Data processing agreement

When this agreement applies

This data processing agreement (“DPA”) is part of our terms of service. It applies when you use FormatJet for an organisation (“you”) and the files you convert on our servers contain personal data that the GDPR, the UK GDPR or a similar law makes you responsible for. For that data, you’re the controller (or a processor acting for your own client) and we, Taprobane Labs, LLC, are your processor. You accept this DPA by using FormatJet for your organisation.

It doesn’t cover your account, sign-in or billing details, or anonymous usage statistics: we decide how those are used, as our privacy policy explains. Files converted in your browser never reach us, so this DPA doesn’t apply to them.

What we process

• Purpose: converting your files and giving you the results.
• Personal data: whatever your files contain. We don’t look at their contents.
• People: anyone your files are about.
• How long: until the files are deleted. The file you upload is deleted as soon as its conversion finishes. The converted file is deleted 60 minutes after its first download on the free plan (24 hours after the conversion if nobody downloads it), or 24 hours after the conversion on Pro by default, and at once if you choose “Delete now”.

What we commit to

• Your instructions. We process the data only to convert your files as you ask, under our terms and the settings you choose, unless a law we’re subject to requires otherwise; then we tell you first, where that law allows. We tell you if we think an instruction breaks data protection law.
• Confidentiality. Only people bound by confidentiality can reach our systems, and nobody opens your files.
• Security. We keep the measures listed below, and improve them over time without lowering the protection they give.
• Subprocessors. You authorise the subprocessors on our subprocessors page. We email account holders at least 30 days before a new one starts handling your files. If you object for reasons of data protection and we can’t resolve it, you can stop using FormatJet and close your account. Each subprocessor is bound by data protection terms that protect the data at least as well as this DPA, and we remain responsible for its work.
• Requests from people. We help you answer people who exercise their rights over data in your files. Since files are deleted within hours, there’s usually nothing left to find or delete.
• Breaches. We tell you without undue delay after we become aware of a personal data breach affecting your data, with what we know about it, and help you meet your own duty to report it.
• Assessments. We give you the information we have to help with data protection impact assessments and with consulting a supervisory authority.
• Deletion. Files are deleted on the schedule above. If you close your account, we delete what remains within 30 days. We keep no copies.
• Audits. We give you the information needed to show we meet this DPA and answer reasonable security questions. If that isn’t enough, you or an independent auditor bound by confidentiality may audit us once a year, with 30 days’ notice, at your cost.

Security measures

• All traffic uses HTTPS. Uploads go straight to storage through links that expire.
• Files are stored encrypted in Cloudflare R2 under random IDs. File names never appear in storage keys, logs, usage statistics or error reports.
• Each upload is checked by its contents, not its name, before it’s converted; files that fail the check are deleted at once.
• Conversion engines run in isolated containers with no internet access, one folder per conversion, with Office macros turned off.
• Each conversion has its own deletion timer. “Delete now” removes its files at once and gives you a signed deletion receipt.

Transfers outside Europe

We and our subprocessors may process data outside the European Economic Area, the UK and Switzerland, mainly in the United States. Where personal data leaves those places for a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (module two, or module three when you’re a processor) apply between you and us, with the UK’s International Data Transfer Addendum and the changes Swiss law needs, and are part of this DPA. For the clauses, option 2 of clause 9 applies with the notice above, the optional wording of clause 11 doesn’t, clauses 17 and 18 choose the law and courts of Ireland, and the annexes are the sections of this page. If the clauses and this DPA conflict, the clauses win.

Liability and conflicts

Liability under this DPA is subject to the limits in our terms. If this DPA and our terms conflict about personal data, this DPA wins.

Contact

Questions about this DPA or data protection: hello@formatjet.com.