Service Schedule — ImproveDesk

This Service Schedule forms part of the agreement between ITSM Ltd and the Client under our SaaS Terms and Conditions (the Terms). It sets out everything specific to the ImproveDesk Service. Capitalised terms have the meanings given in the Terms. Under clause 2(c) of the Terms, this Schedule prevails over the Terms for the ImproveDesk Service to the extent of any inconsistency.

1. THE SERVICE AND ITS PURPOSE

(a) ImproveDesk is a continual improvement register designed to enable organisations to log, track, prioritise and resolve operational, security and service delivery enhancements in alignment with ISO 27001, ISO 20000 and Service Integration and Management (SIAM) standards, as described on the Website.

(b) For this Service: the Brand is "ImproveDesk"; the Website is https://improve-desk.com/; and the Client's Records are the contents of its register — improvement items, nonconformities, corrective actions, review decisions, comments, anything sent in by email, and the evidence packs built from them.

(c) The Purpose for the AUP is: to provide operational, security and service delivery teams with a single source of truth to capture, prioritise and resolve improvement opportunities.

(d) The legal documents for this Service are published at:

Document	Address
SaaS Terms and Conditions	https://improve-desk.com/legal/terms-and-conditions
This Service Schedule	https://improve-desk.com/legal/service-schedule
Acceptable Use Policy	https://improve-desk.com/legal/acceptable-use-policy
Privacy Policy (with Annex A)	https://improve-desk.com/legal/privacy
Cookie Policy (with Annex A)	https://improve-desk.com/legal/cookies
Website Terms of Use	https://improve-desk.com/legal/terms-of-use

2. SUBSCRIPTION TIERS

(a) The Subscription Tiers for ImproveDesk are the Free, Team, Business and Enterprise tiers, as available from time to time, with the functionality of each set out on the Website.

(b) A Free tier is offered, on the terms of clauses 4(d) and 5.3 of the Terms.

(c) No free trial of a paid tier is currently offered for ImproveDesk. If we introduce one, its terms will be stated on the Website and in this Schedule.

3. SUPPORT

(a) Support for ImproveDesk is provided through a support system operated by ITSM Ltd at support.itsm-ltd.com, which is a separate system from the Service. On set-up of the Client's account, and when the Client later adds Users holding the admin role that carries support access, we create an account in that system for each such User and transfer to it that User's email address. The level and priority of Support is determined by the Client's Subscription Tier from time to time.

(b) The Client acknowledges and agrees that, in relation to that support system:

(i) tickets and their contents are held by us in a separate system operated under this agreement and our Privacy Policy, and are retained for a minimum of 6 years after the Client's organisation is closed;

(ii) removing a User from the Client's account in the Service does not by itself close that User's account in the support system; and

(iii) a User's support account is removed only on the request of an owner or administrator of the Client's organisation, which the Client may make at any time by contacting us.

4. SUSPENSION CARVE-OUT

For the purposes of clause 8.4 of the Terms: during any suspension for non-payment, we will not suspend access to evidence packs the Client has already issued, or to records of nonconformities.

5. HOSTING, DATA LOCATION AND SUB-PROCESSORS

(a) Client Data for ImproveDesk is stored in the United Kingdom (Supabase, London eu-west-2).

(b) The complete list of providers handling personal data for ImproveDesk — including Vercel (whose edge processing for this Service takes place in the EEA), Resend and Cloudflare as our sub-processors, and Stripe, which sells subscriptions as merchant of record and acts as an independent controller rather than as our processor — together with what each receives, where each processes it and the transfer mechanism relied on, is Annex A, section A3 of the Privacy Policy, which is the list for the purposes of clause 11.5 of the Terms.

6. SECURITY, STAFF ACCESS AND MFA

(a) The security measures specific to ImproveDesk are those in Annex A, section A6 of the Privacy Policy, including the append-only, checksum-chained audit trail and private storage for evidence packs.

(b) (Access by our personnel — clause 11.7 of the Terms) Our personnel have no standing access to the contents of the Client's workspaces. Access is possible only where a User of the Client holding an appropriate role grants it, and any such grant: (i) is limited to the period the Client specifies, which may not exceed 72 hours; (ii) is limited to the individual to whom it is given; and (iii) is recorded, and the record is visible to the Client. A grant made under this paragraph is an instruction to us for the purposes of clause 11.3(a) of the Terms.

(c) (Two-step verification — clause 6(b) of the AUP) We require multi-factor authentication for every customer role that can manage the members of an organisation, because those roles can change who has access and what they can do.

7. RECORDS THAT CANNOT BE DELETED ITEM BY ITEM

For the purposes of clause 11.6 of the Terms and clause 7(a) of the AUP, the records in ImproveDesk that cannot be edited or deleted individually — by the Client, by a User, or by us — are: entries in the append-only audit trail; evidence packs that have already been issued (and any copy already downloaded, which is outside our control altogether); a closed nonconformity, which is sealed; and the record of which legal documents each User accepted, and at which version. Annex A, section A5 of the Privacy Policy explains why, in plain terms. These records are deleted only when the Client's organisation is deleted in full.

