# Data processing agreement > **Draft — pending review by a solicitor. Not yet in force.** Last updated: 10 October 2026 The terms under which Fyle processes personal data on behalf of customers, as required by Article 28 of the UK GDPR. It applies automatically to organisations that use Fyle for business, as part of our terms of service. Enterprise customers can sign a copy. ## 1. Parties and scope This agreement is between the customer that accepts our [terms of service](/legal/terms) on behalf of an organisation ("you", the controller) and [Company name] Ltd, registered in England and Wales, company number [number] ("Fyle", the processor). It covers personal data in the content and records of your organisations ("customer personal data") that Fyle processes to provide the service. It does not cover data we control ourselves, such as account, billing and security records, which our [privacy policy](/legal/privacy) describes. Where you are a processor for someone else, Fyle acts as your subprocessor on the same terms. ## 2. Processing on your instructions Fyle processes customer personal data only on your documented instructions, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it). Your instructions are these terms, your configuration of Fyle, and actions taken by your members, devices and the agents they authorise, including agent grants and organisation policies. We will tell you if we believe an instruction breaks data protection law. ## 3. Confidentiality Everyone at Fyle or our subprocessors who can access customer personal data is bound by confidentiality obligations and can access it only as needed to provide, secure or support the service. ## 4. Security Fyle maintains the technical and organisational measures in Annex 2, taking into account the state of the art, cost, and the risks to people's rights. We may improve these measures but won't reduce the overall level of protection. ## 5. Subprocessors You authorise Fyle to use the subprocessors on our [subprocessors page](/legal/subprocessors). We impose data protection terms on each that are at least as protective as this agreement, and we remain responsible for their performance. We will give you at least 30 days' notice before adding or replacing a subprocessor. If you object on reasonable data protection grounds, we will work with you to find a solution; if we can't, you may end the affected service and receive a refund of prepaid fees for the remaining period. ## 6. International transfers Where customer personal data is transferred outside the UK, Fyle ensures the transfer is covered by UK adequacy regulations or appropriate safeguards, such as the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Enterprise customers can restrict a workspace to one region, including UK-only residency using their own storage. ## 7. Helping you meet your obligations - **Data subject requests:** Fyle's admin tools let you find, export and delete data. If we receive a request about your data directly, we pass it to you and don't answer it ourselves unless you ask. - **Impact assessments and consultations:** we provide reasonable information to help with data protection impact assessments and consultation with the ICO. - **Records:** we keep the records of processing required by Article 30(2). ## 8. Personal data breaches Fyle will notify you without undue delay, and within [48] hours, after becoming aware of a personal data breach affecting customer personal data. We will give you the information we have about its nature, the data and people affected, likely consequences and the steps taken, and update you as we learn more. ## 9. Deletion and return at the end When the service ends you can export your data during the read-only period. Fyle then deletes customer personal data on the timeline in our [data retention policy](/legal/data-retention) (deletion 90 days after the subscription ends), unless the law requires us to keep it or an Enterprise contract sets a different timeline. ## 10. Audits Fyle will make available the information needed to show compliance with Article 28, including our security documentation and, once obtained, our certification reports. If that is not enough, you may audit us (or appoint an independent auditor) once a year with 30 days' notice, during business hours and under confidentiality, at your own cost. ## 11. Liability and precedence Each party's liability under this agreement is subject to the limits in the terms of service, except where the law does not allow limits. If this agreement conflicts with the terms of service on data protection, this agreement wins. ## 12. Annex 1: Details of processing - **Subject matter and duration:** Providing Fyle for the length of your subscription, plus the retention period after it ends. - **Nature and purpose:** Storing, versioning, syncing and transmitting files; managing access, reviews and agent sessions; producing version history and audit records; support. - **Types of personal data:** Whatever you put in files and file names; identity and contact details of members; records of who changed what, from which device or agent session; device and session details; audit events. - **Special category data:** Only if you put it in files. You are responsible for having a lawful basis and appropriate safeguards for it. - **Data subjects:** Your members and invitees, and anyone whose personal data appears in your files. ## 13. Annex 2: Security measures - TLS on every connection between devices, Fyle and storage. - File content stored encrypted at rest by the storage provider (Cloudflare R2, or your own bucket). - File bytes move directly between devices and storage using short-lived signed requests scoped to one object and one operation; they don't pass through Fyle's application servers. - Committed versions are immutable and conflicting writes become branches, so content isn't silently overwritten. - Organisation-wide access control by role; agents use scoped, short-lived credentials and go through the same permission checks as people. - Sign-in protections: breach-checked passwords (NIST SP 800-63B), optional or enforced two-factor authentication, session limits and idle timeouts set by organisation policy, rate limiting, device approval for desktop apps. - Version history recording who made each change on every plan; audit logs on Enterprise. - Secrets are kept out of client apps and logs; signed URLs are never logged. ## 14. Annex 3: Subprocessors See the [subprocessors page](/legal/subprocessors). Questions: [privacy@fyle.sh](mailto:privacy@fyle.sh).