In this DPA, the following terms have the meanings set out below. Capitalised terms not defined here have the meanings given in the main agreement between the parties.
2.1 The Controller is the data controller and DeptDrive is the data processor in respect of Personal Data processed under this DPA.
2.2 The subject matter, duration, nature and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are set out in Appendix 1.
3.1 Instructions. The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by law. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
3.2 Confidentiality. The Processor shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.3 Security. The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Appendix 2.
3.4 Sub-processors. The Controller grants general authorisation for the Processor to engage Sub-processors. The Processor shall:
3.5 Assistance with Data Subject Rights. Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subject rights under Data Protection Laws.
3.6 Assistance with Compliance. The Processor shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the UK GDPR / EU GDPR, taking into account the nature of processing and the information available to the Processor.
3.7 Data Breach Notification. The Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach. Such notification shall include, where available: (a) a description of the nature of the breach; (b) the categories and approximate number of Data Subjects and records concerned; (c) the likely consequences; and (d) the measures taken or proposed to address the breach. The Processor shall cooperate with the Controller and take reasonable steps to mitigate the effects of the breach.
3.8 Deletion or Return. Upon termination or expiry of the Services, the Processor shall, at the choice of the Controller, delete or return all Personal Data and delete existing copies, unless Union or Member State law requires storage of the Personal Data.
3.9 Audit. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations in this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to reasonable prior notice and confidentiality obligations.
3.10 Electronic acceptance. The Controller may accept this DPA electronically by affirmatively selecting the acceptance control during registration. The Processor records the tenant ID, user ID, DPA version, acceptance timestamp, originating IP address, page URL and user agent. Those records are maintained as evidence that the Controller accepted this version.
4.1 The Processor stores all Customer Content exclusively in Cloudflare's Western Europe (WEUR) infrastructure. The Processor's API infrastructure is located in the United Kingdom.
4.2 Where the European Commission has adopted an adequacy decision for the United Kingdom, transfers of Personal Data from the European Economic Area to the United Kingdom may rely on that decision. Otherwise, the parties will rely on an appropriate transfer mechanism, including the Standard Contractual Clauses, as applicable.
4.3 Where the Processor transfers Personal Data to a Sub-processor located outside the UK or EEA, it shall ensure that appropriate safeguards are in place, including the Standard Contractual Clauses or an adequacy decision, as applicable.
The current Sub-processors engaged by DeptDrive are:
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Cloud infrastructure, object storage and network security | Western Europe (WEUR) | Cloudflare Data Processing Addendum; EU Standard Contractual Clauses and/or an applicable adequacy mechanism |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payment processing and subscription billing | Ireland / USA | Stripe Data Processing Agreement; EU SCCs; EU–U.S. Data Privacy Framework |
5.1 The Processor shall notify the Controller of any intended changes to this list by updating the sub-processor page linked in Clause 3.4 and providing at least thirty (30) days' prior notice.
6.1 Each party's liability under this DPA is subject to the limitations and exclusions set out in the main agreement between the parties.
6.2 The Processor shall be liable to the Controller for the acts and omissions of its Sub-processors in relation to their processing of Personal Data under this DPA.
7.1 This DPA shall remain in force for as long as the Processor processes Personal Data on behalf of the Controller under the main agreement.
7.2 Termination of this DPA shall not relieve the Processor of its obligations under Clause 3.8 (Deletion or Return) in respect of Personal Data already processed.
8.1 This DPA shall be governed by the laws of England and Wales, without prejudice to any mandatory provisions of Data Protection Laws applicable to the Controller.
8.2 Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.
The subject matter of the processing is the provision of DeptDrive's cloud storage services. The duration of the processing is the term of the main agreement between the parties.
The nature of the processing is storage, retrieval, and management of electronic files uploaded by the Controller and its authorised users. The purpose is to provide the Services described in the main agreement.
Personal Data may include, as determined and controlled by the Controller:
The Processor maintains the following measures: