Trust & legal

Privacy Policy

Version 1.0 · Last updated: 27 October 2026

This Privacy Policy explains how DeptDrive ("we", "us", or "our") collects, uses, and shares personal data when you visit our website at www.deptdrive.com or use our cloud storage services (the "Services").

DeptDrive is committed to protecting your privacy. Our core architectural principle is that your files are private, and even our administrators cannot read their contents. This policy explains how that principle applies to the personal data we handle.

1. Our Role: Controller vs. Processor

Under data protection laws (including the UK GDPR and EU GDPR), we act in two distinct roles:

As a Data Controller: When you visit our website, register for an account, or subscribe to a paid plan, we act as the controller of the personal data you provide to us (e.g., your name, email address, and billing details). This Privacy Policy governs how we handle that data.
As a Data Processor: When you upload files and data to your DeptDrive workspace, you (the customer) are the Data Controller, and we are the Data Processor. We process the contents of your files strictly on your documented instructions. Our handling of your file contents is governed by our Data Processing Agreement (DPA), not this Privacy Policy.

2. Personal Data We Collect

We collect personal data in the following ways:

2.1 Information you provide to us

Account Registration: Name, email address, company name, and password (hashed).
Billing Information: Subscription plan details. (Note: Payment card details are collected and processed directly by our payment processor, Stripe. We do not store your full card details on our servers).
Communications: Any information you provide when contacting us for support or inquiries.

2.2 Information we collect automatically

Technical Data: IP address, browser type and version, time zone setting, and operating system.
Usage Data: Information about how you use our website and Services, such as login times, features used, and storage capacity consumed.
Cookies: We use strictly necessary cookies to maintain your session and secure your account. We do not use tracking or advertising cookies. (See Section 8).

3. How and Why We Use Your Personal Data

We use your personal data for the following purposes, relying on the lawful bases specified under GDPR:

To provide the Services (Contract): To create your account, manage your workspace, process payments, and provide customer support.
To secure our platform (Legitimate Interests): To monitor for fraudulent activity, prevent abuse of our systems, and maintain security logs.
To comply with legal obligations (Legal Obligation): To maintain billing records for tax and accounting purposes, and to comply with lawful requests from authorities.
To communicate with you (Contract / Legitimate Interests): To send you service announcements, security alerts, and administrative messages. We will only send marketing communications if you have opted in (Consent).

4. A Note on File Content and Administrator Access

            Administrator Access: As described in our Services, Super Administrators within your workspace can manage folder structures and assign permissions, but they cannot view, download, or preview the contents of your files. DeptDrive personnel also cannot access file contents. We only process metadata (such as file names, sizes, and timestamps) to operate the service.
        

5. How We Share Your Personal Data

We do not sell your personal data. We share data only with third-party "Sub-processors" who help us deliver the Services, under strict contractual obligations:

Cloudflare, Inc.: Provides cloud infrastructure and object storage. Your file data and metadata are stored in Western Europe.
Stripe, Inc.: Handles payment processing, billing, and subscription management.

A full, up-to-date list of our Sub-processors is available on our Subprocessors page. These entities are bound by Data Processing Agreements that include Standard Contractual Clauses (SCCs) where required.

We may also disclose your data if required by law, court order, or to protect the rights, property, or safety of DeptDrive, our customers, or others.

6. International Data Transfers

Our infrastructure is designed to keep your data in Europe.

Your files and data are stored in data centres located in Western Europe (WEUR).
Our API and application infrastructure are located in the United Kingdom.
Where the European Commission has adopted an adequacy decision for the United Kingdom, transfers from the EU/EEA may rely on that decision; otherwise we use an appropriate transfer mechanism.

If we ever need to transfer data outside the UK or EEA (for example, if a Sub-processor processes data in the US), we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

7. Data Retention

We retain your personal data only as long as necessary:

Account Data: Retained while your account is active. If you close your account, we will delete or anonymise your account data within 30 days, except where we need to retain it for legal or tax purposes.
Billing Records: Invoices and transaction records are retained for 6 years to comply with UK tax law.
File Content: As a Data Processor, we handle file content strictly according to your instructions (and the DPA). When you delete files, or when your account is terminated, the files are purged from our active storage systems.

8. Cookies

We use strictly necessary cookies to operate the Services (e.g., to keep you logged in and to protect against cross-site request forgery). We do not use analytical or advertising cookies. Because we only use strictly necessary cookies, we do not display a cookie banner, in accordance with UK PECR guidelines.

9. Your Data Protection Rights

Under data protection law, you have rights regarding the personal data we hold about you as a Controller:

Right of Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can ask us to correct inaccurate data.
Right to Erasure: You can request that we delete your account data, subject to our legal retention obligations.
Right to Restriction and Objection: You can ask us to restrict or stop processing your data.
Right to Data Portability: You can request a machine-readable export of your account data.

If you wish to exercise any of these rights regarding your account data, please use the contact form. We will respond within one month.

Important Note for File Content: If you are an employee or user within a DeptDrive workspace and you wish to exercise your rights regarding personal data contained within uploaded files, you must contact the organisation that owns the workspace (the Data Controller). We cannot access or modify file contents on their behalf.

10. Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk, or with your local data protection authority in the EU.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Services or a prominent notice on our website before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please use the contact form.