Data Processing Agreement (DPA)

The Customer is the controller of the personal data in the files, folders, links and messages it places in upload.am. upload.am (Leads.am) is the processor and processes this data only to provide the service and on the Customer's documented instructions, which are the use of the service features and this agreement.

Subject matter: hosting, transfer, sharing and deletion of the Customer's files and related account data. Duration: for as long as the Customer uses the service, plus the deletion period in section 9. Nature: storage, transmission, access control, backup copies made by the Customer's own settings, and deletion.

Data subjects: the Customer's employees and team members, its clients and other recipients of its links, and anyone whose data the Customer decides to upload. Types of data: whatever the Customer uploads (we do not inspect it), account identifiers (name, email), sharing and access records (IP address, time, device type) and audit-log entries.

We process data only on the Customer's instructions and tell the Customer if we believe an instruction breaches data protection law. Everyone at upload.am with access to the data is bound by confidentiality. We do not use the content of the Customer's files for any purpose of our own.

Encrypted connections; access to files only through unguessable links, passwords, email locks, address restrictions and sessions the Customer controls; hashed passwords; optional two-step sign-in and new-device confirmation; role-based access and folder permissions in Team; an audit log of who did what in the Team; client-side encrypted storage in the Windows app; storage on separate object storage nodes; rate limiting and abuse controls; regular updates. The Customer is responsible for configuring link and Team settings appropriately for its data.

The Customer gives general authorisation for the sub-processors below. Object storage: Internetport (Sweden). Application hosting: Contabo (United States). Card payments: way2bill. Cryptocurrency payments: Shieldz. Bot protection on sign-in forms: Cloudflare Turnstile. We will update this list before adding or replacing a sub-processor that handles Customer files and give Team customers the opportunity to object by contacting us.

We help the Customer answer requests from data subjects and meet its own duties (security, impact assessments, consultation with authorities), taking into account the nature of processing. Much of this is available directly in the service: the Team audit log with CSV export, usage statistics, the ability to delete files and members, and account data export.

We notify the Customer without undue delay after becoming aware of a breach affecting the Customer's data, and in any case within 72 hours, with the information we have about what happened, the data concerned and the measures taken.

The Customer can download or delete its data at any time. When the account is closed or the plan ends, files are removed according to the plan's retention rules and the trash period, after which copies are permanently deleted from storage. On written request we confirm deletion.

On reasonable request we provide the information needed to show compliance with this agreement. Audits by the Customer or an auditor it appoints are possible once a year with reasonable notice, during business hours and under confidentiality, at the Customer's expense.

Where processing involves a transfer of personal data outside the European Economic Area, it takes place under appropriate safeguards required by data protection law. The locations of our sub-processors are listed in section 6.

Liability under this agreement is subject to the limitations in the Terms of Service. The governing law and jurisdiction are those of the Terms of Service.

This agreement applies automatically to business customers using the service. If you need a countersigned copy or have questions, write to us through the contact page.