Data Processing Agreement

This Data Processing Agreement (the "DPA") is entered into between:

• Trembley et Burgermeister SA, Chemin de l'Epinglier 4, 1242 Satigny, Canton of Geneva, Switzerland, business identification number (UID) CHE-101.917.143, which operates Filetable ("Filetable", the "Processor"); and
• the legal entity that accepted the Filetable Terms of Service and holds the workspace (the "Customer", the "Controller").

This DPA is incorporated by reference into the Filetable Terms of Service and takes effect when the Customer accepts those Terms, or on the date the Customer first uses the service, whichever is earlier. No separate signature is required for it to bind both parties.

A signed counterpart is available on request. Write to legal@filetable.com with the legal entity name, registered address and the name of the signatory, and Filetable will return an executed copy. Requesting a counterpart does not delay the DPA taking effect.

This DPA applies only to Customer Personal Data, defined in section 2. It does not govern personal data for which Filetable is itself the controller — the account holder's contact details, billing records, marketing contacts, Filetable's own security logs and, once introduced, product analytics (section 4). That processing is described in the Filetable Privacy Policy.

Filetable has not appointed a Data Protection Officer. Article 10 FADP makes a Swiss data protection advisor optional, and Article 37 GDPR is not triggered at Filetable's current scale: Filetable does not carry out large-scale monitoring of data subjects on its own account, and the special-category data in the service is uploaded by customers under their own instructions rather than processed on a large scale as a core activity of Filetable's own. Data protection questions go to privacy@filetable.com; security matters to security@filetable.com.

This DPA uses the terminology of the GDPR. Each term is to be read as including its equivalent under Swiss law.

• "Controller" means the controller under Article 4(7) GDPR, and the person responsible for the file ("Verantwortlicher" / "responsable du traitement") under Article 5 let. j FADP.
• "Processor" means the processor under Article 4(8) GDPR, and the order processor ("Auftragsbearbeiter" / "sous-traitant") under Article 5 let. k FADP and Article 9 FADP.
• "Personal data", "processing" and "data subject" carry their Article 4 GDPR meanings and the corresponding meanings in Article 5 FADP. Note that the FADP protects only natural persons; where Swiss law is the only applicable regime, data about legal entities falls outside it.
• "Special categories of personal data" means the categories in Article 9(1) GDPR, and "sensitive personal data" ("besonders schützenswerte Personendaten" / "données sensibles") under Article 5 let. c FADP. The Swiss list is wider — it expressly includes data on social assistance measures and on administrative or criminal proceedings and sanctions. Where this DPA says "special categories", read it as covering both lists.
• "Personal data breach" means a breach under Article 4(12) GDPR and a breach of data security under Article 5 let. h FADP.
• "Customer Personal Data" means personal data contained in, or derived from, the documents, tables, rows, cells, emails, files and account records the Customer or its users put into its Filetable workspace, together with the workspace and user identifiers Filetable processes to operate and secure that workspace.
• "Sub-processor" means a third party engaged by Filetable to process Customer Personal Data, and a third party to whom processing is sub-delegated within the meaning of Article 9(3) FADP.
• "Applicable Data Protection Law" means the FADP and its ordinances (in particular the OPDo), the GDPR where it applies to the Customer's processing, and any other data protection law applicable to a party in respect of Customer Personal Data.

Subject matter and duration. Filetable processes Customer Personal Data to provide the Filetable service to the Customer. Processing lasts for the term of the Terms of Service and for the deletion window described in section 10.

Nature and purpose of the processing. Filetable is a document and data platform. Its users upload documents into a drive, and the service reads them with optical character recognition and large language models, extracts structured values into tables the Customer has designed, and stores both the original document and the extracted data. Around that core the service performs: storage and retrieval; folder and virtual-folder organisation; automatic classification and filing; matching and reconciliation between rows and tables; tabular import of CSV and camt.053 ISO 20022 files; splitting a PDF into several documents; generating documents from row data; receiving documents at a per-workspace inbound email address; running saved views and sending alerts and digests; enforcing granular permissions down to a single table, folder, file, row or column; keeping a 30-minute undo window over recent changes; and keeping deleted files and folders in a trash for 30 days so that they can be restored. Filetable also processes Customer Personal Data to secure the service, to bill for it, and to support the Customer.

