Data processing agreement

Effective 22 October 2026 · DeltaBreen Limited (the operator of Share by DeltaBreen), a company registered in Ireland with company number 826627 and VAT number IE4835019QH, of Gorey, Co. Wexford, Ireland · contact@deltabreen.eu · Terms · Refunds · Privacy · Data processing agreement

This data processing agreement ("DPA") forms part of the terms of service for any customer ("Customer") who uses Share by DeltaBreen to process personal data of others in the course of a business, and applies automatically from the moment the Customer does so. It is written to meet Article 28 of the GDPR. DeltaBreen Limited (the operator of Share by DeltaBreen), a company registered in Ireland with company number 826627 and VAT number IE4835019QH, of Gorey, Co. Wexford, Ireland is the "Processor"; the Customer is the "Controller". Enterprise customers may sign a countersigned copy on request.

1. Subject matter, nature and purpose

The Processor provides an encrypted file and secret sharing service. Processing consists of storing, transmitting and deleting data that the Controller and its recipients encrypt in their own browsers, and of holding the associated account, receipt and audit records. For ID checks, it also consists of receiving from the identity provider the result of a check the Controller asked for and locking it to the Controller's workspace key. The purpose is the Controller's sharing of files, its collection of files and answers, its requests for signatures, and its checks of who the people it deals with are, with the people it chooses. Duration: the term of the Controller's account plus the retention periods in the privacy policy.

2. Types of data and data subjects

Content data: files, filenames, secrets and answers, processed only as ciphertext the Processor cannot read; their categories are determined by the Controller and unknown to the Processor. Metadata: email addresses of the Controller's users and recipients, the names and addresses in its contacts, timestamps, sizes, labels chosen by the Controller, coarse browser families, hashed IP addresses and, where the Controller enables it per share, real IP addresses and the country they came from; for a signature request, each signer's IP address and browser, recorded with their signature, and, while a prepared request waits to be sent, the note for its invitations. Identity data, for ID checks only: a person's name, date of birth, nationality, the details of their identity document, how each check went, possible sanctions and politically exposed person matches (which can bear on alleged offences), the address on a proof of address and, where the Controller asks for a copy, pictures of the document and of the person's face; a face compared with a document is biometric data, a special category under Article 9 of the GDPR. This data is not end-to-end encrypted: it reaches the Processor readable, once, from the identity provider, is locked to the Controller's workspace key as soon as it arrives, and is not kept readable. Data subjects: the Controller's staff, its clients and correspondents, anyone the Controller sends to or receives from, the people it asks to sign a document, and the people it asks to confirm who they are.

3. Processor obligations

• Process personal data only on the Controller's documented instructions, which are the use of the service as designed and any written instructions agreed, unless required by EU or Member State law, in which case the Processor informs the Controller before processing unless the law forbids it.
• Not process the personal data for its own purposes, not sell or share it, and not use it to train machine-learning or AI models; process it only to provide the service.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement the technical and organisational measures in section 7.
• Engage sub-processors only under section 6.
• Assist the Controller, by appropriate technical measures and taking account of the nature of the processing, with responding to data subject requests. Because the Processor cannot decrypt content, requests for access, correction or erasure of content are fulfilled by the Controller through the service; the Processor assists with metadata it holds.
• Assist the Controller with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to it.
• At the Controller's choice, delete or return all personal data at the end of the service and delete existing copies, unless EU or Member State law requires storage; deletion of content happens on share expiry, revocation or account deletion, with residual copies removed within 30 days.
• Make available the information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by it, subject to reasonable notice, confidentiality and not more than once a year unless a breach or a supervisory authority requires otherwise, at the Controller's cost, and without access to other customers' data or to the Processor's security secrets; a recognised third-party audit report satisfies this where one exists. The audit export, receipts and this document are the first line of that evidence.
• Inform the Controller immediately if, in its opinion, an instruction infringes the GDPR.

