This Data Processing Agreement (“DPA”) forms part of the ScreenSharePRO agreement between FNCONLINE LLP (“Processor”, “we”) and the customer (“Controller”, “you”), and governs our processing of personal data on your behalf. Where there is a conflict on data-protection matters, this DPA prevails. In this DPA, “Data Protection Law” means all data-protection and privacy laws applicable to the processing, including the EU General Data Protection Regulation (2016/679), the UK GDPR and Data Protection Act 2018, and the Digital Personal Data Protection Act, 2023 (India), as applicable.
1. Roles
For personal data we process on your behalf through the services — account users’ data, session audit records for your sessions, and diagnostic logs relating to your devices and users (“Customer Personal Data”, described in Annex I) — you are the Controller and we are the Processor. We act as an independent controller only for limited data we determine the purposes of (e.g., billing, account-security, aggregated technical data), governed by our Privacy Policy. You are responsible for having a lawful basis and all required notices/consents for the personal data you process using the services — including informing, and where required obtaining consent from, individuals using any connected device.
2. Scope and duration
We process Customer Personal Data only to provide, secure, support, and maintain the services, in accordance with this DPA and your documented instructions. The nature, purpose, data subjects, and personal-data types are in Annex I. Processing continues for the term of the agreement and until deletion or return under Section 9.
3. Our obligations
- process Customer Personal Data only on your documented instructions, unless required by law;
- ensure personnel are bound by confidentiality;
- implement the technical and organizational measures in Annex II;
- engage sub-processors only under Section 4;
- assist you, taking into account the nature of processing, with data-subject requests, security, breach notification, and impact assessments;
- delete or return Customer Personal Data under Section 9; and
- make available information to demonstrate compliance with Article 28 GDPR and allow audits (Section 8).
4. Sub-processors
You provide general authorization for us to engage the sub-processors in Annex III. We impose data-protection terms on each that are no less protective than this DPA and remain responsible for them. We will give you at least 30 days’ notice of any addition or replacement (by updating Annex III or notifying your account email), and you may object on reasonable data-protection grounds.
5. Data-subject rights
Taking into account the nature of processing, we will assist you, insofar as possible, to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection). If we receive such a request directly, we will refer the data subject to you unless legally required to act.
6. Personal-data breach
We will notify you without undue delay (and where feasible within 72 hours) after becoming aware of a personal-data breach affecting Customer Personal Data, and provide information reasonably available to help you meet your obligations.
7. Impact assessments
We will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and information available to us.
8. Audits
We will make available information necessary to demonstrate Article 28 compliance and allow for and contribute to audits on reasonable prior notice (at least 30 days), no more than once per year unless required by a supervisory authority or following a breach, during business hours and subject to confidentiality. We may satisfy audit requests with third-party certifications or reports where available.
9. Deletion or return
On termination we will, at your choice, delete or return Customer Personal Data and delete existing copies, unless retention is required by law. We retain Customer Personal Data for as long as your account is active or as needed to provide the services; on account closure or on your written request we will delete or return it and delete existing copies within 30 days, except where a limited retention period is required for security, dispute resolution, or legal compliance. Diagnostic and connection logs are automatically pruned after approximately 30 days. You may request deletion at any time by contacting us at the address below.
10. International transfers
We are established in India, and our hosting sub-processor (Microsoft Azure) may process data in one or more regions. Where processing transfers Customer Personal Data out of the EEA, the United Kingdom, or Switzerland to a country without an adequacy decision (including India), such transfers are governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for United Kingdom transfers, the UK International Data Transfer Addendum, each incorporated into this DPA by reference. The current data-hosting region is available on request at the address below.
11. Liability; governing law
Liability under this DPA is subject to the limitations in the agreement. This DPA is governed by the same law as the agreement, except where Data Protection Law requires otherwise; where any provision conflicts with Data Protection Law, the latter prevails.
Annex I — Description of the processing
Nature & purpose: providing remote screen-sharing / remote-control services; establishing and relaying sessions; authentication; session audit and security; diagnostics, error reporting, and support; maintenance and improvement. Data subjects: your account users/administrators; hosts and viewers; individuals using connected devices; people who contact us.
| Category | Examples | Where | Retention |
|---|---|---|---|
| Account data | email, bcrypt-hashed password, role, stable host ID, token version | Database | Life of the account; deleted within 30 days of closure or on request |
| Session audit records | session IDs/codes, host & viewer IPs, viewer display name, participant/user IDs, connection IDs, client type, start/end times, duration | Database | Life of the account; deleted within 30 days of closure or on request |
| Device / host registry | app host ID, machine name, OS version, app version, last IP, first/last seen | Database | Life of the account; deleted within 30 days of closure or on request |
| Installation logs | machine name, OS/installer version, success/exit code, MSI log text (may include file paths/usernames) | Server files | ~30 days (auto-pruned) |
| Connection / error logs | role, session ID, error/exception text, machine name, OS/app version, recent client log lines | Server files | ~30 days (auto-pruned) |
| Bug reports | error, stack trace, device info, severity, timestamp, submitting user | Database | Retained while needed for support/quality; deletable on request |
| Crash dumps | process memory snapshot (may contain in-memory screen data) | End-user device (uploaded only if the user chooses) | User-controlled |
Session media (screen video, input, clipboard) is transmitted directly between host and viewer over encrypted WebRTC and is not stored by us; where relayed, a TURN provider handles encrypted media and connection metadata (e.g., IPs), not decrypted content. Special-category data is not intentionally collected.
Annex II — Security measures
- In transit: HTTPS/TLS 1.2+ for web/API/signaling (plain HTTP to non-loopback refused); session media end-to-end encrypted via WebRTC DTLS-SRTP; SMTP over SSL/TLS.
- At rest: passwords stored only as bcrypt hashes; relay (TURN) credentials encrypted via the ASP.NET Core Data Protection keyring (persisted encrypted).
- Access control: JWT authentication with a minimum-length signing key; role-based authorization; diagnostic logs, host registry, and relay configuration restricted to administrators.
- Secrets: production secrets supplied via environment/platform settings, not committed or shipped; a build-time guard rejects credentials in shipped configuration.
- Hardening: path-traversal protection on diagnostic file retrieval; core assemblies are obfuscated to hinder reverse engineering; and release installers and binaries are code-signed.
- Minimization: credentials are never logged; diagnostic files are size-limited and auto-pruned after the retention period.
- Organizational: access to production data is limited to authorized personnel on a least-privilege basis; administrative access uses strong authentication; personnel are bound by confidentiality; access is reviewed on onboarding and offboarding; and we maintain an incident-response process for security events.
Annex III — Sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Microsoft (Azure App Service & Azure SQL) | Application hosting and database | All server-side Customer Personal Data | Microsoft Azure (region as provisioned; available on request) |
| GoDaddy (secureserver.net SMTP) | Outbound email | Sender name, email, message content | United States |
| ExpressTurn (or configured TURN provider) | Relaying session media when direct P2P is not possible | Encrypted media, IPs, connection metadata (no decrypted content) | Global (nearest available relay) |
No third-party analytics, advertising, or error-tracking processors are used by the product as shipped.
Contact
Data-protection enquiries: [email protected] — FNCONLINE LLP, #2235, Sector 89, Mohali, Punjab – 140308, India.