Data processing agreement (DPA) - template for businesses

1. Parties, definitions and scope

1.1The parties to this agreement are: (1) Artur Witoś, a sole trader, address: Wólka Zatorska 16, 07-217 Wólka Zatorska, Poland, NIP: 5681625642, REGON: 386254514, entered in the Central Register and Information on Economic Activity (CEIDG), referred to as “Korfi” or the “Processor”; (2) the user who is a business or another organisation and has accepted this agreement for its account, referred to as the “Controller”.

1.2The Controller’s identification details are the company details given when the agreement is accepted. [TO BE DECIDED: how the Controller is identified - company details stored in the account settings at acceptance]

1.3This agreement fulfils the requirement of Article 28(3) GDPR. Korfi is a processor only for the personal data that the Controller entrusts to it through the Service. For everything else, including account data, security data and technical data, Korfi is a separate controller, and payments are handled by Paddle as an independent controller (see the Privacy Policy).

1.4In this agreement, the following terms mean:

GDPR

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Service

the Korfi service described in the Terms: the app, the API, the korfi.app websites and the storage, sharing, search and AI assistant features.

Controller’s Personal Data

personal data contained in the content of files, in file and folder names, in descriptions and in other materials that the Controller or persons authorised by it upload to the Service, or that reach it through a Bucket link (an address through which a person without an account uploads files to a chosen folder) or the Controller’s email inbox.

Standard Folder

a folder whose contents are visible to the server and may be processed on the server, for example by text extraction, OCR and a search index.

Private Folder and Vault

end-to-end encrypted folders whose contents Korfi is unable to read.

Sub-processor

an entity to which Korfi entrusts further processing of the Controller’s Personal Data, listed in annex 2.

Breach

a personal data breach within the meaning of Article 4(12) GDPR concerning the Controller’s Personal Data.

Recovery key

a key generated in the Korfi app when encryption is first enabled and kept only by the user.

2. Subject matter, nature, purpose and duration of processing

2.1The Controller entrusts Korfi with processing the Controller’s Personal Data to the extent necessary to provide the Service.

2.2The nature of the processing, its purposes, the types of data and the categories of data subjects are described in annex 1.

2.3Processing lasts for the term of the agreement for the Service and for the data return and deletion period described in section 7.

2.4Korfi does not process the Controller’s Personal Data for any other purpose. In particular, it does not use it for its own purposes, advertising or profiling.

2.5Korfi does not sell the Controller’s Personal Data or disclose it to anyone other than the Sub-processors listed in annex 2, unless required by law.

3. Korfi’s obligations as processor

3.1Korfi processes the Controller’s Personal Data only on the Controller’s documented instructions. The instructions are this agreement, the agreement for the Service and the use of Service features by the Controller and the persons it has given access, for example uploading a file, creating a link, switching on an AI feature or deleting a file.

3.2If Union law or Polish law requires Korfi to process data, Korfi will inform the Controller before processing begins, unless the law prohibits such information on important grounds of public interest.

3.3Korfi will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

3.4Korfi ensures that persons authorised to process the Controller’s Personal Data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Only persons who need access to provide the Service have access to the data.

3.5Korfi applies the technical and organisational measures required by Article 32 GDPR, described in annex 3. Korfi may change them as long as it does not lower the overall level of protection.

3.6Korfi keeps the record of categories of processing activities referred to in Article 30(2) GDPR.

4. Sub-processors

4.1The Controller gives general authorisation for Korfi to use the Sub-processors listed in annex 2.

4.2Korfi will notify the Controller in advance of any intention to add or replace a Sub-processor, by email to the account address or by a message in the app, and will update the list on this page. The Controller may raise a reasoned objection. [TO BE DECIDED: advance notice of a change of sub-processor (proposal 30 days) and the objection period (proposal 14 days)]

4.3If the objection is reasoned and the parties do not find a solution, the Controller may terminate the agreement for the part affected by the change, at no additional cost, and download its data in accordance with section 7.

4.4Korfi enters into contracts with Sub-processors that impose data protection obligations at least equivalent to those in this agreement (Article 28(4) GDPR) and remains liable to the Controller for the Sub-processor’s performance of those obligations.

4.5The terms under which the main Sub-processors process data are public. Links to their data processing agreements and sub-processor lists are in annex 2.

5. Assistance to the Controller

5.1Korfi assists the Controller, to the extent possible and by appropriate technical measures, in responding to requests from data subjects (Chapter III GDPR). The Controller can search, download, correct and delete data on its own using the Service features.

5.2If a data subject contacts Korfi directly about the Controller’s Personal Data, Korfi will forward the request to the Controller without undue delay and will not respond to its substance without the Controller’s instruction, unless the law requires otherwise.

