# Data Processing Agreement The Data Processing Agreement under which Sitedrive Oy processes personal data on behalf of its customers. Language: en Canonical: https://sitedrive.com/dpa ## Data Processing Agreement Data Processing Agreement to the Service Agreement. **Version:** 2026 ## 1\. Background and purpose **1.1.** By this Data Processing Agreement (“**DPA**”), **Sitedrive Oy** (“**Company**”) and the customer subscribing to or purchasing the Company’s services or software licenses (“**Customer**”, together with the Company referred to as the “**Parties**”) set out the terms and conditions for the processing of Personal Data by the Company on behalf of the Customer. **1.2.** This DPA applies to all processing of Personal Data carried out by the Company on behalf of the Customer in connection with the provision of services under the primary agreement governing the purchase or use of the Company’s services or software, whether titled a Service Agreement, Terms of Service, Subscription Agreement, Order Form, or otherwise (“**Agreement**”). **1.3.** When the Company acts as the processor of Personal Data, it will process Personal Data as instructed by the Customer. This DPA shall apply to the extent the Company acts as a processor which processes personal data on behalf of the Customer as part of Company’s provision of services, such as software as a service and as a provider of professional services (together as “**Services**”). **1.4.** Parties shall process personal data (Personal Data) in accordance with all applicable laws relating to protection of personal data, including without limitation the laws implementing EU Directive 2002/58/EC, the EU General Data Protection Regulation (“**GDPR**”) (2016/679/EC) and any amendments thereto (“**Data Protection Legislation**”). Company is not responsible for compliance with any laws or regulations applicable to Customer or Customer’s industry that are not generally applicable to the Company. **1.5.** The subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects shall be set out in more detail in Appendix 1. **1.6.** Any terms not defined in this DPA or the Agreement shall be given the meaning allocated to them in the Data Protection Legislation, and such terms shall be interpreted in accordance with the then prevailing interpretation of the term’s meaning in jurisprudence concerning Data Protection Legislation. **1.7.** In the event of any discrepancy between the content of the body of this DPA and appendices thereto, the Agreement or any of the appendices thereto or the Data Protection Legislation, the following order of precedence shall be applied: 1) Data Protection Legislation; 2) This DPA and any appendices thereto; 3) the Agreement and any appendices thereto. ## 2\. Rights and responsibilities of the Customer **2.1.** The Customer shall: 1. process the personal data in compliance with the Data Protection Legislation and good data processing practice; 2. be responsible for implementing and maintaining privacy protections and security measures for components that Customer provides or controls; 3. ensure that it has all necessary rights and authorisations needed to provide personal data to the Company to be processed by it in relation to the Services; 4. be entitled to give written instructions to the Company concerning the processing of personal data; 5. be liable for the lawfulness and correctness of written instructions; and 6. at all times retain the control and authority to the personal data. ## 3\. Responsibilities of the Company ### 3.1. General principles applying to the processing of personal data The Company must not use the personal data for any other purposes than those specified in the Agreement and this DPA. Taking into account nature of processing and means available to the Company, the Company shall: - process personal data and the Company’s role as a processor of Personal Data in a workmanlike manner and in compliance with applicable Data Protection Legislation; - process the personal data only per the instructions from the Customer, unless required to do so in accordance with applicable laws and regulations to which the Company is subject; - make available to the Customer, in a manner consistent with the functionality of the Company Services and the Company’s role as a processor of personal data of data subjects, the ability to fulfill data subject requests to exercise their rights under the GDPR; however Customer will be responsible for responding to any such data subject’s request(s); - redirect Customer’s data subjects to the Customer, if the Company receives a request from the Customer’s data subject to exercise one or more of its rights under the GDPR in connection with the Services for which the Company is a data processor or sub-processor; - assist as reasonable the Customer in ensuring compliance with its legal obligations, such as, with the Customer’s data security, data protection assessment and prior consulting obligations set out by the Data Protection Legislation; - make available to the Customer all reasonable information necessary to demonstrate compliance with the Company’s obligations set out in this DPA and in the Data Protection Legislation, and contribute to audits, including inspections, conducted by the Customer as set forth in Section 4 of this DPA; and - process personal data only during the term of this DPA and for such period thereafter as is necessary for the activities after termination or expiration of the DPA to be completed (including but not limited to the deletion of personal data). The Company shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The Company shall immediately inform the Customer if, in its opinion, an instruction infringes the Data Protection Legislation or other Union or Member state data protection provisions. The Company has the right to invoice the Customer for these tasks in accordance with the Agreement, if no price has been agreed, in accordance with the Company’s general price list. This DPA shall not prevent Company from disclosing the processed data as required by law, regulation or by competent regulatory authority (in which case Company shall, unless prohibited by law, inform Customer in advance). ### 3.2. Data security With respect to its own processing of personal data, the Company shall implement technical, physical, and organisational measures to ensure security of the personal data processing and to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. The level of security shall be customised so that it corresponds to the risks of varying probability and severity, while taking into account, for example, the nature, extent and context of the processing of personal data. The Company may only correct, delete, amend or block