Data Processing Agreement

Last updated: July 15, 2026 · Included on every plan, including Free

This Data Processing Agreement ("DPA") forms part of the FileCollect Terms of Service and applies automatically to every customer whose use of FileCollect involves the processing of personal data subject to the EU General Data Protection Regulation (GDPR). No signature is required; by using the service you and FileCollect agree to this DPA. Countersigned copies are available on request for customers on the Firm plan.

1. Parties and roles

For the purposes of GDPR Article 28: you (the professional using FileCollect to collect documents from your clients) are the data controller. FileCollect is the data processor, processing personal data on your behalf and only on your documented instructions as expressed through your use of the service.

2. Subject matter and duration

The subject matter of the processing is the collection and delivery of documents from your clients to your Google Drive, together with the sending of related transactional emails (invitations, reminders, notifications). Processing lasts for the duration of your account and ends when your account is deleted, subject to the retention periods below.

3. Nature and purpose of processing

• Receiving files uploaded by your clients and transferring them, in transit, to your own Google Drive.
• Temporarily storing files that cannot be delivered immediately, for a maximum of 14 days.
• Storing client contact details (name, email, phone) you provide, to send invitations and reminders on your behalf.
• Recording metadata (file names, sizes, timestamps, checklist status) needed to operate the service.

4. Categories of data and data subjects

Data subjects: your clients and their representatives; you and your team members.

Categories of data: names, email addresses, phone numbers, and the contents of uploaded documents. Uploaded documents may contain sensitive information (for example financial or identity documents); FileCollect does not read, analyse, or index their contents.

5. Our obligations as processor

• Process personal data only to provide the service and on your instructions.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational measures (see Section 8).
• Assist you, insofar as possible, in responding to data-subject requests (access, erasure, portability).
• Notify you without undue delay after becoming aware of a personal data breach affecting your data, and in any case within 48 hours, with the information required by GDPR Article 33(3).
• Delete or return personal data at the end of the service relationship (files are already in your own Drive; temporary copies and metadata are deleted per Section 9).
• Make available the information necessary to demonstrate compliance with Article 28 and allow for audits as described in Section 11.

6. Subprocessors

You provide general authorisation for the following subprocessors. We will notify account owners by email at least 14 days before adding or replacing a subprocessor, giving you the opportunity to object.

Subprocessor	Purpose	Location
Google LLC (Google Drive API)	File delivery to your Drive	EU/US (EU-U.S. Data Privacy Framework)
Google LLC (Google Workspace)	Transactional email delivery	EU/US (EU-U.S. Data Privacy Framework)
Stripe, Inc.	Payment processing (professionals only)	EU/US (SCCs)
Cloudflare, Inc.	CDN, TLS termination, DDoS protection	EU/US (EU-U.S. Data Privacy Framework)
ScalaHosting	Server infrastructure	European Union

7. International transfers

Our servers are located in the European Union. Where a subprocessor processes data outside the EEA (see table above), transfers are safeguarded by the EU-U.S. Data Privacy Framework or Standard Contractual Clauses incorporated in that subprocessor's own data processing terms.

8. Security measures

• TLS 1.2+ encryption for all data in transit.
• Access to production systems restricted to authorised personnel with key-based authentication.
• Files delivered to your Drive are never stored beyond transient processing; undeliverable files are automatically purged after 14 days.
• Upload links are unguessable and can be protected with an access code; uploads are rate-limited.
• See our Security page for the current, complete list of measures.

9. Deletion and return

Collected documents are delivered directly to your own Google Drive; you retain them regardless of your subscription status. On account deletion we remove client contact data and request metadata within 30 days, and any remaining temporary files immediately.

10. Assistance with compliance

Taking into account the nature of the processing, we will assist you with your obligations under GDPR Articles 32 to 36 (security, breach notification, data protection impact assessments), and will inform you if, in our opinion, an instruction infringes the GDPR.

11. Audits

Once per year, on reasonable notice, you may request the information necessary to demonstrate our compliance with this DPA. For customers on the Firm plan we additionally complete vendor security questionnaires and provide countersigned copies of this DPA.

12. Contact

Data protection enquiries: privacy@filecollect.io.