Data Processing Agreement

For JoyRemote Teams customers, under Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Last updated October 2026.

1. Parties

1.1 The Customer: the company that has started an organisation on the JoyRemote Teams console, named when this agreement is signed. The Customer is the controller.

1.2 The Processor: Tiny Thoughts LTD, company number 513868273, the publisher of JoyRemote, reachable at info@joyremote.com.

1.3 This agreement forms part of the Customer's JoyRemote Teams subscription and the license agreement. Where they conflict on the processing of personal data, this agreement prevails.

2. Subject matter and duration

2.1 The Processor processes personal data on the Customer's behalf to provide JoyRemote Teams: the company console, enrolment of the Customer's computers, the company's list of viewers, the fleet list, and the central audit log.

2.2 This agreement runs for as long as the Customer has a JoyRemote Teams organisation, including its trial, and until the personal data has been deleted or returned under section 11.

3. Nature and purpose of the processing

3.1 Storing, organising, signing and transmitting the data in section 4 so that: members can sign in to the console; computers can be enrolled; enrolled computers receive the Customer's list of viewers, signed by the directory's key; the Customer can see its computers and their state; and the Customer can read and export a log of connections, approvals and file transfers.

3.2 The Processor does not process the contents of sessions. The screen, keyboard and mouse input, clipboard and the contents of transferred files never pass through or are stored on the Processor's servers, except as encrypted relay traffic that the relay cannot read.

4. Types of personal data

• The organisation's name.
• Members' e-mail addresses and roles.
• Enrolment tokens, kept hashed.
• For each enrolled computer: its device public key, number, name, platform and JoyRemote build; its operating system, signed-in user, uptime, free disk space, whether a restart is pending, and whether it is online.
• The Customer's list of viewers.
• The audit log: event name, time, the computer's number, the other party's number and name, and file names and sizes for file transfers.

No special categories of personal data are intended to be processed. File names are chosen by the Customer's users; the Customer should not put special-category data in them.

5. Categories of data subjects

• The Customer's console members: owners and admins.
• People who use the Customer's computers, as signed-in users.
• People who connect to, or are connected to from, the Customer's computers, including the Customer's viewers, as named in the audit log.

6. The Processor's obligations

The Processor will:

• process the personal data only on the Customer's documented instructions, which are this agreement and the Customer's use of the console, unless the law requires otherwise, in which case it will tell the Customer first unless that law forbids it;
• tell the Customer if it believes an instruction breaks the GDPR or other data protection law;
• make sure that everyone it authorises to process the personal data is bound by confidentiality;
• take the security measures in section 8;
• use sub-processors only as section 7 allows;
• assist the Customer as section 10 describes;
• delete or return the personal data as section 11 describes;
• make available the information needed to show it meets Article 28, and allow audits as section 12 describes.

7. Sub-processors

7.1 The Customer authorises the sub-processors listed on the trust page at the date of signing.

7.2 The Processor will give the Customer at least 30 days' notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end its subscription.

7.3 The Processor will bind each sub-processor to data protection obligations no less protective than these, and remains responsible to the Customer for each sub-processor's performance.

8. Security measures

• Sessions are encrypted end to end with TLS 1.3 on a local network and QUIC (TLS 1.3) over the internet; relayed traffic cannot be read by the relay.
• Each computer proves its identity with a device key generated on that computer; the private half never leaves it.
• A computer nobody enrolled cannot be opened to anyone by the directory. An enrolled computer accepts only a viewer list signed by the directory's key.
• The person at the keyboard can block any viewer, and sees an indicator whenever somebody is connected.
• Console sign-in is by a one-time e-mail link valid for 15 minutes; there are no passwords. A sign-in lasts 30 days.
• Enrolment tokens are stored hashed.
• The audit log is kept for 90 days.
• The Customer can switch off the plain-HTTP phone and browser page on its computers.
• The directory and relay are hosted by OVHcloud in the European Union.

The Processor holds no security certification. It will not claim one until it has been audited.

9. Personal data breaches

The Processor will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Customer's personal data. The notice will describe what is known of the breach, the data and data subjects affected, its likely consequences, and the measures taken or proposed, and will be updated as more becomes known.

10. Assistance

Taking into account the nature of the processing and the information available to it, the Processor will assist the Customer in answering requests from data subjects exercising their rights, in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR). Much of this is available to the Customer directly in the console, including the CSV export of the audit log.

11. Deletion or return at the end

When the Customer's organisation ends, the Processor will, at the Customer's choice, return the personal data (the console's exports) or delete it, within [number] days, unless the law requires it to keep a copy. Records of payments are kept by the payment provider and by the Processor as the law requires for business records.

12. Audits

The Processor will answer the Customer's reasonable written questions about its compliance with this agreement. Where those answers are not enough, the Customer, or an auditor bound by confidentiality whom it appoints, may audit the Processor's compliance on reasonable notice, at the Customer's cost, and not more than once a year unless a personal data breach or a supervisory authority requires it.

13. International transfers

The Customer's personal data is stored in the European Union. Where personal data is transferred to, or accessed from, a country outside the European Economic Area that the European Commission has not found to provide adequate protection, including access by the Processor itself, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two, controller to processor, or Module Three, processor to processor, as applicable) apply and are incorporated by reference.

14. Governing law

This agreement is governed by the same law, and heard by the same courts, as the license agreement, except where the GDPR or the Standard Contractual Clauses require otherwise for the part they cover.

15. Signatures

For the Customer: name, title, date.
For Tiny Thoughts LTD: name, title, date.