Data Processing Overview

Roles

For workspace content, your organisation is the data controller and Principal Approval Desk acts as a data processor, processing content only to provide the Service and on the organisation's instructions.

What we process

Account details of members, decision requests and their attachments, comments, notifications, and audit records — as created by your organisation.

Sub-processors

We use a small set of infrastructure sub-processors: application hosting, database hosting, file storage, email delivery, and payment processing. A current list is available on request from support@principalapprovaldesk.com.

Security measures

Encryption in transit; infrastructure encryption at rest; organisation-level data isolation enforced in the application layer; role-based access control; audit logging; and tested backup procedures. See the Security page for detail.

International transfers

Where data is transferred between jurisdictions, we rely on appropriate safeguards offered by our infrastructure providers, such as standard contractual clauses.

Deletion and return

On termination, organisations may export their data for thirty days, after which content is deleted from production systems and expires from backups on a rolling basis.

Contact

Data protection enquiries: support@principalapprovaldesk.com.

This template was last updated in August 2026.