Draft
Data processing agreement
Last updated 12 November 2026. This document is still being reviewed and may change before hosted sign-up opens.
This agreement is between the organisation that uses hosted Murmura (the "customer") and Dusk Engineering Services Ltd ("we", "us"). It forms part of the terms of service and applies to the personal data in the content the customer's people put into Murmura ("customer data").
For customer data, the customer is the controller and we are its processor, as those words are used in UK data protection law (the UK GDPR and the Data Protection Act 2018). Where the EU GDPR applies to the customer, this agreement applies in the same way under it.
1. The processing
| Item | Details |
|---|---|
| Subject matter and purpose | Providing hosted team chat to the customer: storing, delivering, searching, backing up and exporting what its people post. |
| Duration | For as long as the customer has an organisation on hosted Murmura, and until its data is deleted under section 8. |
| Whose data | The customer's staff, guests and anyone else it invites, and anyone its people mention or write about. |
| Kinds of data | Names, email addresses, profile details, messages, files, notes, call recordings and anything else the customer's people choose to post. We do not ask for special category data, and the customer decides whether to post any. |
2. Instructions
We process customer data only on the customer's documented instructions. Those instructions are the terms of service, this agreement, and what the customer's owners, admins and members do through Murmura (for example posting, sharing, exporting, setting retention and deleting).
If the law requires us to process customer data in another way, we will tell the customer first unless the law forbids it. We will also say so if we think an instruction breaks data protection law.
3. Our people
Anyone working for us who can reach customer data is bound by a duty of confidentiality, and reaches it only when that is needed to run, repair or secure the service, or to deal with a report.
4. Security
We keep customer data secure with measures that include:
- encryption of everything in transit between people's devices and the service;
- a separate database for each workspace, so one organisation's content is not mixed with another's;
- passwords stored only as salted scrypt hashes, two-factor authentication for every account that wants it, and single sign-on through the customer's own identity provider;
- sessions that each person can review and end, and that owners can end for the whole organisation;
- a log of sign-ins and administrative actions, which the customer's owners can read;
- rate limits on sign-in and other sensitive requests;
- servers reached for administration only with keys, behind a firewall, with security updates applied automatically;
- daily backups.
We may change these measures as the service develops, but will not make customer data materially less secure.
5. Sub-processors
The customer agrees that we may use the sub-processors on our sub-processors page. Each is bound by a written contract that protects customer data to at least the standard of this agreement, and we remain responsible for what they do with it.
Before we add or replace a sub-processor we will update that page and tell the customer's owners at least 30 days ahead. If the customer objects on reasonable data protection grounds and we cannot resolve it, the customer may end its agreement with us and we will refund any period already paid for and not used.
6. Helping the customer
- Requests from individuals. Murmura lets each person download their own data and delete their account, and lets owners export and delete the organisation's data. If someone sends us a request about customer data, we will pass it to the customer and not answer it ourselves, unless the law requires us to.
- Assessments. We will give the customer the information it reasonably needs for a data protection impact assessment or to consult a regulator about its use of Murmura.
7. Personal data breaches
If we become aware of a breach of security that leads to customer data being lost, altered, disclosed or accessed without authority, we will tell the customer's owners without undue delay, and in any case within 72 hours of confirming it. We will say what happened, what data is affected as far as we know, and what we are doing about it, and will keep the customer updated as we learn more.
8. Returning and deleting data
The customer's owners can export the organisation's data at any time. When an owner deletes the organisation, or when the agreement ends, we delete its workspaces, messages and files. Backup copies are deleted within 30 days after that. We keep customer data longer only if the law requires it, and will tell the customer if so.
9. Transfers outside the UK
Customer data is stored in the United Kingdom. We will not move it outside the UK unless a lawful safeguard is in place, such as an adequacy decision or the UK International Data Transfer Agreement.
10. Showing that we comply
We will give the customer the information it reasonably needs to check that we are meeting this agreement. Once in any 12 months, on at least 30 days' written notice, the customer or an independent auditor it appoints may audit how we handle its data, during working hours, under a duty of confidentiality and at the customer's cost. The audit must not put other customers' data at risk.
11. General
The limits on liability in the terms of service apply to this agreement. If this agreement and the terms of service say different things about personal data, this agreement wins. It is governed by the law of England and Wales.
Contact
Dusk Engineering Services Ltd, info@duskengineering.services.