8. ENDING, DELETING AND WHAT SURVIVES

(a) (Deleting an organisation) Deleting an entire organisation is not something the Client or any User can do from within the Solution. The Client may ask us and we will carry it out. Deletion is performed in two steps separated by a cooling-off period of 24 hours, and we will cancel the request on the Client’s instruction at any time before it is carried out. Deletion is permanent: the organisation, its Client Data and any evidence packs it has issued are all removed, and we cannot recover any of them afterwards. The Client should therefore download anything it wishes to keep before it asks. On the Free tier that means the reports available within the Solution; evidence packs may only be issued on a paid Subscription Tier.

(b) (Issued evidence packs survive cancellation) Cancelling a Subscription does not delete the Client’s organisation. The organisation reverts to the Free tier and continues to operate subject to that tier’s limits. Any evidence pack the Client issued before cancellation remains available to download, on any Subscription Tier including the Free tier and to Users of any role, for as long as the Client’s organisation exists. This does not apply where the organisation is deleted, whether at the Client’s request or because it has been dormant on the Free tier for twelve months following the notices we send beforehand — in which case the organisation, its Client Data and its issued evidence packs are all deleted and cannot be recovered. This paragraph is the retention right referred to in clauses 15.3(a) and 15.4(b) of the Terms and clause 10(c) of the AUP.

9. DATA PROCESSING PARTICULARS (ARTICLE 28(3) UK GDPR)

This section sets out the particulars required by Article 28(3) of the UK GDPR for ImproveDesk. It is the Client's documented instruction to us for the purposes of clause 11.3(a) of the Terms.

9.1. Subject matter

Our provision of the ImproveDesk Service to the Client under the agreement: a continual improvement register in which the Client and its Users record, prioritise, review and resolve improvement items, nonconformities and corrective actions, together with the support, notification and evidence-production functions that go with it.

9.2. Nature of the processing

Collection, recording, organisation, structuring, storage, retrieval, use, transmission by email, production of exports and evidence packs, restriction, erasure and destruction — carried out electronically and, other than where a person at the Client acts through the Service, automatically.

9.3. Purpose of the processing

To provide the Service to the Client in accordance with the agreement, and for no other purpose. We do not process Client Data for our own purposes except as identified in clause 11.1(c) of the Terms and the Privacy Policy, do not use it to train any model, and do not disclose it other than as clause 11 of the Terms permits.

9.4. Duration of the processing

For the Term, and afterwards only as follows:

(a) the audit trail, which is append-only and cannot be altered or deleted entry by entry, is retained for the life of the Client's organisation;

(b) evidence packs already issued are retained for the life of the Client's organisation, and a copy the Client has downloaded is outside our control altogether;

(c) records of which legal documents a User accepted, and at which version, are retained indefinitely as evidence of that acceptance;

(d) support tickets held in ITSM Ltd's support system are retained for a minimum of 6 years after the Client's organisation closes, in accordance with section 3 of this Schedule;

(e) billing records are retained for 6 years to meet accounting and tax obligations; and

(f) where the Client's Subscription is on the Free tier and is dormant, clause 5.3(c) of the Terms applies.

Otherwise we delete or return Personal Data in accordance with clause 11.3(g) of the Terms, after the export window in clause 15.4(a).

9.5. Categories of Personal Data

(a) the account identifiers needed to operate the Client's workspace — the name and business email address by which a User is identified in the Service, and the account identifier recorded against that User's actions;

(b) the contents of the Client's register — improvement items, nonconformities, corrective actions, review decisions, comments and any attachment or free text within them, which may name or describe any individual and may, depending on what the Client records, include special category personal data or data relating to criminal offences (clause 11.2(f) of the Terms);

(c) email sent to a workspace address, including the sender's address, the subject and the full message body;

(d) evidence packs and their contents, including an actor register identifying the people who took the recorded actions;

(e) audit trail entries, which record an account identifier rather than a name or email address; and

(f) submissions made through a public capture link, together with a coarse description of the submitter's browser type but not their IP address.

The Personal Data for which we are controller is not processed under this section. That includes account, sign-in and security data, billing records, the record of which legal documents a User accepted, usage data, and IP addresses handled at sign-up, password reset, waitlist entry or public submission. Those categories, and the purposes they are processed for, are set out in clause 11.1(c) of the Terms and in the Privacy Policy.

9.6. Categories of data subject

(a) the Client's Personnel and Users;

(b) individuals named or described in the contents of the Client's register, who may include the Client's Personnel, its customers' Personnel, its suppliers' Personnel, and members of the public;

(c) individuals who send email to a workspace address or submit through a public capture link; and

(d) the Client's administrators, in respect of the support system described in section 3 of this Schedule.

9.7. Obligations and rights of the Client

The Client's obligations and rights as controller are set out in clause 11 of the Terms, and include: giving documented instructions; ensuring a lawful basis exists for the Personal Data it records, including any condition required under Article 9 or Article 10 of the UK GDPR; responding to requests from data subjects in respect of the contents of its register; and giving the information required by Articles 13 and 14 to the individuals it records.