1. Scope and Application

This Data Processing Agreement ("DPA") supplements the FileLu Terms of Service and governs the processing of personal data by FileLu LLC ("FileLu") on behalf of customers using the FileLu cloud storage service.

This DPA applies where FileLu processes personal data on behalf of a customer acting as a Data Controller or Data Processor under applicable data protection laws, including Regulation (EU) 2016/679 (GDPR).

Where the customer acts as a Data Controller, FileLu generally acts as the Data Processor for personal data contained in customer-uploaded content. Where the customer acts as a Data Processor, FileLu may act as a Sub-processor.

FileLu may act as an independent Data Controller for account registration, billing, fraud prevention, security, and certain operational information, as described in our Privacy Policy.

Where validly incorporated into the customer's service agreement, this DPA forms part of the contractual terms governing the use of FileLu.

2. Processing of Customer Data

FileLu processes customer personal data to provide, maintain, secure, support, and operate the cloud storage services requested by the customer.

Processing activities may include receiving, uploading, storing, encrypting, retrieving, transmitting, synchronizing, backing up, caching, replicating, sharing, and deleting customer files and related information.

Customer instructions may be provided through the FileLu website, FileLuSync desktop and mobile applications, supported APIs, and third-party clients using protocols and integrations such as WebDAV, FTPS, S5, rsync, Rclone, and MCP.

These instructions may also be provided through other supported applications, integrations, and file transfer methods introduced by FileLu in the future.

FileLu will process customer personal data only on documented instructions from the customer, including instructions concerning international transfers, unless processing is required by applicable law.

Where legally permitted, FileLu will inform the customer of such legal requirements before processing.

If FileLu believes a customer instruction infringes applicable data protection law, FileLu will inform the customer as required by law.

3. Content Delivery, Caching, and Replication

To improve service performance, reliability, availability, and download speeds, FileLu may use content delivery networks (CDNs), caching, replication, and distributed storage technologies.

When customers upload, download, access, or share files, FileLu may temporarily cache, replicate, or process file content on servers located in different geographic regions, including locations outside the customer's primary storage region.

These technologies help deliver files efficiently and maintain service availability. Cached and replicated data remains subject to FileLu's applicable security and data protection measures.

Selecting a particular storage region or regional endpoint does not guarantee that all associated account information, file transfers, cached content, or service-related data will remain exclusively within that region.

4. Data Security

FileLu implements technical and organizational security measures designed to protect customer personal data against unauthorized access, accidental loss, alteration, destruction, or unlawful disclosure.

Security measures include applicable encryption technologies, access controls, authentication, infrastructure security, monitoring, and operational safeguards appropriate to the nature of the services provided.

FileLu provides optional customer-controlled encryption features, including end-to-end encryption, for supported storage configurations.

The availability and implementation of encryption features may vary depending on the storage method, application, protocol, and customer configuration.

Customers are responsible for selecting appropriate security settings, protecting their credentials, and securely managing encryption keys where applicable.

5. Confidentiality

FileLu will restrict access to customer personal data to authorized personnel and service providers who require access for legitimate operational purposes.

Personnel authorized to process customer personal data must be subject to appropriate confidentiality obligations.

FileLu does not claim ownership of customer content and will not use customer-uploaded files for purposes unrelated to providing the service, except where authorized by the customer or required by applicable law.

6. Sub-processors

The customer provides FileLu with general written authorization to engage third-party sub-processors as necessary to provide, maintain, secure, and support the FileLu services.

FileLu may use third-party service providers for hosting, infrastructure, network security, content delivery, caching, email delivery, and other necessary service operations.

FileLu maintains information about relevant service providers and their processing activities.

FileLu will provide at least 30 days' advance notice before adding or replacing a sub-processor that processes customer personal data, except where urgent security or operational circumstances require a shorter period.

Customers may object to a proposed sub-processor change on reasonable data protection grounds by contacting FileLu Support during the applicable notice period.

FileLu will review objections in good faith and seek an appropriate resolution. Where no reasonable resolution is available, the customer may discontinue the affected services in accordance with the applicable service agreement.

FileLu will enter into appropriate contractual arrangements with sub-processors that impose data protection obligations consistent with applicable law and this DPA.

FileLu remains responsible for the performance of its sub-processors' data protection obligations to the extent required by applicable law.

Service Providers

These providers support different aspects of FileLu's operations. Their legal roles may vary depending on the services performed and the personal data processed. Not every provider necessarily acts as a sub-processor for customer-uploaded content.

7. International Data Transfers

FileLu LLC is based in the United States and operates storage and service infrastructure in multiple geographic regions, including the United States and European Union.

FileLu's European data centers are located in Germany and Finland.