5.3Korfi assists the Controller in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment and consultation with the supervisory authority), taking into account the nature of the processing and the information available to Korfi. Section 10 describes the limits that follow from end-to-end encryption.

5.4Assistance provided through the standard Service features carries no additional charge. [TO BE DECIDED: charging for assistance beyond the standard Service features - included in the plan or at a rate]

6. Personal data breaches

6.1Korfi will notify the Controller of a Breach without undue delay and no later than 48 hours after becoming aware of it (Article 33(2) GDPR), by email to the account address. [TO BE DECIDED: deadline for notifying the Controller of a breach - proposal 48 hours]

6.2The notification contains, to the extent the information is known: a description of the nature of the Breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken and proposed, and contact details. Information may be provided in phases.

6.3Korfi takes action to limit the effects of the Breach and documents it. The decision whether to notify the President of the Personal Data Protection Office (Article 33(1) GDPR) and whether to inform data subjects (Article 34 GDPR) lies with the Controller. Korfi assists the Controller in doing so.

6.4Korfi describes its internal breach response procedure (detection, risk assessment, notification, informing individuals, breach register) in internal documentation.

7. Return and deletion of data after processing ends

7.1After the agreement for the Service ends or the account is deleted, the Controller has 30 days to download its data using the download and export features available in the Service.

7.2After that period Korfi deletes the Controller’s Personal Data (files, metadata, extracted text and the search index), unless the law requires it to be kept longer.

7.3Full deletion does not cover the following data, which disappears later or after release:

• objects in the Archive that are under a lock at the data storage level (30 days from upload). Nobody can delete them before the lock ends, including Korfi. Access to them is blocked, and the objects will be deleted when the lock ends,
• copies of the database history kept automatically by the infrastructure provider, which expire after no more than 30 days,
• data preserved at the request of a competent authority for 90 days. It will be deleted when the preservation is released.

7.4At the Controller’s written request, Korfi confirms the deletion of data by email.

8. Audit

8.1Korfi makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR, in particular the description of security measures (annex 3), the list of Sub-processors and the available reports and certifications of Sub-processors, to the extent Korfi may share them.

8.2The Controller may carry out an audit of Korfi no more than once a year and after a Breach, on prior written notice, during business hours, in a way that does not disrupt the Service and without access to other customers’ data or to keys and secrets. The auditor keeps the information confidential. [TO BE DECIDED: audit conditions - notice period, scope and allocation of costs]

8.3Audit rights against Sub-processors exist on the terms of their agreements (for infrastructure providers, mainly independent audit reports). Korfi will help the Controller exercise those rights to the extent possible.

9. Controller’s obligations

9.1The Controller is responsible for the lawfulness of the processing, including the legal basis (Article 6 GDPR and, for special categories of data, Article 9), for meeting its information duties towards data subjects (Articles 13 and 14 GDPR), and for having the right to entrust the data to Korfi.

9.2The Controller’s instructions must comply with the law. The Controller uploads to the Service only the personal data it needs for its purposes.

9.3Special categories of data (Article 9 GDPR) and data relating to criminal convictions and offences (Article 10 GDPR) may be stored in the Service solely at the Controller’s responsibility. For sensitive data we recommend Private folders or the Vault.

9.4The Controller is responsible for the persons to whom it gives access to the account, for securing that access (email inbox, devices, second factor, passkeys, backup codes), for configuring sharing links and Buckets (expiry, passwords, limits) and for keeping the Recovery key.

9.5Buckets and the email inbox work only with Standard Folders. The Controller understands that files received this way are visible to the server and may be processed in accordance with section 11.

10. Limits resulting from end-to-end encryption

10.1The contents of files in Private Folders and Vaults are encrypted end to end on the user’s computer before upload. Korfi stores the ciphertext and wrapped keys, has no access to the decryption keys and sees plain metadata: file and folder names, descriptions, sizes, dates and settings.

• Korfi cannot disclose the contents of these files, search them, process them on the server or recover them.
• Assistance with data subject requests (section 5) is limited to metadata and to actions the Controller performs itself in the app, for example downloading or deleting a file.
• Korfi is unable to determine whether encrypted files contain personal data.

10.2Korfi does not know the Recovery key and cannot recreate it. If the Controller loses the Recovery key and access to the computer holding the master key, the encrypted files cannot be recovered, including by Korfi. Korfi is not liable for the consequences of losing the key, unless they result from the Service not conforming to the agreement.

10.3File and folder names and descriptions remain visible to the server in encrypted folders too. The Controller should not put in them data that must remain invisible to Korfi.

11. AI features and processing in Standard Folders

11.1Server-side processing of contents, such as text extraction, OCR, the search index, automatic descriptions and tags, and vectors, applies only to Standard Folders. Korfi does not perform it on the server in Private Folders and Vaults. Some of these features are planned and will be rolled out in stages.

