Data processing agreement

Last updated: August 2026

This data processing agreement (DPA) applies when you use PlanDesk to store workspace content (customers, invoices, stock, POS data). You are the controller of that content. LOOKERO HUB S.L. (sociedad unipersonal), Calle Paseo de Gracia 19, Planta Baja, 08007 Barcelona, Spain, NIF B22726335, is the processor.

It forms part of the Terms of service and follows GDPR Article 28 and Spanish LOPDGDD.

1. Subject and duration

We process workspace content only on your documented instructions, to provide PlanDesk, for as long as the account is open, plus Spanish tax retention where the law requires it.

2. Nature of processing

Hosting, storage, display, backup, and transmission of workspace content inside the PlanDesk product (invoicing, POS, inventory, staff, documents).

3. Types of data and data subjects

Data you upload or generate in the workspace, typically identification, contact, billing, tax IDs, and transaction records of your customers, suppliers, and staff. We do not determine the categories. You do.

4. Your instructions

Your instructions are the product configuration, API calls, and written requests to hello@lookero.com. We will tell you if an instruction, in our view, infringes GDPR.

5. Confidentiality and security

Staff who may access workspace content are bound to confidentiality. We apply technical and organisational measures appropriate to the risk: access control, encryption in transit, EU hosting, backups, and logging.

6. Sub-processors

We use sub-processors only to operate PlanDesk: EU hosting and storage, transactional email, payment providers if you subscribe, and Google if you use Google sign-in. We remain responsible for them. A current list is available on request at hello@lookero.com.

7. International transfers

Workspace content is hosted in the European Union. If a transfer outside the EEA is required, we use a GDPR-valid mechanism (adequacy decision or standard contractual clauses).

8. Assistance

We assist you, as far as possible, with data-subject requests, DPIAs, and security incidents that affect your workspace content. We will notify you without undue delay after becoming aware of a personal-data breach affecting that content.

9. Deletion and return

On termination we disable access. Workspace content is deleted or returned according to the Privacy policy, except data we must keep by Spanish or EU law.

10. Audits

You may request information reasonably needed to demonstrate compliance with this DPA. On-site audits are by prior appointment, limited to processing relevant to your workspace, and at your cost unless a material breach is found.

11. Law and venue

Spanish law applies. Professional clients: courts of Barcelona, without prejudice to mandatory consumer venue.

Contact: hello@lookero.com (legal), hello@plandesk.io (support).