Automated decision-making. Extraction produces a suggestion. Extracted values are written into the Customer's tables as AI-provenance values that a person can see, correct and overwrite, and the Customer decides what, if anything, follows from them. Filetable therefore does not consider that it carries out automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR. If a Customer builds a workflow in which an extracted value does drive such a decision without human review, that decision is the Customer's, and the Customer is responsible for the Article 22 analysis and for the safeguards Article 22(3) requires.

Types of personal data. The Customer decides what it uploads, so Filetable cannot exhaustively list the categories. Filetable is sold to finance, accounting, HR and back-office teams, and in practice the documents put into it include supplier and customer invoices, payroll files, employment and other contracts, bank statements and camt.053 account files, expense claims, and medical invoices. So Customer Personal Data typically includes identification and contact details, employment and remuneration data, financial account and transaction data, and any other content the Customer chooses to upload — and, in the case of medical invoices and some HR files, data revealing health, which is a special category under Article 9(1) GDPR and sensitive personal data under Article 5 let. c FADP. Filetable also processes account data for the Customer's users (name, email address, workspace role and permissions) and workspace and user identifiers used for security logging.

Categories of data subjects. The Customer's employees, contractors and workspace users; its clients and customers; its suppliers and their staff; and any other individual named in a document the Customer uploads or in data the Customer imports.

Customer warranty on special categories. Filetable does not choose to process special-category data. It processes the documents its Customers upload, which may include such data. The Customer warrants that it has a lawful basis under Article 6 GDPR and a condition under Article 9(2) GDPR — or the corresponding justification under Articles 30 and 31 FADP — for every category of personal data it puts into its workspace, including special categories, and that it has given its data subjects the information Article 13 or 14 GDPR and Article 19 FADP require, including about Filetable as a recipient and about the sub-processors on the Sub-processor List (Annex 2).

Filetable processes Customer Personal Data only on the Customer's documented instructions, including on transfers to a third country. The Customer's documented instructions are:

• the Terms of Service;
• this DPA, including its annexes;
• the Customer's configuration and use of the service — every table the Customer creates, every column and extraction prompt it defines, every permission it grants, every automation, alert or document generator it turns on, and every file it or its users upload or email in. Using a feature is an instruction to perform the processing that feature performs;
• support requests the Customer submits, and any further written instruction the parties agree.

Filetable processes Customer Personal Data for no other purpose. In particular, Customer documents and the data extracted from them are never used to train or fine-tune any machine learning model, whether Filetable's or a sub-processor's: Filetable engages an AI provider only under a contract that prohibits it from using Customer Personal Data to train or improve its models.

Product analytics. Filetable plans to introduce product analytics; it is not active. Once enabled, it will be Filetable's own processing as controller, on the basis of its legitimate interest in understanding how the service is used and improving it. It is not processing on the Customer's behalf, is not part of the Customer's instructions under this section and falls outside this DPA. It will be captured server-side only, using pseudonymous user and workspace identifiers, and will not include document content, file names or email addresses. There is no session recording of the application. More generally, Filetable's internal logging rules prohibit logging document content, model prompts and responses, file or folder names, and email addresses, and require identifiers instead. Operational monitoring runs on infrastructure operated by Filetable and does not involve a third-party provider.

Instructions that infringe. If Filetable considers that an instruction infringes Applicable Data Protection Law, it will inform the Customer without undue delay and may suspend that part of the processing until the instruction is withdrawn, confirmed or amended. Filetable is not obliged to carry out a legal review of the Customer's instructions.

Legally required processing. If Union, Member State or Swiss law requires Filetable to process Customer Personal Data other than on the Customer's instructions, Filetable will inform the Customer of that legal requirement before processing, unless the law prohibits that information on important grounds of public interest. Filetable will not disclose Customer Personal Data to a public authority unless a binding, lawful and enforceable order compels it; it will challenge an order that is manifestly unlawful or overbroad; and it will disclose only the minimum the order requires.

Filetable ensures that every person authorised to process Customer Personal Data — employees, contractors and directors — has committed to confidentiality in writing, in their employment or engagement contract, or is under an appropriate statutory obligation of confidentiality. That commitment survives the end of their engagement.

Access is granted on a need-to-know basis and is reviewed when a person's role changes and removed when their engagement ends. Personnel receive data protection and security instruction appropriate to their role, and are instructed that Customer documents may be accessed only where a support task requires it.

