Data Processing Agreement

01Background & scope

This Data Processing Agreement (the "DPA") forms part of the Terms of Service between you (the "Customer") and File.Business, Inc. (the "Processor") and applies whenever File.Business processes Customer Personal Data on behalf of Customer. It is intended to satisfy the requirements of Article 28 of the EU GDPR, the UK-GDPR, the Swiss FADP, the CCPA/CPRA service provider provisions, and equivalent laws.

Customers on Growth and Enterprise plans accept this DPA automatically. Starter customers may execute the DPA on request.

02Definitions

Capitalized terms have the meanings given in the GDPR or, where the GDPR is not applicable, in the corresponding local law. "Customer Personal Data" means Personal Data processed by File.Business on Customer's behalf. "Subprocessor" means any third party engaged by File.Business to process Customer Personal Data.

03Roles & responsibilities

Customer is the Controller. File.Business is the Processor. Each party will comply with its respective obligations under Applicable Data Protection Law.

04Processing details

Subject matter: provision of the Services as described in the Terms.

Duration: for as long as Customer has an active account, plus the retention period set in the Privacy Policy.

Nature and purpose: to perform the Services, including formation, compliance, communications, HR, finance, and storage.

Types of data: identifiers, customer records, professional/employment data, financial data, electronic communications, and (where Customer provides) sensitive data.

Categories of data subjects: Customer's employees, contractors, vendors, customers, and end-users.

05Processor obligations

File.Business will:

• Process Customer Personal Data only on documented instructions from Customer, including with regard to transfers to a third country
• Ensure that personnel authorized to process the data have committed to confidentiality
• Take all measures required by Article 32 GDPR (security; see Security Policy)
• Respect Subprocessor conditions (Section 7)
• Assist Customer with data-subject rights requests
• Assist Customer with security incident notification, DPIA, and prior consultation obligations
• Delete or return Customer Personal Data on termination, subject to legal retention requirements
• Make available to Customer all information necessary to demonstrate compliance and allow for audits

06Security incidents

File.Business will notify Customer without undue delay (and in any event within 72 hours of becoming aware) of any Personal Data Breach affecting Customer Personal Data. Notification includes the nature of the breach, categories and approximate number of affected data subjects and records, likely consequences, and measures taken or proposed.

07Subprocessors

Customer authorizes File.Business to engage the Subprocessors listed at subprocessors.html. File.Business will:

• Impose contractual data-protection obligations on each Subprocessor that are no less protective than this DPA
• Remain liable for the acts and omissions of Subprocessors
• Provide at least 30 days' notice of new Subprocessors via the Subprocessor page
• Allow Customer to object to a new Subprocessor in writing within 30 days; the parties will work in good faith to find a resolution, failing which Customer may terminate the affected Services and receive a pro-rata refund

08International transfers

For transfers from the EEA, UK, or Switzerland to countries that do not provide an adequate level of protection, the parties enter into and incorporate by reference the European Commission Standard Contractual Clauses (Module 2: Controller-to-Processor) with the following selections: Clause 7 (docking) optional; Clause 11(a) optional; Clause 17 governing law: Republic of Ireland; Clause 18 forum: courts of Ireland. The UK International Data Transfer Addendum and the Swiss FADP equivalents apply mutatis mutandis to UK and Swiss transfers.

09Audit

Customer has the right to audit File.Business's compliance with this DPA at its own expense, no more than once per year (unless required by a regulator). Audits will be conducted under reasonable notice, during business hours, and subject to confidentiality. File.Business may satisfy the audit obligation by providing its current SOC 2 Type II report, ISO 27001 certificate, or equivalent.

10Return & deletion

At Customer's choice, on termination File.Business will delete or return all Customer Personal Data and delete existing copies, except as required by law. Deletion will be completed within 30 days unless a longer period applies under law.

11Liability

The liability provisions of the Terms of Service apply to this DPA. Nothing in this DPA limits any liability that cannot be limited under Applicable Data Protection Law.