Trust & legal
Data processing addendum
This page explains how DeptDrive handles customer data for GDPR-conscious teams. It is a plain-language summary; the executed DPA and current subprocessor list are provided on request. Read the current versioned Data Processing Agreement (v1.0).
1. Parties and roles
The customer is normally the data controller. DeptDrive acts as a data processor when it stores and processes workspace content on the customer's instructions. For account and billing records that DeptDrive controls, DeptDrive acts as an independent controller limited to operating the service.
2. Data we process
Workspace content uploaded by the customer; folder and permission metadata; account and member details; billing identifiers received from the payment provider; support correspondence; and security and audit logs needed to operate and protect the service.
3. Purpose and instructions
We process customer content to provide workspace storage, permissions, downloads, support, security monitoring and service recovery. We do not use customer content for advertising or sell it. Processing outside the documented instructions requires a lawful basis or the customer's instruction.
4. Storage location and subprocessors
Customer content is stored in data centres in Western Europe. We use infrastructure and payment subprocessors under written terms. The current subprocessor list includes their roles, locations and safeguards. We will provide notice of material changes where required by the DPA.
5. Security measures
Measures include least-privilege administration, workspace and department boundaries, short-lived signed download links, access logging, encrypted transport, credential controls and backups. No system is perfectly secure; the DPA describes the agreed technical and organisational measures in more detail.
6. Retention and deletion
Customer content is retained for the subscription term and the documented deletion window. Customers can delete files, folders and workspaces through the product. When a workspace is deleted, its content and records are removed from the active service within the period described in the DPA, subject to backup rotation and legal retention obligations.
7. Data subject rights and assistance
DeptDrive provides product controls and reasonable assistance for access, correction, deletion, restriction and portability requests. The customer is responsible for responding to its own data subjects. Requests can be sent through the contact form.
8. International transfers
The service is designed around Western Europe data residency. If a transfer outside the EEA is required for support or a subprocessor, it will be covered by an appropriate transfer mechanism and described in the DPA.
9. Incident notification
We maintain an incident response process and will notify affected customers without undue delay when a personal data breach is confirmed and notification is required under the DPA or applicable law.
10. Request the DPA
Read the current Data Processing Agreement online. To request a signed copy, use the contact form with your company name, the workspaces covered and any security questionnaire you need completed.