Support access to a Customer workspace requires specific authorisation. An access session must be opened; it is recorded as a security event with the staff member's identity, and every action taken during it is recorded and attributed to that session. These records are retained for 24 months.

Filetable is also bound by any statutory or contractual duty of confidentiality that applies to the Customer's data and that the Customer has notified to Filetable, as Article 9(2) FADP requires. The Customer should tell Filetable, before uploading, if its data is subject to a professional secrecy regime — for example medical or legal professional secrecy — because that may require additional arrangements, and in some cases may make the delegation unlawful without a specific release.

Filetable implements the technical and organisational measures set out in Annex 3, which are designed to meet Article 32 GDPR and Article 8 FADP together with Articles 1 to 6 OPDo. Annex 3 describes these measures, including per-file AES-256-GCM encryption keys, client-side encryption of browser uploads, TLS 1.2 or 1.3 in transit, certificate-verified TLS to the database, encrypted database backups held in the same Swiss region, zone-redundant storage of documents within the Zurich region, role-based access control combined with granular per-object permissions, and permission-gated, fully logged support access.

Filetable may update those measures over time. It will not make a change that materially reduces the overall level of security of the service. Where a measure is replaced, the replacement will be at least equivalent.

Filetable does not currently hold SOC 2 or ISO/IEC 27001 certification and intends to pursue certification as the company grows. Filetable maintains a security questionnaire and supporting documentation that it will complete for a Customer under section 11, and it will tell the Customer if and when it obtains a certification.

The Customer is responsible for the security decisions the product puts in its hands: who it invites to its workspace, what role and what per-object permissions it grants them, which senders it allows to post to its inbound email address, whether it enables document generation and alerting, and how it protects its users' credentials. The effectiveness of the permission model depends on the Customer's configuration.

General written authorisation. The Customer gives Filetable general written authorisation to engage the sub-processors on the Sub-processor List published at /legal/subprocessors (the "List"), which forms Annex 2 of this DPA as updated under this section. Article 9(3) FADP requires the controller's prior approval for sub-delegation and permits that approval to be general, provided the processor informs the controller of intended changes; Article 28(2) GDPR is to the same effect. This section is that general prior approval.

The List. For each sub-processor, the List states its legal entity, its role, the countries where it may process Customer Personal Data and the transfer safeguard relied on. The Customer approves the sub-processors on the List at the effective date of this DPA by accepting it. Every change to the List is dated and recorded in the List's change history.

AI providers. Filetable uses one or more of the AI providers on the List to recognise text, to extract, classify and match data, and to compute representations used for search. Filetable chooses the provider and the model for each task, may route any task to any AI provider on the List, and may change these choices at any time without notice, provided the provider remains on the List and bound by obligations no less protective than this DPA. How Filetable distributes processing among sub-processors already on the List is neither an addition nor a replacement under this section. The List does not state which provider performs which task; Filetable provides that information on a confidential basis where it is needed for an audit under section 11 or requested by a supervisory authority.

Notice of changes. Before Filetable adds a sub-processor or replaces an existing one, it will give the Customer at least 30 days' prior notice, by email to the workspace's administrative contacts and by a dated update of the List. The notice will name the sub-processor, its role, the countries where it may process Customer Personal Data and its legal entity.

Right to object. The Customer may object to a new sub-processor on reasonable data protection grounds by writing to privacy@filetable.com within the 30-day notice period, stating those grounds. The parties will discuss the objection in good faith. Filetable will try to make a change that addresses it — for example by keeping the affected processing on an existing sub-processor, or by offering a configuration in which the new sub-processor is not used. If no reasonable solution is available within 30 days of the objection, the Customer may terminate the affected service on written notice, with a pro-rata refund of prepaid fees for the unused remainder of the term. That is the Customer's exclusive remedy for an objection.

Emergency replacement. If a sub-processor must be replaced urgently for security, legal or availability reasons, Filetable may do so immediately and will notify the Customer as soon as possible afterwards. The right to object then applies from the date of that notice.

Terms and liability. Filetable enters a written contract with each sub-processor imposing data protection obligations that are, in substance, no less protective than those in this DPA, and in particular the obligations under Article 28(3) GDPR to the extent they are relevant to the sub-processor's role. Each contract with an AI provider prohibits it from using Customer Personal Data to train or improve its models. Filetable remains fully liable to the Customer for the performance of each sub-processor's obligations.

