Data Processing Addendum

Draft for review. A DPA is a contract. Have a lawyer review this before offering it, and attach the correct transfer mechanism for your regions.

Last updated: [date]

1. When this applies

If you use the service to send files that contain personal data about other people — a client's wedding photographs, a model's contact sheet, footage of identifiable members of the public — then under data protection law you are the controller of that data and we are your processor.

This addendum sets out the terms on which we process it. It forms part of the Terms of Service and applies automatically to business customers. If your organisation requires a signed copy, write to [support email].

2. What we process, on your instructions

Item	Detail
Subject matter	Storing and delivering files you upload
Duration	Until the transfer expires or you delete it
Nature and purpose	Storage, transmission, and deletion at expiry
Types of personal data	Whatever your files contain, plus recipient email addresses if you send by email
Categories of data subject	Whoever appears in or is named in your files — typically your clients and the people they photograph or film
Special category data	Only if you choose to send it; we neither require nor inspect it

3. Our obligations

We will:

• process personal data only on your documented instructions, which for ordinary use means the actions you take in the service, unless the law requires otherwise — in which case we will tell you first, unless that law forbids it;
• make sure the people who can access it are bound by confidentiality;
• apply appropriate technical and organisational measures, as described in section 6;
• not engage a new sub-processor without giving you notice and a chance to object, as set out in section 5;
• help you respond to requests from data subjects, so far as the service allows;
• help you with security, breach notification and impact assessments, taking into account what we know and what you can reasonably expect;
• delete the data at expiry, on deletion, or when your account closes — and confirm that if you ask;
• make available the information needed to show we comply, and allow an audit as described in section 7.

4. Your obligations

You will: have a lawful basis for the data you upload; give the people it concerns the information the law requires; not send special category data, or data about children, unless you have taken the extra steps the law asks for; and set an expiry appropriate to the sensitivity of what you are sending.

5. Sub-processors

You authorise us to use the sub-processors listed on the sub-processors page. We remain responsible for their performance.

We will give at least [30] days' notice before adding or replacing one. If you object on reasonable data protection grounds within that period, we will try to offer an alternative; if we cannot, you may terminate the affected part of the service and receive a pro-rata refund of anything paid for the period after termination.

6. Security measures

• Encryption in transit for every connection.
• Files stored under generated identifiers, never publicly addressable, reachable only through a signed link that expires within minutes.
• Optional password protection on a transfer, checked before any file detail is revealed.
• Automatic, permanent deletion at expiry.
• Passwords hashed with a modern algorithm; provider credentials encrypted at rest.
• Access to production limited to people who need it, and logged.
• Analytics recorded against a one-way hash of the IP address, never the address itself.

7. Audits

On reasonable written notice, and no more than once in any twelve months unless an authority requires otherwise, we will supply the information needed to show we meet this addendum. Where that is not enough, we will cooperate with an audit by you or an independent auditor bound by confidentiality, during business hours, in a way that does not disrupt the service. You bear the cost unless the audit finds material non-compliance.

8. Breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within [72] hours, with what we know: what happened, who is likely affected, the likely consequences, and what we are doing. We will keep you updated as we learn more.

9. International transfers

Where personal data is transferred outside [your region], the transfer is covered by [standard contractual clauses / an adequacy decision / another lawful mechanism], which are incorporated into this addendum by reference. A copy is available on request.

10. Ending

This addendum lasts as long as we process personal data for you. On termination we delete it within [30] days, except where the law requires us to keep a copy, in which case we keep it only for as long as required and keep protecting it.

11. Precedence

If this addendum conflicts with the Terms of Service on a data protection question, this addendum wins.