the personal data processed on behalf of the Customer when instructed to do so by the Customer or required by law or regulation. Customer is solely responsible for making an independent determination as to whether the technical and organizational measures for Services meet Customer’s requirements, including any of its security obligations under applicable Data Protection Legislation. Customer acknowledges and agrees that it is solely responsible for the security, integrity, and access controls of its own systems, networks, applications, and data (“Customer Environment”). The Customer shall implement and maintain appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of data within its environment. The Customer assumes full liability for any security incident, data breach, unauthorized access, or compromise occurring within its environment, including but not limited to incidents caused by its personnel, third-party vendors, contractors, or any other entity with access to its systems. The Company shall bear no responsibility for security incidents arising from vulnerabilities, misconfigurations, insufficient security measures, or other failures within the Customer Environment. The Customer shall promptly notify the Company of any security incident that may impact the Services provided under this DPA and shall cooperate in good faith to mitigate any potential harm. If a security incident originates within the Customer’s environment, the Customer shall not make, and shall take all reasonable steps to prevent, any statements, disclosures, or communications—whether public or internal—that could directly or indirectly attribute responsibility for the incident to the Company, unless such attribution is required by applicable law or regulatory authority. If a security incident within the Customer’s environment becomes publicly known and subject to media coverage, regulatory scrutiny, or third-party claims, the Customer shall: 1. Promptly notify the Company of any such risk of publicity 2. Make reasonable efforts to clarify, in public communications, that the Company is not responsible for the incident, and 3. Indemnify and hold harmless the Company from any reputational harm, financial loss, or third-party claims arising from such public disclosure, unless it is proven that the Company was directly and solely responsible for the incident. ### 3.3. Personal data breach notification In the event of a personal data breach, i.e. a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed, the Company shall without undue delay after becoming aware, notify the Customer. If and to the extent such information is available to the Company, the personal data breach notification shall contain at least the following information: 1. a description of the nature of the personal data breach including, the categories and approximate number of data subjects concerned and the categories and approximate number of data records concerned; 2. a description of likely consequences and/or realized consequences of the personal data breach; and 3. a description of the measures taken to address the personal data breach and to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide the information listed above at the same time, the information may be provided in phases. The Company shall take necessary steps to protect the personal data after having become aware of the personal data breach, to the extent such measures are available to the Company. After having notified the Customer, the Company shall, in consultation with the Customer, take reasonable commercial steps to secure the personal data and limit any possible detrimental effect to the data subjects to the extent such measures are available to the Company. The Company will cooperate with the Customer, and with any third parties designated by the Customer, to respond to the personal data breach. The objective of the personal data breach response will be to restore the confidentiality, integrity, and availability of the Services, to take reasonable steps to establish root causes, remediation steps and preserving evidence, and to take reasonable steps to mitigate any damage caused to data subjects or the Customer. The Company’s notification of or response to a personal data breach under this section is not an acknowledgement by the Company of any fault or liability with respect to the incident itself. The Company is not liable for any indirect and/or consequential damages. Customer must notify the Company promptly about any possible misuse of its accounts or authentication credentials or any security incident related to the Services. ### 3.4. Return or destruction of personal data Upon termination of this DPA, or upon the Customer's written request, the Company shall either destroy or return (to the extent such measures are available to the Company taking into account the nature of processing), either to the Customer or to a third party designated by the Customer in writing, all personal data, and delete existing copies unless Union or Member State law requires storage of the personal data. ### 3.5. Transfer of personal data The Company shall not transfer any personal data to any third party or country outside the European Union or the European Economic Area, unless such transfers are made in compliance with applicable data transfer mechanisms under the GDPR, such as EU adequacy decisions, EU-U.S. Data Privacy Framework, Standard Contractual Clauses or Binding Corporate Rules. ### 3.6. Subcontractors The Company is entitled to use subcontractors to provide certain services on its behalf and thus such subcontractors may act as sub-processors. Customer consents to this engagement and to the Company’s affiliates as sub-processors. Additional sub-processors may be added as per the Company’s discretion and subject to Company’s responsibility, provided that the Company shall inform the Customer of any intended changes concerning the addition or replacement of sub-processors at least 14 days in advance, thereby giving the Customer the opportunity to object to such changes on reasonable data protection grounds. The Company is responsible for its subcontractors’ operations and defaults in relation to the Customer. ## 4\. Auditing At any time during the term of the DPA, the Customer and the Company will mutually agree upon the scope, timing, duration, control and evidence requirements for the audit, provided that this requirement to agree will not permit the Company to unreasonably delay performance of the audit. To the extent needed to perform the audit, the Company will make the processing systems, facilities and supporting documentation relevant to the processing of Customer data and personal data by the Company, its Affiliates, and its sub-processors