Stripe. For customers outside Switzerland, payments run through Stripe Managed Payments, where Stripe is the merchant of record — Stripe is the seller and handles indirect tax. For Swiss customers, Filetable is the seller and Stripe acts as a payment processor. In both arrangements the personal data concerned is billing and payment data for which Filetable, or Stripe, acts as controller — not Customer Personal Data under this DPA. Stripe is on the List for completeness; it does not process the Customer's documents.

Data subject requests about Customer Personal Data go to the Customer, as controller. If a data subject contacts Filetable directly with a request that concerns a Customer's workspace, Filetable will not answer it on the merits. It will tell the data subject to contact the Customer, and where it can identify the workspace concerned it will inform the Customer without undue delay.

Self-service comes first. Most requests about workspace content can be answered by the Customer itself, without involving Filetable, using the tools already in the product:

• Access and portability. Table data can be exported from any view, and original files can be downloaded from the drive. A copy of a user's own account data — profile, workspace memberships and activity history — is provided on request to privacy@filetable.com, as a structured, commonly used, machine-readable file: the Article 15(3) copy and the Article 20 portable format, and the corresponding rights under Articles 25 and 28 FADP.
• Rectification. Any cell, row or document can be corrected in the product by a user with permission to edit it — Article 16 GDPR, Article 32(1) FADP.
• Erasure. Deleting a row or table removes it from the workspace. A deleted file or folder goes to the workspace's trash and is permanently deleted after 30 days, or earlier when a user deletes it permanently from the trash (section 10). A user's account is deleted on request to privacy@filetable.com; the deletion is irreversible. Erasure of an account is implemented as anonymisation: the name and email address are destroyed, and a peppered digest of the email address is retained so that a suppression list can work without keeping the address itself.
• Restriction and objection. Access to a table, folder, file, row or column can be restricted through the granular permission model, and processing of a document can be stopped by removing it.

Where self-service is not enough, Filetable will provide reasonable assistance by appropriate technical and organisational measures, taking into account the nature of the processing and the information available to it, so that the Customer can meet its obligations under Chapter III GDPR and Articles 25 to 28 and 32 FADP. The Customer should send such requests to privacy@filetable.com identifying the workspace and, where it can, the records concerned. Filetable will respond within a period that leaves the Customer time to meet its own statutory deadline, and in any event within 10 working days of a complete request.

Assistance that goes beyond what the product's own tools can do, and beyond what is reasonably proportionate, may be charged at Filetable's then-current professional services rates, notified in advance.

Filetable assists the Customer in complying with Articles 32 to 36 GDPR, and with Articles 8, 22, 23 and 24 FADP, taking into account the nature of the processing and the information available to it.

Breach notification. If Filetable becomes aware of a personal data breach affecting Customer Personal Data, it will notify the Customer without undue delay. This reflects the processor's obligation under Article 33(2) GDPR. The 72-hour deadline in Article 33(1) GDPR applies to the Customer as controller; Filetable will provide the Customer with the information it needs in time to meet it.

A notification will describe, as far as known at the time: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to mitigate its effects; and a contact point for further information. Filetable will supplement the notification as its investigation progresses rather than delaying the first notice until everything is known. Filetable will not notify a supervisory authority or affected data subjects about a breach on the Customer's behalf unless the Customer instructs it to.

The Swiss position. Under Article 24 FADP, a Swiss controller must notify the FDPIC "as soon as possible" of a breach of data security likely to result in a high risk to the personality or fundamental rights of the data subject. That is a different threshold and a different formulation from the GDPR's — a high-risk threshold rather than a risk threshold, and no fixed deadline. Where Filetable acts as processor for a Swiss controller, Article 24(3) FADP requires it to report a breach to the controller as soon as possible; it will do so under the same "without undue delay" standard set out above, and the Customer decides whether the FDPIC threshold is met.

Impact assessments and prior consultation. On request, Filetable will provide the information reasonably available to it to help the Customer carry out a data protection impact assessment under Article 35 GDPR or Article 22 FADP, and to conduct any prior consultation under Article 36 GDPR or Article 23 FADP. Annex 1, Annex 2 and Annex 3 of this DPA are designed to supply most of what such an assessment needs.

Records. Filetable maintains a record of the categories of processing it carries out on behalf of controllers, as Article 30(2) GDPR and Article 12(2) let. b FADP require. Filetable does not rely on the exemption for small and medium-sized enterprises in Article 24 OPDo, as its processing may involve sensitive personal data on a large scale. An extract of the record relevant to the Customer is available under section 11.

