
• We tell the customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach.
• We help with data protection impact assessments and prior consultation where reasonably needed.
• When the customer deletes a workspace, its data is deleted from the live system straight away and from backups within 35 days, unless the law requires us to keep it.
• We make available the information needed to show compliance with this article, and allow reasonable audits, normally by written questionnaire, at most once a year.

3. International transfers

Workspace data is stored in London. Where a subprocessor processes data outside the UK, the transfer relies on UK adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

4. Customer responsibilities

The customer is responsible for having a lawful basis for the data it brings in, for informing its people, and for the connections and AI providers it chooses.

Questions or a signed copy: georgi.macbookpro@gmail.com.