Privacy policy

Last updated 28 October 2026

About this policy

This policy explains what personal data Desk collects, why, who it is shared with and the choices you have. It covers the Desk website at desk.dinhtech.co.uk, the request portal, the Desk apps for iPhone and Android, and the emails Desk sends.

Desk is run by Dinh Tech Ltd, a company registered in England and Wales (company number 16999255), whose registered office is at 78 Lancaster Way, Northampton, NN4 8LD. “We” and “us” in this policy mean that company.

Your organisation's data and your account

Organisations use Desk to run their help desk, so most of what is in Desk belongs to them: tickets, emails, customer details, files, documents and wiki pages. For that content the organisation is the controller and we are its processor. We only use it to run Desk for them, on their instructions.

If you have contacted a business that uses Desk, for example by emailing its support address or using its request portal, that business decides what happens to your details. Please ask them first; we will help them answer.

For your Desk account itself, how you use Desk, and billing, we are the controller.

What we collect

How we use it

We do not sell personal data, show advertising, or use your data to advertise to you.

Under UK data protection law, we rely on:

AI features

Desk has optional AI features: agents that draft replies and solutions, suggest ticket fields, and draw technical drawings, and suggestions for the name and folder of uploaded documents. Your organisation decides which of these it uses.

When they are used, the content they need is sent to Anthropic, who provides the AI models. That can include the ticket, its emails and attachments, and the documents and wiki pages the agent is allowed to read. Anthropic processes it to produce an answer and, under its commercial terms, does not use it to train its models. A record of each AI run is kept for up to 365 days.

For agent chats, your organisation's agent managers see a report of how each agent is used: how often each person asks, and the questions as the agent read them, without the person's name. The report keeps a question for up to 365 days, or less if your organisation chooses, even if the chat is deleted. The chat itself is the person's alone unless your organisation lets chats be opened: then the people it gives Conversations access on an agent's report can read that agent's chats with the person's name, the chat page says so, and each time one is opened is logged.

Microsoft and Google accounts

Desk only asks for the access each feature needs:

The access tokens for connected mailboxes and calendars are stored encrypted. You can disconnect them in Desk at any time, or remove Desk's access from your Microsoft or Google account settings.

Desk's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only use Gmail and Google Calendar data to provide the Desk features described here. We do not use it for advertising, sell it, or use it to train general-purpose AI models, and people only read it when you or your organisation ask us to, when security or the law requires it, or once it has been made anonymous.

The phone app

Cookies

Desk only uses the cookies it needs to work: ones that keep you signed in and remember which account each browser tab is using. It also keeps some preferences in your browser, such as theme and layout. There are no advertising or analytics cookies and no tracking by other companies.

Who we share it with

Inside an organisation, what you add can be seen by the people that organisation gives access to, and replies to customers are emailed to them. Outside it, we use these providers to run Desk. Each only gets what it needs for its job and is bound by a contract to protect it.

We also share data when the law requires it, to protect someone's safety or our rights, or with a buyer if the Desk business is sold, who would then be bound by this policy.

Desk's servers are in Germany, which UK law recognises as protecting personal data to the same standard as the UK. Some providers also process data in the United States. Those transfers are covered by the UK–US data bridge or by the UK's International Data Transfer Addendum to the EU standard contractual clauses.

How long we keep it

Keeping it safe

Data travels over encrypted connections. Passwords are stored as hashes, mailbox and calendar tokens are encrypted, and who can see what inside Desk follows each organisation's roles and project access. No system is perfectly secure, but if a breach puts your data at risk we will tell you and the Information Commissioner's Office as the law requires.

Your rights

Under UK data protection law you can ask to see the personal data we hold about you, correct it, delete it, limit or object to how we use it, or get a copy to take elsewhere. Email privacy@dinhtech.co.uk and we will reply within a month. If your request is about an organisation's content, we will pass it to that organisation and help them answer.

To delete your Desk account, email us from the address on the account and we will delete it within 30 days. Organisation admins can also remove people from their organisation. What you added to an organisation's tickets stays with that organisation, as part of its records.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office, though we would like the chance to put it right first.

Children

Desk is a tool for businesses and is not meant for children under 16.

Changes to this policy

If we change this policy we will update the date at the top, and for important changes we will tell you by email or in Desk first.

Contact us

Questions about privacy, or a request about your data: privacy@dinhtech.co.uk.