RushFiles A/S – Data Processor Agreement

The Processor provides the RushFiles enterprise file sync and share platform (the “Platform”) under the Main Agreement, either as a hosted service (“SaaS Deployment”) or as software installed and operated by the Controller or its Reseller on its own infrastructure (“On-Premise Deployment”). The processing described in this DPA is carried out solely for the purpose of providing the Platform.

SaaS Deployment. The processing is limited to hosting, storage, transmission, synchronisation, versioning and deletion of the Controller’s files in encrypted form, and of the account and usage data needed to operate the Platform. Files are encrypted at rest with keys specific to each company, and file names and structure are obfuscated on storage. The Processor has no access to the Controller’s administration or user management, no knowledge of the content of files and no ability to decrypt them; the Controller and its users alone determine which data is stored, who may access it and for how long.

On-Premise Deployment. The Controller’s files and user accounts are stored on infrastructure controlled by the Controller or its Reseller and are not processed by the Processor. The Processor processes only (a) user e-mail addresses and domain assignments held by the RushFiles central licensing and single sign-on services for licence validation and login (not in an Isolated Data Island), (b) usage and licence reporting data, (c) personal data incidentally accessed during remote support sessions carried out with consent (Annex 4), and (d) contact details of the Controller’s personnel.

The categories of data subjects and personal data, and the retention periods, are set out in Annex 1.

This DPA applies for as long as the Processor processes personal data on behalf of the Controller under the Main Agreement, and until the deletion in clause 10 has been completed.

The Processor processes personal data only on the Controller’s documented instructions, including with regard to transfers to third countries, unless required to do so by EU or Member State law to which the Processor is subject, in which case the Processor informs the Controller of that legal requirement before processing unless the law prohibits this on important grounds of public interest.

The Main Agreement, this DPA, the configuration made by the Controller or its Reseller in the administration interfaces of the Platform, and support requests submitted through the RushFiles helpdesk constitute the Controller’s documented instructions. Instructions that go beyond the functionality of the Platform require written agreement and may be charged at the Processor’s then-current rates.

The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data protection law, and may suspend execution of the instruction until it is confirmed or amended.

The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, that access is limited to persons who need it to provide the Platform, and that such persons process personal data only on the documented instructions.

The Processor implements the technical and organisational measures described in Annex 3 and otherwise the measures required by Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The Processor may update the measures provided the overall level of security is not reduced.

No backup service. The Controller acknowledges that RushFiles is a file sharing and synchronisation service, not a backup service. The Platform runs on redundant storage, which protects against hardware and disk failure, but the Processor does not keep traditional point-in-time backup copies of the Controller’s files and does not perform backup or restore tests of customer data. The Platform provides file versioning and recovery of deleted files within the retention period configured by the Controller, and these self-service functions are the only means of restoring data. The Controller is responsible, as part of its own Article 32 measures, for maintaining and testing a backup of data it considers critical in a separate system, and may document restores performed through the Platform’s versioning functions as part of its own controls.

The Controller is responsible for the security measures within its own control: administering users and access rights, enforcing multi-factor authentication for its users, configuring retention, sharing and public link policies, protecting administrator credentials, and, in an On-Premise Deployment, the security of the environment in which the Platform runs.

The Controller gives general written authorisation for the Processor to engage the sub-processors listed in Annex 2. The Processor shall notify the Controller by e-mail at least 30 days before engaging a new sub-processor or replacing an existing one, giving the Controller the opportunity to object on reasonable, documented grounds relating to data protection. If the Parties cannot resolve an objection within the notice period, the Controller may terminate the affected part of the Platform with effect from the date the change takes effect, without penalty.

The Processor imposes on each sub-processor, by written contract, the same data protection obligations as set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures, and remains fully liable to the Controller for the performance of the sub-processor’s obligations.

Personal data in a SaaS Deployment is stored in data centres in the EU/EEA. The Processor transfers personal data to a third country or international organisation only on the Controller’s documented instruction or as listed in Annex 2, and only where a valid transfer mechanism under Chapter V GDPR is in place: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, together with any supplementary measures required.

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller’s obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR. Since the Processor cannot access file content or user management, the self-service functions of the Platform (search, export, deletion, audit logs) are the primary means of such assistance; any data subject request received directly by the Processor is forwarded to the Controller without undue delay and not answered by the Processor.

The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR (security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to the Processor. This DPA, Annex 3 and the Processor’s security documentation are intended to provide the information the Controller needs for its impact assessments.

Assistance beyond the self-service functions of the Platform and beyond what the GDPR requires of a processor may be charged at the Processor’s then-current rates, except where the need for assistance results from the Processor’s breach of this DPA.

The Processor notifies the Controller without undue delay, and in any event within 36 hours, after becoming aware of a personal data breach affecting personal data processed on behalf of the Controller, so that the Controller can meet the 72-hour deadline in Article 33 GDPR. The notification describes, to the extent known, the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point. Information may be provided in phases as it becomes available. The Processor documents all personal data breaches.

The Controller notifies the Processor without undue delay of any breach within its own control that may affect the Platform or other customers of the Processor (for example compromised administrator credentials).

The Controller retrieves the personal data it wishes to keep by exporting it through the Platform before the effective date of termination or expiry of the Main Agreement; this constitutes the return of personal data within the meaning of Article 28(3)(g) GDPR. The Platform remains available for that purpose during the notice period.

On the effective date the Processor disables the Controller’s access and deletes all personal data and existing copies processed on behalf of the Controller, including residual copies on redundant storage, within 30 days, unless EU or Member State law requires continued storage. In an On-Premise Deployment the Processor deletes the data it holds in the central services within the same period; the Controller or its Reseller remains responsible for the data on its own infrastructure. The Processor confirms deletion in writing on request.

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR. On written request, and not more than once per year, the Processor provides its current description of technical and organisational measures (Annex 3), the current sub-processor list (Annex 2), a management declaration of compliance with this DPA, and, where held, any ISO 27001 certificate, ISAE 3000 / SOC 2 assurance report or summary of independent penetration testing, under confidentiality. Such documentation satisfies the Controller’s audit right in the normal course.

Where the documentation is manifestly insufficient, a supervisory authority requires it, or a personal data breach affecting the Controller has occurred, the Controller may, on 30 days’ written notice, conduct an audit or inspection itself or through an independent auditor bound by confidentiality and reasonably acceptable to the Processor, during business hours, limited to the processing covered by this DPA and without unreasonable disruption to the Processor’s operations or risk to other customers’ data. Each Party bears its own costs unless the audit reveals a material breach by the Processor, in which case the Processor bears the reasonable costs of the audit.

The Controller acknowledges that documentation of backup and restore testing of customer files is not part of the Processor’s documentation, for the reasons stated in clause 5.2, and that such controls are the Controller’s responsibility.

Each Party is liable for damage caused by processing in breach of the GDPR in accordance with Article 82 GDPR. Between the Parties, liability under this DPA is subject to the limitations and exclusions in the Main Agreement, except that those limitations do not apply to a Party’s liability for administrative fines or damages under data protection law to the extent caused by that Party’s own breach of this DPA.

This DPA is governed by Danish law and disputes are resolved as set out in the Main Agreement. In case of conflict between this DPA and the Main Agreement on matters of personal data, this DPA prevails. The Processor may update Annex 2 in accordance with clause 6.1 and Annex 3 in accordance with clause 5.1; other amendments require written agreement.