11.2When the Controller or a person it has authorised uses the AI assistant, the text of the request and selected file excerpts are sent to the artificial intelligence model of the Sub-processor named in annex 2 through Korfi and the AI gateway. That Sub-processor processes data only when an AI feature has been used.

11.3Korfi does not store the text of AI requests or replies in its database or logs. Every request to the AI gateway has content logging and caching switched off. Only usage metadata is recorded: model, token counts, cost, time and status.

11.4The AI model provider may retain data sent through its API in line with its own terms. According to its public information, API data is as a rule deleted within 30 days, and may be kept longer if a usage policy violation is detected. [TO BE DECIDED: confirm in the agreement with the AI model provider the data retention terms and that API data is not used to train models]

11.5The Controller’s switching on an AI feature is an instruction within the meaning of section 3. The Controller may decide not to use it. In Private folders the assistant sees only file names by default, and sees content excerpts only after consent in the given conversation, while the Vault is not processed. [TO BE DECIDED: whether the AI feature is on by default for business accounts]

12. Transfers outside the European Economic Area

12.1Files are stored in the European Union (data storage under EU jurisdiction). [TO BE DECIDED: confirm that the database was created with EU jurisdiction (the jurisdiction cannot be changed after the database is created)]

12.2The infrastructure provider’s compute services run on a global network. Requests, metadata and email messages may be processed in data centres outside the EEA, and a US-based entity (annex 2) may have access to them. Korfi does not guarantee that all operations, including AI calls, take place exclusively in the EU.

12.3The grounds for transfers to the United States result from the Sub-processors’ public agreements and are stated for each of them in annex 2: certification under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) and, where a certification does not apply or does not cover the entity, the standard contractual clauses (Commission Implementing Decision (EU) 2021/914).

12.4Korfi will not transfer the Controller’s Personal Data outside the EEA without a ground under Chapter V GDPR and will inform the Controller of changes as described in section 4.

12.5On request, Korfi will provide the information it has that the Controller needs to assess the effects of the transfers.

13. Liability

13.1Each party’s liability towards data subjects and supervisory authorities arises from the GDPR, including Article 82.

13.2Between the parties, Korfi’s liability under this agreement is subject to the limitations in the Terms. [TO BE DECIDED: cap on Korfi’s liability under the DPA, exclusions and the relationship to the limits in the Terms]

13.3Nothing in this agreement excludes liability that cannot be excluded under the law.

13.4Korfi is not liable for the effects of unlawful instructions, of the loss of the Recovery key or of the actions of persons to whom the Controller has given access to the account, unless they result from Korfi’s failure to perform its obligations.

14. Conclusion, term and termination

14.1The agreement is concluded on acceptance. Korfi records the version of the template and the date of acceptance. [TO BE DECIDED: how the agreement is concluded - online acceptance in the business account settings or a signed version]

14.2The agreement applies from conclusion until the agreement for the Service ends and the return and deletion of data under section 7 is complete.

14.3The Controller may stop using the Service at any time by deleting the account. Either party may terminate this agreement without notice for good cause, in particular in the event of a material breach of its provisions.

14.4Korfi may change the template on the terms the Terms provide for changes to the Terms, with notice to the account email address. The current version and its date are published on this page.

14.5After the agreement ends, the provisions on confidentiality, return and deletion of data, and liability continue to apply.

15. Governing law, court and contact

15.1This agreement is governed by Polish law and the GDPR. Matters not regulated are governed by the Polish Civil Code.

15.2Disputes arising from the agreement are decided by the court indicated below. [TO BE DECIDED: court competent for disputes between businesses, for example the court competent for Korfi’s registered seat]

15.3For data protection matters, contact us at hello@korfi.app.

Annex 1. Details of the processing

A1.1The summary below supplements section 2.

Subject matter

Processing of the Controller’s Personal Data within the Korfi Service.

Nature of processing

Storage, reading and downloading, organising in folders, versioning, trash and Archive, sharing through links, receiving files through Buckets and the email inbox (features that are planned or released in stages), text extraction, OCR and indexing in Standard Folders, processing by the AI assistant on the user’s instruction, deletion.

Purposes

Providing the Service to the Controller in line with its instructions and keeping it secure.

Types of data

Personal data contained in the content of files, in file and folder names and in descriptions, extracted text and the search index (Standard Folders), personal data of people uploading files through Buckets and the email inbox, and file metadata. The Controller’s users’ account data (email address, sign-in and session data) is processed as described in the Privacy Policy.

Categories of data subjects

The Controller’s employees and collaborators, its customers and contractors, people sending files through Buckets and the email inbox, and other people whose data the Controller puts in files.

