Sign your DPA in your Deskwoot dashboard

Signing your GDPR Data Processing Agreement in Deskwoot takes under a minute from the Settings menu: you fill in your company details, sign electronically, and receive a countersigned PDF immediately. No DocuSign loop, no waiting for a counter-signature. The current version is 1.6.0, in force since 20 October 2026.

How to sign it

1. Go to Settings, Compliance, Data Processing Agreement in the dashboard.
2. Click Read the sample DPA to skim the full agreement before you commit. The same text becomes your signed PDF, so there are no surprises after the fact.
3. Fill in your company name, address, country, and the authorized signer's name and role.
4. Tick the acceptance box and click Accept and get PDF.
5. You will receive a confirmation email with the fully signed PDF as an attachment, and the same PDF stays available from the dashboard at any time.

What we capture for non-repudiation

Article 28(9) GDPR accepts electronic conclusion of the DPA, but only with a verifiable acceptance trail. Every signature on Deskwoot stores:

• Signer email, name, role, company, and country
• Acceptance timestamp and DPA version
• IP address and the full x-forwarded-for chain
• User-agent and Sec-CH-UA browser, platform, and mobile flags
• Cloudflare CF-Ray ID and CF-IPCountry, region, and city for tamper-resistant geo
• Accept-Language header, DNT preference, and Referer URL
• SHA-256 hash of the rendered PDF for tamper detection

This is all written twice. Once on the DpaAcceptance row in your account, and once into your audit log under dpa.accept. If anyone ever disputes the signature later, both records would have to be tampered with at the same time to fake a denial.

Professional secrecy for health professions

Since version 1.5.0, § 5a of the DPA protects professional secrets. It applies when you are legally bound to keep the secrets of others, in particular as a member of a health profession under § 203 of the German Criminal Code (StGB), for example as a physician, dentist, psychotherapist or physiotherapist. Deskwoot then takes part in your work as a contributing person under § 203(3) StGB and:

• keeps every secret it learns in its work for you, including the content of all messages and files and the mere fact that someone is in contact with you or is your patient, also after the contract ends,
• looks at such data only as far as the service needs it, for example for operation, security, troubleshooting and support,
• binds every employee and other person who works on the service to secrecy in text form before they start,
• passes secrets to the sub-processors in Annex B only as far as their service needs it, and makes sure each of them is bound to confidentiality by contract,
• tells you without undue delay when an authority or a court demands such data, where the law allows it.

§ 6(5) also binds every sub-processor by contract to the same data protection obligations that the DPA sets for its service.

When we update the DPA

When we add a clause or change a transfer mechanism, we bump the version number and ask you to accept again in the dashboard: the DPA page then shows New version available. Version 1.5.0 added § 5a, so a DPA accepted before 1.5.0 needs a new acceptance. A version that only changes the list of sub-processors in Annex B, such as 1.6.0, keeps your acceptance valid: under § 6(2) we tell you about such a change in advance, and you can object. Old acceptances stay in your history. The new one supersedes them.

Sub-processors

Annex B of the DPA lists every sub-processor we use, what data category they handle, and the GDPR transfer mechanism. Version 1.6.0 adds AssemblyAI, which turns voice messages from WhatsApp and Telegram into text on its servers in the EU while voice message transcription is on in your workspace (Settings > Account Settings, see Fynn and voice messages). Where a sub-processor publishes a DPA of their own for customers (AssemblyAI, Stripe, Cloudflare, Google for Firebase Cloud Messaging and ipapi.co at the time of writing), the link is shown right next to their privacy policy on deskwoot.com/dpa, so you can chase the SCC chain in one click.

Past acceptances

The DPA settings page lists all your historical signatures, including superseded ones. Each entry has its own download link, so your audit trail stays continuous even across new versions of the DPA.

Frequently asked questions