At the Customer's choice, Filetable will delete or return Customer Personal Data at the end of the provision of services, and delete existing copies, unless law requires it to be kept.

Return. The Customer can export its data itself at any time while it has access to its workspace: per-view table exports, and download of the original files from the drive. A user's account data is provided on request (section 8). Cancelling a paid plan does not end that access: at the end of the billing period the workspace moves to the free Basic plan, and its content remains available until the Customer deletes it. Filetable will also, on written request made before the Customer Personal Data is deleted, produce a bulk export of a workspace's documents and table data in a commonly used, machine-readable format; work beyond a straightforward export may be charged at Filetable's professional services rates, agreed in advance.

Deletion. Unless the Customer asks for return, Filetable removes Customer Personal Data from live systems within 30 days of the end of the contract, of the Customer's request, or of the Customer deleting its workspace.

During the term, files, folders and virtual folders deleted from the drive are moved to the workspace's trash, where they can be restored for 30 days. They are permanently deleted when that period ends, or earlier when a user deletes them permanently or empties the trash. Permanent deletion removes the files, the folders and their placements from the workspace. The rows extracted from a deleted file remain in their tables unless the user chooses to delete them when deleting the file permanently, and the workspace's upload and inbound history keeps a record of each arrival, with the name under which the file arrived, marked as deleted. Deleting a row or a table is applied to live systems immediately, subject to the 30-minute undo window on recent changes. A workspace's trash is deleted with the workspace.

Backups. The application database is backed up by the managed database service of Filetable's hosting provider. Its backups are kept for 35 days in the same region and are not edited item by item, so data deleted from the database remains in them until they expire. Documents are not backed up: they are held in zone-redundant storage across three availability zones of the Zurich region, and the content of a file deleted or replaced in storage remains recoverable through the storage service's soft-delete function for 7 days. Filetable does not restore deleted Customer Personal Data into live systems except as part of a disaster-recovery restore, and if such a restore reinstates data that was deleted, Filetable re-applies the deletion before the data is used.

What Filetable keeps, and why. Two narrow categories survive deletion:

• Accounting and billing records, for 10 years, because Article 958f of the Swiss Code of Obligations requires books, accounting vouchers and the annual report to be kept for ten years. This covers invoices, subscription and usage records and payment events — not the Customer's uploaded documents.
• Records that data protection law itself requires be kept. Security and audit events are retained for 12 months, which meets the minimum of one year required by Article 4 OPDo. Records proving that a data subject request was received and honoured are retained for 10 years under the accountability principle in Article 5(2) GDPR. Records of AI-assisted processing are retained for at least 6 months, which is the floor in Article 26(6) of the EU AI Act.

These retained records are identifier-based, not content-based: they hold workspace, user and object identifiers, not document content. Filetable continues to protect them under this DPA and processes them for no purpose other than the one that justifies keeping them.

Other retention periods: raw infrastructure logs that may contain IP addresses are kept 30 days; workflow execution history 3 days; extraction working state 60 minutes after a run completes; undo snapshots 30 minutes (up to 24 hours while a playbook is left unfinished); deleted files and folders 30 days in the trash; parked tabular-import drafts 14 days; generated exports 24 hours; the model's raw answers, kept for troubleshooting, 30 days or until the document is deleted; and inbound email that the system refused or failed to process 90 days. Email the system accepted is the Customer's data and lives for as long as the Customer keeps it.

Filetable makes available to the Customer all information necessary to demonstrate compliance with the obligations in Article 28 GDPR and Article 9 FADP, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

Filetable does not currently hold a SOC 2 or ISO/IEC 27001 report. It meets this obligation as follows:

• Documentation. On request, Filetable provides its security documentation: the measures in Annex 3 in operational detail, its architecture and data-flow description, its sub-processor list and the relevant extract of its Article 30(2) record of processing.
• Written questionnaire. Filetable will complete the Customer's own security and data protection questionnaire once per twelve-month period, within 30 days of receiving it, and will answer reasonable follow-up questions on its answers.
• On-site or remote inspection. If the documentation and the questionnaire do not answer the Customer's question, the Customer may audit Filetable's premises and systems, on at least 30 days' written notice, during business hours, in a way that does not disrupt Filetable's operations or the confidentiality of other customers' data. An audit takes place no more than once in any twelve-month period, and is at the Customer's cost. Both limits fall away where the Customer has a reasonable and specific basis for believing that Filetable is in breach of this DPA, or following a personal data breach affecting the Customer's data, or where a supervisory authority requires an audit.