available. The Customer may conduct the audit itself or the parties may agree on an independent third-party auditor with proven experience and procedures. The auditor shall not be a competitor of the Company, and it shall execute a written confidentiality agreement to the Company before conducting the audit. The audit will be conducted during normal office hours at the applicable facility and may not unreasonably interfere with Company’s business activities. In the event of an audit request being made to the Customer directly from a relevant supervisory authority related to the Company’s environment, the Company shall assist the Customer in answering the request and organizing the audit. The Customer shall bear the costs in connection with an audit including the cost of a third-party independent auditor. Notwithstanding the foregoing, if the audit or inspection reveals a material non-compliance by the Company of its obligations under the Data Protection Legislation, the Company shall bear the auditor’s reasonable costs in addition to remedying the default. ## 5\. Liability for damage and limitation of liability Except as otherwise agreed in this DPA: 1. Neither party shall be liable for any indirect or consequential damages arising from this DPA. 2. The Company’s total liability shall be limited to 50% of the payments received from the Customer under the applicable Service Agreement in force at the time of the event giving rise to the damage, calculated based on the six-month period immediately preceding such event. For clarity, if the Agreement falls under a broader framework agreement, the liability cap shall be determined based on the relevant individual Service Agreement, rather than the total payments under the framework agreement. For the sake of clarity administrative fines pursuant to Article 83 of the GDPR shall be borne by the Party to the Agreement named as recipient of such sanctions. ## 6\. Term and termination This DPA shall become effective upon the Customer’s acceptance or execution of the Agreement and shall continue to be in effect until terminated as set forth below. This DPA shall automatically terminate upon any termination or expiration of the Agreement. In case the Company materially breaches of this DPA and fails to remedy the breach within thirty (30) days upon Customer’s written notification, the Customer has the right to terminate this DPA and the Agreement with immediate effect. Those provisions that by their nature are intended to survive termination or expiration of this DPA shall so survive. ## 7\. Applicable law and dispute resolution This DPA shall be construed in accordance with the laws of Finland excluding its choice of law provisions and the UN Convention on Contracts for the International Sale of Goods. Any dispute, controversy or claim arising out of or relating to this DPA, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The arbitration shall take place in Helsinki, Finland, and shall be conducted in Finnish language. ## Appendix 1: Details of processing ### 1\. Nature and purposes of processing personal data The Company will use and otherwise process personal data only as described and subject to the limitations provided below (a) to provide Customer the Services in accordance with Customer’s documented instructions and (b) for business operations incident to providing the Services to Customer. The Company performs the following personal data processing activities: - Editing and/or Changing - Saving - Deleting and destroying - Organizing - Retention - Delivering functional capabilities as licensed, configured, and used by Customer and its users - Keeping the Services up to date - Other processing operations, such as: Processing activities may be, for example, only the examination of personal data of the Company’s personnel for performing support services When providing the Services, the Company will not use or otherwise process personal data for: (a) user profiling and (b) advertising or similar commercial purposes, unless such use or processing is in accordance with Customer’s documented instructions. Customer authorizes the Company: 1. to create aggregated statistical, non-personal data from data containing pseudonymized identifiers (such as usage logs containing unique, pseudonymized identifiers); and 2. to calculate statistics related to any customer data ### 2\. Personal data and categories of data subjects **Data subjects** include the Customer’s representatives and end-users including employees, contractors, collaborators of the Customer. **Personal Data** means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. **Categories of data**: The personal data that is included in e-mail, documents and other data in an electronic form in the context and use of the Services and any other personal data as identified in the Article 4 of the GDPR. ### 3\. Duration of personal data processing The Company may access data for the duration of the Agreement. ### 4\. Sub-processors At the time of execution of this DPA the following sub-processors may be used. Additional sub-processors may be added as per the Company’s discretion and subject to Company’s responsibility. Name of sub-processor Nature and purpose of processing Processing location Google Cloud Platform (Google Cloud EMEA Ltd) Hosting: compute, database, file storage, logging, data warehouse EU: Finland (europe-north1); backups in another EU region Google Cloud Vertex AI (Google Cloud EMEA Ltd) AI features, used only if the Customer switches them on; the minimum extract each feature needs, not used for training EU (EU multi-region) Google Firebase Authentication Sign-in (email address, user identifier, sign-in metadata) Global (incl. US); Google Cloud DPA, EU-US Data Privacy Framework, SCCs Google Firebase Cloud Messaging Push notifications to the mobile apps (device token, notification content), delivered through Apple Push Notification service on iOS Global (incl. US); Google Cloud DPA, EU-US Data Privacy Framework, SCCs Cloudflare DNS, TLS, WAF, DDoS protection, CDN; no storage of request/response contents; limited traffic metadata retained short-term Global edge; EU-only processing available by agreement; Cloudflare DPA, SCCs, EU-US Data Privacy Framework PostHog Product analytics and application error monitoring (pseudonymous user ID, usage events, device and browser type, errors) EU (PostHog EU Cloud) Resend Transactional email: sign-in codes, invitations, notifications EU HubSpot In-app support chat and customer communication US; EU-US Data Privacy Framework, SCCs Production Flow Oy Onboarding and customer success for the accounts it serves Finland The current list of sub-processors is published at [sitedrive.com/subprocessors](https://sitedrive.com/subprocessors).