Special categories of data

Possible if the Controller uploads them, solely at the Controller’s responsibility (section 9).

Duration

The term of the agreement and the data return and deletion period (section 7).

Location

Files: European Union (data storage under EU jurisdiction). Other data and operations: as described in section 12.

A1.2This agreement does not cover data for which Korfi is the controller, such as account, security, billing and abuse report data. The buyer’s payment data is processed by Paddle as an independent controller.

Annex 2. List of Sub-processors

A2.1The Controller authorises the use of the following Sub-processors. Changes follow the procedure in section 4.

A2.2Paddle is not a Sub-processor. Paddle is the seller (Merchant of Record) and an independent controller of the buyer’s payment data, as set out in the Paddle privacy policy.

A2.3[TO BE COMPLETED: registration details and addresses of the contracting entities (Cloudflare, Inc. and Anthropic, PBC) according to their current agreements]

Annex 3. Technical and organisational measures

A3.1Below we describe the measures in place when the template was published. The description covers only what is implemented, and planned elements are marked as planned.

Encryption

• Private folders and Vaults: file contents are encrypted end to end on the user’s computer before upload (XChaCha20-Poly1305, streaming encryption). Each file has its own key, and the file key is wrapped with the master key. The server stores the ciphertext and wrapped keys.
• The master key is kept in the macOS Keychain. Only the user keeps the recovery key.
• Each file’s ciphertext is bound to that file’s identifier, so the server cannot swap it for another.
• Data is transmitted over HTTPS (TLS).
• Files are stored in data storage under EU jurisdiction and encrypted at rest by the infrastructure provider.

Authentication and access

• Sign-in with a one-time email code, with no passwords. The code is stored as an HMAC hash with a server secret, is valid for 10 minutes, allows 5 attempts per code and no more than 5 codes per hour for one address.
• Optional 2FA with a TOTP app: secrets are encrypted on the server side, and backup codes are stored only as hashes.
• Passkeys (WebAuthn) bound to the korfi.app domain. Adding a passkey requires confirmation and a code from email, and we send a notification when one is added.
• Critical actions (for example deleting a protected file, turning off 2FA, deleting the account) require fresh confirmation, valid for up to 5 minutes: with a passkey, a TOTP code or an email code. The server enforces this requirement.
• Sessions: tokens are stored on the server only as hashes, are valid for up to 90 days, and come with a device list and remote sign-out. The app keeps the token in the macOS Keychain.

Customer data isolation

• The user identifier comes only from the session, never from the client. Every query for user data contains a user_id condition, and data is accessed only through functions that require the user identifier.
• Another user’s resource returns 404, so we do not reveal that it exists. The full-text index is always filtered by user_id.
• The server builds the object key in the data storage from a record that belongs to the user. Names and paths sent by the client never enter the key.
• Every endpoint that operates on user data has an isolation test confirming that user B cannot access user A’s resources.
• The Worker’s S3 token has permissions only for the Korfi bucket.

Sharing and URLs

• Presigned URLs are valid for up to 15 minutes, are signed for a specific key, method and size, and are issued after the owner and the storage limit have been checked.
• Sharing links have an expiry time, an optional password (PBKDF2-SHA256 with a salt and an additional server secret), a download limit, an attempt limit and escalating lockouts. The global client limit relies on an HMAC of the IP address, and the raw IP address is not stored.
• For encrypted files the file key is in the part of the link after the # character, so the server does not see it.

Storage, deletion and restoration

• Trash keeps deleted files for 30 days, after which an automatic job deletes them permanently.
• The Archive has a lock at the data storage level for 30 days from upload, which nobody can bypass, including an administrator.
• The database has an automatic change history, which allows the state from the last 30 days to be restored.
• Duplicate detection by SHA-256 applies only to unencrypted files.

Administration, monitoring and AI

• The administration panel runs on a separate domain behind an external access-control service, and its endpoints additionally verify the JWT issued by that service. Administrator actions (accounts, invitations, blocks, limits) are written to an audit log.
• Service tokens have minimal permissions. Secrets are kept outside the repository (Wrangler secrets, and locally files excluded from version control).
• The AI proxy does not store the text of requests or replies in the database or in logs, and the AI gateway has content logging and caching switched off. Only usage metadata remains.
• Technical logs do not contain file contents, and error messages do not contain input data.

Procedures and development

• The personal data breach response procedure (detection, risk assessment, notification of the authority, informing individuals, breach register) is described in internal documentation.
• Code changes pass automated tests, including customer isolation tests, style checks and type checks.

Planned measures

• Protection of public pages (Buckets, link password, forms) with mechanisms that detect automated abuse and limit request rates is planned. Until it is introduced, the attempt limits described above apply.

A3.2Korfi may change the measures described in this annex as long as it does not lower the overall level of protection.