Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") is between Filexco, LLC, a limited liability company formed in Florida, United States ("Filexco"), and the customer who accepted the Terms of Service ("Customer"). It is part of the Terms of Service and applies when Filexco processes personal data for the Customer that is covered by the GDPR, the UK GDPR, the Swiss data protection law or the California Consumer Privacy Act (together "Data Protection Law").

It covers the Filexco cloud storage service and the personal data that Customer or its users put into it ("Customer Personal Data"). It does not cover the personal data that Filexco collects for its own purposes, such as account, billing and security records. That is described in the Privacy Policy, and Filexco is the controller of it.

2. Roles

For Customer Personal Data, the Customer is the controller (or the processor, where it acts for someone else) and Filexco is the processor (or sub-processor). Under the CCPA, Filexco is a service provider.

Filexco processes Customer Personal Data only on the Customer's documented instructions: the Terms of Service, this DPA, and what the Customer does in the Service (for example uploading, sharing or deleting files). Filexco tells the Customer if it believes an instruction breaks Data Protection Law. Filexco does not sell Customer Personal Data, and does not use it for its own purposes or for advertising.

The Customer is responsible for having a legal basis for the personal data it puts into the Service and for the content it stores.

3. Processing details

  • Subject matter: storing, transferring and deleting the Customer's files and related information so the Customer can use the Service.
  • Duration: for as long as the Customer has an account, and afterwards as described in "Deletion and return".
  • Nature and purpose: storage, retrieval, transfer, backup of databases, deletion and security monitoring, through the web app, WebDAV and the API.
  • Types of personal data: whatever the Customer chooses to store, such as names and contact details in documents, and file and folder names. In an encrypted vault Filexco cannot read file contents or names. Filexco also sees the Customer's users' account details, network addresses and activity logs.
  • Categories of data subjects: the Customer's own staff, customers, contacts and any other people whose data the Customer stores.
  • Special categories of data: the Customer decides. Filexco does not look for them and cannot read vault contents.

4. Security measures

Filexco keeps technical and organizational measures that fit the risk, including:

  • encryption in transit with TLS 1.2 or newer on every public connection;
  • encryption at rest. Files in Standard folders are encrypted with per-object keys that are wrapped by an account key under a master key kept apart from the data. Vault folders are encrypted in the user's browser, so Filexco only stores encrypted data;
  • passwords stored only as salted hashes of a value made in the browser (Argon2id). Two-factor authentication is required for Filexco staff and available to every user;
  • access keys that can be limited to chosen folders and permissions, can be revoked at once and are stored protected;
  • role-based access for staff, with two-factor authentication, least-privilege database accounts, and an append-only audit log that is checked for tampering;
  • separation of storage, database and web servers, firewalls that open only the ports needed, and a database that is not reachable from the internet;
  • encrypted backups of databases kept in a separate location, and restore tests;
  • logging, monitoring and a process to find, rate and fix vulnerabilities;
  • confidentiality duties for everyone at Filexco who can reach Customer Personal Data.

These measures may change as technology and risks change, but Filexco will not make them weaker overall.

5. Sub-processors

The Customer gives Filexco general authorization to use sub-processors. The current list, with what each one does and where, is on the Sub-processors page. Filexco has a contract with each sub-processor that requires at least the same level of data protection as this DPA, and Filexco is responsible for what its sub-processors do with Customer Personal Data.

Filexco tells the Customer about a new sub-processor or a change at least 30 days before it starts, by email or in the web app. The Customer may object in writing, on reasonable data protection grounds, within that time. Filexco then tries to find a solution; if none is found, the Customer may end the affected service and receive a refund of the prepaid time it did not use.

6. International transfers

Filexco is based in the United States and processes Customer Personal Data in the United States. Files are stored in the region the Customer chooses for each bucket: the United States or the European Union.

When Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland is transferred to Filexco, the parties use the European Commission's Standard Contractual Clauses (Module Two, controller to processor, and Module Three where the Customer is a processor), which are made part of this DPA. For the UK the parties use the UK International Data Transfer Addendum, and for Switzerland the Clauses apply with the changes the Swiss authority requires. The Clauses are governed by the law of Ireland, and their details are those in this DPA: the parties, the processing description, the security measures and the sub-processors.

7. Assistance and audits

Taking into account the nature of the processing, Filexco helps the Customer to answer requests from data subjects (access, correction, deletion, restriction, portability, objection). Filexco passes on any request it receives about Customer Personal Data without undue delay, and does not answer it itself unless the law requires. Many of these actions the Customer can do itself in the web app.

Filexco tells the Customer without undue delay, and within 72 hours, after it becomes aware of a personal data breach affecting Customer Personal Data, with the information it has to help the Customer meet its own duties. Filexco also helps with data protection impact assessments and consultations with authorities where the law requires.

Filexco gives the Customer the information needed to show that Filexco follows this DPA. Once a year, and after a breach, the Customer may audit Filexco (by Filexco's reports and answers, and where that is not enough, by an audit on 30 days' notice, during business hours, at the Customer's cost, without access to other customers' data), under a confidentiality agreement.

8. Deletion and return

The Customer can export its files at any time. When an account ends, because the Customer deletes it or after the grace period described in the Terms of Service, Filexco deletes the Customer Personal Data promptly and in any case within 30 days. Copies in backups are overwritten as the backups expire in the normal cycle.

Filexco keeps what the law requires it to keep (for example billing records) and tells the Customer when that is the case. Until deletion Filexco keeps protecting the data under this DPA.

9. Contact

Filexco, LLC
United States
Data protection questions and requests: [email protected]
Security incidents: [email protected]