An auditor must be independent of Filetable's competitors, must sign a confidentiality undertaking on reasonable terms before starting, and may not access another customer's data, Filetable's own commercial information, or credentials. Filetable will remediate a confirmed material finding at its own cost and within a reasonable period agreed with the Customer.

Nothing in this section limits a supervisory authority's own powers, or the Customer's obligation to cooperate with one.

Storage in Switzerland. Customer documents and the application database, with its backups, are stored in Switzerland, on Microsoft Azure (Zurich region); documents are replicated across three availability zones of that region. Transactional email is sent from Switzerland (Zurich region).

Processing by sub-processors. Customer Personal Data may otherwise be processed by the sub-processors on the List (Annex 2), in the countries stated there for each: Switzerland, the EU/EEA, the United States and other countries where they operate. Filetable currently prefers processing in Europe where a provider offers it; this describes Filetable's practice and is not a commitment as to the location of processing.

Address completion. The text a user enters in an address field and, during extraction, the addresses read from documents into address columns are sent from Filetable's servers to the address-completion provider on the List, unless automatic completion is switched off for the column concerned. The name printed with an extracted address is left out of the request when the extraction has identified it as the addressee; otherwise it may be part of the address sent. This data may be processed outside the EEA, including in the United States.

Support correspondence — messages the Customer's users send to Filetable's email addresses, with their attachments — is hosted by Filetable's email provider on the List, whose infrastructure may include locations outside the EEA, including the United States.

For Swiss controllers. Transfers from Switzerland to the EEA require no additional safeguards, as the EEA states are listed by the Federal Council as providing adequate data protection under Article 16(1) FADP and Annex 1 of the Data Protection Ordinance (OPDo).

For EU and EEA controllers. Storage and the database are located in Switzerland, which benefits from an adequacy decision of the European Commission, most recently confirmed on 15 January 2024. Transfers from the EEA to Filetable in Switzerland therefore require no additional safeguards.

Onward transfers. Where a sub-processor may process Customer Personal Data outside Switzerland and the EEA, or where its parent company is established in the United States, Filetable relies on the Swiss–U.S. and EU–U.S. Data Privacy Frameworks for certified recipients and, otherwise, on the sub-processor's transfer mechanism under Article 46 GDPR and Article 16(2) FADP, generally the European Commission's Standard Contractual Clauses with the adaptations recognised by the FDPIC for transfers from Switzerland. The List states the safeguard relied on for each sub-processor; Filetable provides the relevant mechanism on request.

Standard Contractual Clauses on request. Where the Customer's own assessment requires Standard Contractual Clauses to be executed between the Customer and Filetable, Filetable will enter into the 2021 Standard Contractual Clauses (Module Two or Module Three, as applicable) on request. They prevail over this DPA in the event of conflict.

EU representative. Filetable will appoint a representative under Article 27 GDPR before offering its services to customers established in the EU, and will publish the representative's contact details in its Privacy Policy and in this DPA.

Order of precedence. If there is a conflict between documents, the following order applies, highest first: (1) any Standard Contractual Clauses executed between the parties; (2) this DPA; (3) the Terms of Service; (4) any other document referenced by them. This DPA prevails over the Terms of Service on any question of data protection.

Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, and the two documents together are treated as one agreement for the purpose of any liability cap. Nothing in this DPA limits either party's liability where the law does not permit it to be limited — in particular, nothing in this DPA affects a data subject's rights under Article 82 GDPR or Article 32(2) FADP, or either party's liability to a supervisory authority.

Changes to this DPA. Filetable may amend this DPA where an amendment is required by a change in Applicable Data Protection Law, by a supervisory authority or court decision, or by a change in the service that affects the processing. Filetable will give at least 30 days' prior notice of a material amendment. If the amendment materially reduces the Customer's protection under this DPA and the Customer objects in writing within that period, the parties will discuss it in good faith, and failing agreement the Customer may terminate the affected subscription with a refund of prepaid fees for the unused remainder of the term. Changes to the sub-processor list are governed by section 7, not by this section.