4. Controller obligations

The Controller warrants that it has a lawful basis for the personal data it sends, requests, names and records through the service, including the addresses of the people it sends to and asks to sign and, where it turns address recording on, their IP addresses; that its own privacy notice covers this processing; that it alone decides what categories of data go into content, which the Processor cannot see, and does not rely on the Processor to classify, scan or screen it; and that it manages its links, encryption passwords, access codes and the people in its workspace so that only those it intends can open what it sends and receives. For ID checks, the Controller warrants that it has a lawful basis for checking each person and, for their face, the explicit consent the service collects on its behalf or another condition of Article 9(2) of the GDPR; that it has carried out any data protection impact assessment the checks need; and that it decides itself whether a result meets its own legal duties, such as customer due diligence.

5. Personal data breach

The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information Article 33(3) requires as it becomes available. Because content is ciphertext the Processor cannot read, a breach of stored content does not by itself expose it; the Processor will say what was affected and whether keys or plaintext could have been involved.

6. Sub-processors

The Controller gives general authorisation for the sub-processors below. The Processor will give at least 30 days' notice by email of any addition or replacement; the Controller may object on reasonable data protection grounds within that period, and if no resolution is found the Controller's sole remedy is to stop using the affected feature or terminate the service for the affected processing. The Processor imposes on each sub-processor data protection obligations equivalent to this DPA and remains liable for their performance.

Encrypted files on paid plans are stored with OVHcloud in Germany. The Processor may send new uploads to Cloudflare R2, in EU jurisdiction, instead, for example while OVHcloud is failing; a file stays where it was first stored until it is deleted. The browser of whoever uploads or downloads a file connects directly to that storage provider, which sees the connection's IP address and browser. Encrypted files on the Free plan are stored on servers the Processor operates at Hetzner in the EU, not with OVHcloud or Cloudflare R2. Enterprise customers using their own storage bucket remove OVHcloud and Cloudflare R2 from this list for content data; their storage provider is then their own processor. A service the Controller connects itself (Slack, a mail server, storage or a company login provider of its own, or an AI assistant) is the Controller's own processor, not a sub-processor under this DPA.

7. Technical and organisational measures

• Encryption: content encrypted client-side with AES-256-GCM under per-file keys; keys transported only in links, or sealed to the Controller's X25519 workspace keys, whose private halves only the Controller's authorised users hold, locked in their browsers with their encryption passwords, the Processor storing them only in sealed form; passwords derived with Argon2id in the browser. The Processor holds no content keys, except for request pages the Controller marks readable by the service.
• ID checks: the identity provider's result is read over TLS from its API, never taken from a notification's body; cut down to the fields the Controller needs; locked the moment it arrives with a random key for the check (AES-256-GCM, the check's id bound in) sealed to the Controller's workspace key; pictures kept only where the Controller asks, locked the same way; the identity provider's session, face data included, deleted once the result is locked; the API and assistants see a check's status only.
• Secrets the Processor must hold (credentials the Controller configures, server-readable inbox keys where the Controller opts in) are sealed under a server key stored outside the database.
• Transport: TLS 1.2 or higher everywhere; a strict content security policy so no third-party script runs on the pages that handle keys or content, with the payment page, the bot check and the support page each confined to a page of their own, the support page on an address of its own.
• Access control: single-operator production access over a private network; administrative actions logged; API keys scoped and revocable; per-workspace roles.
• Data minimisation: IP addresses stored as truncated one-way hashes unless the Controller enables recording per share; no analytics or tracking.
• Retention and deletion: expiry-driven deletion with storage lifecycle rules as backstop; retention periods in the privacy policy.
• Resilience: EU hosting, database backups, monitored infrastructure with alerting.
• Location: content stored in EU-jurisdiction object storage; the API and database in the EU.

8. International transfers

Content is stored and processed in the EU. Where a sub-processor listed above processes metadata outside the EEA, the transfer relies on the mechanism named in the table. The Processor will not transfer the Controller's personal data outside the EEA on any other basis without the Controller's written agreement.

9. Liability, term and law

Each party's liability under this DPA is subject to the limits in the terms of service, except that nothing limits liability to data subjects under Article 82 GDPR. This DPA lasts as long as the Processor processes personal data for the Controller and survives termination of the terms for that purpose. It is governed by the law of Ireland.

10. Contact

Data protection questions and breach reports: contact@deltabreen.eu. Supervisory authority for the Processor: the Data Protection Commission, Ireland.