Customer personal data may be transferred, stored, cached, replicated, or otherwise processed outside the European Economic Area (EEA) as necessary to provide and maintain the FileLu services.

FileLu's central account database is hosted in the United States and is encrypted. Certain account information, metadata, and operational data may therefore be processed outside the European Union.

FileLu does not currently guarantee that customer files, account information, cached content, and related service data remain exclusively within the European Union.

International Transfer Safeguards

Where a transfer of personal data is subject to Chapter V of the GDPR, FileLu and the relevant data exporter must rely on an applicable lawful transfer mechanism.

Such mechanisms may include an applicable adequacy decision, the European Commission's Standard Contractual Clauses (SCCs), or another mechanism permitted under applicable data protection law.

Where Standard Contractual Clauses are used, the relevant parties must incorporate the applicable clauses adopted under Commission Implementing Decision (EU) 2021/914, together with the required completed annexes, into their contractual arrangements.

FileLu implements technical and organizational safeguards designed to protect personal data during international transfers, including applicable encryption and access controls.

Where required, the relevant parties must assess the circumstances of international transfers and implement supplementary safeguards appropriate to the identified risks.

Customers requiring information about applicable international transfer arrangements may contact FileLu Support.

Additional information about FileLu's international data transfer arrangements, including information about the European Commission's Standard Contractual Clauses, is available on our International Data Transfer Safeguards page.

8. Personal Data Breaches

FileLu will notify affected customers without undue delay after becoming aware of a personal data breach involving personal data processed on their behalf, as required by applicable law.

FileLu will provide reasonably available information necessary to assist customers in evaluating and responding to the incident.

FileLu will take reasonable steps to investigate, contain, and mitigate confirmed security incidents affecting customer personal data.

9. Data Subject Rights and Assistance

FileLu will provide reasonable assistance to customers in responding to requests from individuals exercising their rights under applicable data protection laws.

Customers may manage, download, and delete their stored content using available FileLu tools.

Where required by applicable law, FileLu will also provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities.

10. Data Retention and Deletion

Customers retain control over the content stored in their accounts and may delete files or terminate their accounts in accordance with the FileLu Terms of Service and Data Retention Policy.

Upon termination of the applicable services, FileLu will, at the customer's choice, delete or return customer personal data, unless applicable law requires its retention.

FileLu will delete remaining copies in accordance with applicable retention schedules, subject to legally required retention.

Backup copies, temporary cached data, and operational records may remain for limited periods where necessary for security, service continuity, or legal compliance, subject to applicable retention policies.

11. Government and Legal Requests

FileLu may be required to respond to valid legal requests from courts, government authorities, or law enforcement agencies.

FileLu will evaluate such requests in accordance with applicable laws and will disclose information only where legally required or otherwise permitted under applicable law.

Where legally permitted and consistent with applicable obligations, FileLu will notify affected customers of requests concerning their personal data.

12. Compliance and Audits

FileLu will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and applicable data protection laws.

Where required by GDPR Article 28, FileLu will allow for and contribute to audits and inspections conducted by the customer or an authorized independent auditor.

Such audits may be subject to reasonable confidentiality, security, and operational safeguards, provided these safeguards do not prevent the exercise of applicable statutory audit rights.

13. Customer Responsibilities

Customers are responsible for ensuring that they have a lawful basis for collecting, uploading, storing, and processing personal data through FileLu.

Customers are also responsible for managing account access, selecting appropriate security settings, protecting credentials, and complying with applicable data protection laws.

14. Changes to This Agreement

FileLu may update this DPA to reflect changes in applicable laws, regulatory requirements, infrastructure, or service operations.

Material changes affecting customer data protection rights will be communicated in accordance with applicable law and contractual requirements.

Changes to this DPA will not reduce protections required by applicable data protection law.

15. Contact Information

Questions concerning this Data Processing Agreement or FileLu's data protection practices may be directed to [email protected].

FileLu uses technical and organizational measures appropriate to the nature of its services and the risks associated with processing customer data. Specific protections may vary by feature, protocol, and customer configuration.

Encryption and Data Protection

FileLu supports encrypted connections for applicable services and provides server-side and optional customer-controlled encryption features for supported storage configurations.

Authentication and Access Control

FileLu provides account authentication and access control mechanisms designed to restrict unauthorized access to customer accounts and stored information.

Infrastructure Security

FileLu operates its services using infrastructure and network security measures designed to protect the availability, confidentiality, and integrity of customer data.

Backup and Availability

FileLu may use backup, replication, caching, and distributed infrastructure technologies to support service availability and operational resilience.

Security Incident Management

FileLu maintains operational procedures for investigating and responding to security incidents affecting its services.