Data Processing Agreement

Effective: 1 July 2026 · Applies to Enterprise plans

1. Scope

This Data Processing Agreement ("DPA") supplements the Terms of Service and applies where Excelfyio processes personal data on behalf of the Customer ("Controller") as a processor under applicable data protection law (including GDPR and UK GDPR).

2. Definitions

"Personal Data", "Processing", "Data Subject", "Supervisory Authority" have the meanings given in applicable data protection law. "Customer Data" means any personal data submitted to the Service by the Customer.

3. Processing Instructions

Excelfyio shall process Customer Data only on documented instructions from the Customer (as set out in the applicable order or these Terms) unless required to do otherwise by applicable law.

4. Sub-processors

Excelfyio engages the following categories of sub-processors:

Cloud infrastructure — EU-hosted compute and storage.
AI inference — Anthropic (Claude) and/or Azure OpenAI. Data is processed under their respective DPAs and is not used for model training.
Email delivery — Resend, for transactional email only.

Excelfyio will notify the Customer of any intended addition or replacement of sub-processors with at least 14 days' notice.

5. Security Measures

Excelfyio implements appropriate technical and organisational measures including: encryption in transit (TLS 1.2+) and at rest; access controls and least-privilege principles; regular security assessments; and incident response procedures.

6. Data Subject Rights

Excelfyio shall provide reasonable assistance to the Customer in responding to Data Subject requests within applicable timeframes. Requests should be submitted to privacy@excelfyio.com.

7. Breach Notification

Excelfyio shall notify the Customer without undue delay (and within 72 hours where feasible) upon becoming aware of a Personal Data breach affecting Customer Data.

8. Deletion and Return

Upon termination of the Service, Excelfyio shall delete or return all Customer Data within 90 days, unless applicable law requires longer retention.

9. Execution

Enterprise customers may request a countersigned DPA at legal@excelfyio.com.