Survival. Sections 5, 9, 10, 11 and 13 survive termination of the Terms of Service for as long as Filetable holds any Customer Personal Data.

Governing law and jurisdiction. This DPA is governed by Swiss substantive law, excluding its conflict-of-law rules and the Vienna Convention on Contracts for the International Sale of Goods. The courts of Geneva, Switzerland have exclusive jurisdiction, subject to any mandatory place of jurisdiction that applicable law confers on a party. Where the GDPR applies to the Customer's processing, this choice of law does not deprive any data subject of the protection of the mandatory rules of the law that would otherwise apply.

This annex is the processing description Article 28(3) GDPR requires the DPA to contain, and it is also the description Filetable supplies to help a Customer complete its own Article 30(1) record and any impact assessment under Article 35 GDPR or Article 22 FADP.

Annex 2 is the Sub-processor List published at /legal/subprocessors, as updated under section 7. For each sub-processor it states the legal entity, its role, the countries where it may process Customer Personal Data and the transfer safeguard relied on, and it keeps a dated history of its changes. Filetable provides a copy of the List as it stood on any date on request to privacy@filetable.com.

Stripe does not process Customer documents or extracted data. It processes billing and payment data, and under Stripe Managed Payments (used for customers outside Switzerland) acts as merchant of record and as a separate controller.

Filetable's email provider is on the List because support requests, which may contain Customer Personal Data, reach Filetable by email (sections 3 and 4).

Filetable's operational monitoring runs on infrastructure operated by Filetable and does not involve a third-party provider.

Filetable implements the following technical and organisational measures.

Encryption of customer documents. Every file gets its own 256-bit key and is encrypted with AES-256-GCM. Keys are sealed separately and are never shared between files or between customers, so compromise of one file's key does not extend to any other file or any other customer. Files uploaded from a browser are encrypted client-side, before any byte reaches storage. Files that arrive another way — through the workspace's inbound email address, or generated by the product from row data — are encrypted server-side before they are written to storage.

Encryption in transit and at rest. TLS 1.2 or 1.3 for all connections to the service. Data at rest is encrypted with AES-256 by the hosting provider, for both file storage and the database. The application connects to the database over TLS with certificate verification; the connection is refused if the certificate cannot be verified. Database backups are encrypted and held in the same Swiss region as the database.

Access control. Role-based access control per workspace, plus granular per-object permissions reaching down to a single table, folder, file, row or column. Every identifier supplied by a user is validated against the workspace boundary before it is used, to prevent access to another workspace's objects. Authentication uses session cookies; roles and permissions are checked on the server on every request, not in the browser.

Support access. Access to a Customer workspace is permission-gated, must be opened as a recorded session, and is logged from start to finish, with every action inside the session attributed to the staff member who performed it. These records are kept for 24 months and are retained even if an individual user account is erased.

Logging and audit. Security events — authentication, permission changes, support access, data-subject request handling — are written to an append-only audit store in the same database transaction as the action they record, so an action cannot commit without its audit row. They are retained for 12 months, meeting the Article 4 OPDo "at least one year" floor. Filetable's logging rules prohibit logging document content, model prompts and responses, file or folder names, and email addresses; logs carry identifiers instead, and this rule is enforced by automated checks.

AI processing. Customer documents are never used to train or fine-tune any model. Contracts with AI providers prohibit them from using Customer Personal Data to train their models. Extraction produces marked, reviewable suggestions rather than final decisions.

Resilience and recovery. A managed database service with backups kept in the Swiss region for 35 days. Documents are not backed up: they are held in zone-redundant storage across three availability zones of the Zurich region, and a deleted or overwritten file remains recoverable through the storage service's soft delete for 7 days. If a restore reinstates previously deleted data, the deletion is re-applied before the data is used.

Software and change control. Code changes go through review before merge, with automated type checking, unit tests and database-backed integration tests. Authorisation and data-retention rules have their own test coverage, so that a change lowering a retention period or widening an access boundary is detected before release.

Organisational measures. Written confidentiality obligations on all personnel that survive the end of engagement. Need-to-know access, reviewed on role change and removed on departure. Data protection and security instruction appropriate to role. A responsible disclosure programme at security@filetable.com, with reports acknowledged within 24 hours.

Certification. Filetable does not currently hold SOC 2 or ISO/IEC 27001 certification and intends to pursue certification as the company grows. Customers will be informed when a certification is obtained.