Data processing agreement

Last updated 22 October 2026

1. Parties and scope

This DPA is concluded between:

• the customer that has accepted the terms of service for CloudFile ("Controller", "you"); and
• Swift Apps Jakub Kałamarz, Kielanówka 16e m. 23, 35-106 Kielanówka, Poland, NIP: 5170430587, REGON: 523561765 ("Processor", "we").

It governs the processing of personal data by the Processor on behalf of the Controller when providingCloudFile under the terms of service (the "Agreement"), in line with Art. 28 of Regulation (EU) 2016/679 (the "GDPR"). Terms such as "personal data", "processing", "data subject" and "personal data breach" have the meaning given in the GDPR. If this DPA conflicts with the Agreement, this DPA prevails for the processing of personal data.

This DPA doesn't cover data we process as a controller ourselves, such as your account and billing details; that is described in our privacy policy.

2. Subject matter and duration

The subject matter is the hosting of managed file transfer servers (SFTP, FTPS, FTP and WebDAV), the storage of files transferred to them, and the related notifications, logs and web file manager. Processing lasts for the term of the Agreement and until the data is deleted under section 11.

3. Nature and purpose of processing

We receive, store, transmit, list, retrieve and delete data solely to provide the service you configure: running your servers, storing files in the storage you select, recording file activity, sending the webhooks and email notifications you set up, and supporting you on request.

4. Types of personal data and data subjects

Data subjects: your users and partners who connect to your servers, your team members using the dashboard, recipients of notifications you configure, and any individuals whose data is contained in files you or your users upload.

Types of personal data:

• contents of files uploaded to your servers, which may contain any personal data you or your users choose to store;
• SFTP, FTPS, FTP and WebDAV usernames, public SSH keys and the access rules attached to them;
• IP addresses, timestamps, file paths and file names in connection and file activity logs;
• email addresses and webhook or chat destinations entered for notifications;
• records of changes made by your team in the audit log.

The service is not designed for special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR). If you store such data, you are responsible for assessing whether the measures in Annex II are appropriate.

5. Instructions

We process personal data only on your documented instructions, including with regard to transfers to third countries, unless EU or Member State law requires otherwise; in that case we inform you before processing unless the law prohibits it. The Agreement, this DPA and your configuration of the service (in the dashboard or through the API) are your complete instructions. We will tell you without delay if we believe an instruction infringes data protection law.

6. Confidentiality

We ensure that everyone authorised to process the personal data is bound by confidentiality, whether by contract or by law, and has access only to the extent needed to provide the service or support you.

7. Security of processing

We implement and maintain the technical and organisational measures described in Annex II and on oursecurity page, appropriate to the risk under Art. 32 GDPR. We may update these measures as technology develops, provided the overall level of protection is not reduced.

8. Sub-processors

You give us general authorisation to engage the sub-processors listed in Annex III. We will notify you by email at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period; if we can't address the objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees for it. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for their performance.

Services you connect yourself, such as your own storage bucket, webhook endpoints or chat channels, are engaged by you and are not our sub-processors.

9. Assistance

Taking into account the nature of the processing, we assist you with appropriate technical and organisational measures in responding to data subject requests (access, rectification, erasure, restriction, portability and objection). Most requests can be handled directly in the dashboard or through the API, by finding, downloading or deleting files and users. If a data subject contacts us directly, we forward the request to you without undue delay and don't respond ourselves unless you instruct us to. We also assist you, using the information available to us, with security, breach notification, data protection impact assessments and prior consultations (Art. 32–36 GDPR).

10. Personal data breaches

We notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data. The notice goes to the email address of your organization's owner and describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where information isn't available at once, we provide it in phases. We take reasonable steps to contain the breach and mitigate its effects.

11. Deletion and return

During the Agreement you can download your files at any time over the supported protocols, the web file manager or the API, and delete them yourself. When the Agreement ends, you should download any data you want to keep. Within30 days after termination, or after you ask us in writing, we delete the personal data we hold for you in our managed storage and database, unless EU or Member State law requires us to keep it. When you delete a server, its files in our managed storage are deleted automatically 7 days later; the delay only exists so an accidental deletion can be undone on request.

Database backups that may contain your data are deleted automatically on rotation after 14 days. Files stored in your own bucket remain under your control and are not deleted by us. On request, we confirm deletion in writing.

12. Audits and information

We make available all information necessary to demonstrate compliance with Art. 28 GDPR. Audits start with written documentation: on request we answer reasonable security questionnaires and provide a description of our measures. If that isn't enough, you or an independent auditor bound by confidentiality may carry out an audit, at your cost, no more than once a year (except after a personal data breach or at a supervisory authority's request), with at least 30 days' written notice, during business hours and without disrupting the service or accessing other customers' data. Audits of sub-processors' facilities rely on their own certifications and reports.

13. International transfers

Your files and server data are stored in the EU, at Hetzner in Germany, unless you choose another region or connect your own bucket elsewhere. Where a sub-processor may process personal data outside the EU/EEA, the transfer is covered by an adequacy decision or the European Commission's Standard Contractual Clauses, as listed in Annex III.

14. Liability, term and governing law

Liability under this DPA is subject to the limitations in the Agreement, except where the GDPR provides otherwise. This DPA remains in force as long as we process personal data on your behalf. It is governed by Polish law, and the courts competent for the Processor's registered office have jurisdiction, as in the terms of service. We may update this DPA by giving you at least 30 days' notice by email; changes required by law may apply sooner.

Annex I: Details of processing

Annex II: Technical and organisational measures

A summary; the security page describes these measures in more detail.

• Location: servers, database and managed object storage at Hetzner data centers in Germany.
• Isolation: each server runs in its own container with its own users, ports and admin credentials; each server's files are kept under a separate storage prefix, and each user is confined to their own folder unless given wider access.
• Encryption in transit: SFTP over SSH; FTPS and WebDAV over TLS; the website, dashboard and API over HTTPS only. Unencrypted FTP is off by default and can be enabled by the Controller only.
• Encryption of secrets: storage credentials, server admin secrets and webhook signing secrets encrypted with AES-256-GCM; API keys stored only as SHA-256 hashes; SFTP passwords stored only as salted hashes by the server software, not in our database.
• Access control: organization roles (owner, admin, member), optional TOTP two-factor authentication, minimum password length, per-user permissions and quotas, IP allow and block lists, and automatic blocking of clients after repeated failed logins.
• Internal access: server management interfaces reachable only from a private network and protected by secret tokens; only the hosting ports needed for file transfer and the website are exposed.
• Accountability: audit log of changes made in the dashboard and through the API; file activity logs per server.
• Outbound data: webhooks signed with HMAC-SHA256; webhook and storage endpoints restricted to public HTTPS addresses; download links that expire (one hour in webhooks, five minutes in the web file manager).
• Availability and resilience: daily database backups kept for 14 days, automated health checks with alerting, and a public status page.
• Payments: processed by the merchant of record; card data never reaches the Processor's systems.

Annex III: Sub-processors

Paddle.com Market Ltd (United Kingdom) acts as reseller and merchant of record and processes the account holder's billing data as an independent controller. It has no access to files or server data.

The current list is also published on the security page.