BoardDesk

Data Processing Agreement

Template DPA · Last updated: June 29, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between your board (the “Controller”) and BoardDesk (the “Processor”). It is provided as a template to help boards demonstrate GDPR/CCPA-aligned processing practices.

1. Roles

The board is the Controller of personal data it manages (board members and residents). BoardDesk is the Processor and processes personal data only on the Controller’s documented instructions, including as set out in the Service.

2. Categories of data processed

  • Board member identity data — names, emails, roles.
  • Resident contact data — email addresses for notification subscriptions.
  • Board operational records — decisions, minutes, projects, budgets and expenses, bids, documents, and meetings.

3. Purposes of processing

  • Providing board-management functionality to the Controller.
  • Displaying board-approved public information on the resident portal.
  • Sending board notifications residents have subscribed to.
  • Securing, maintaining, and supporting the Service.

4. Security measures

  • Encryption in transit (TLS) and at rest.
  • Row-level access controls isolating each board’s data.
  • Public portal exposure limited to explicitly published, non-sensitive fields.
  • Brokered, signed access to stored documents — no public bucket exposure.

5. Sub-processors

BoardDesk uses infrastructure and service sub-processors (e.g., cloud hosting, database and storage, payment processing, and email delivery) solely to provide the Service. A current list is available on request.

6. Data subject rights

BoardDesk will assist the Controller, taking into account the nature of processing, in responding to data subject requests (access, correction, deletion where lawful, and objection). Residents may unsubscribe directly via the link in every notification.

7. Retention & deletion

Decisions and minutes are retained to support statutory record-keeping (NY BCL §624) and are not hard-deleted. Other data is retained for the duration of the agreement or as instructed, subject to legal retention requirements. Resident emails are deleted/anonymized upon unsubscription on request.

8. International transfers

Where data is processed outside your jurisdiction, appropriate safeguards are applied.

9. Liability

The liability provisions of the Terms of Service apply to this DPA.

This template is provided for convenience and is not legal advice. Boards should review it with their own counsel.

Privacy · Terms · DPA