1. What Is a Data Processing Agreement?

Under Article 28 of the GDPR, when a data controller (Filed) engages a third party to process personal data on its behalf, a legally binding Data Processing Agreement (DPA) must be in place. This ensures that all parties handling your data are contractually required to protect it.

2. Our Data Processors

Filed has Data Processing Agreements in place with the following organisations who process your personal data:

Supabase Inc.

• Role: Database and file storage provider
• Data processed: Account data, transaction records, receipt photographs
• Location: European Union
• DPA: Supabase Data Processing Agreement (signed via Supabase platform)
• Privacy policy: supabase.com/privacy

Stripe Ireland, Ltd.

• Role: Payment processing
• Data processed: Subscription status, payment records (not card details)
• Location: Republic of Ireland / EU
• DPA: Stripe Data Processing Agreement (signed via Stripe platform)
• Privacy policy: stripe.com/ie/privacy

Google Cloud (Vision API)

• Role: Optical character recognition for receipt scanning
• Data processed: Receipt photograph content (processed in transit, not stored)
• Location: EU where possible; may process in US with SCCs in place
• DPA: Google Cloud Data Processing Amendment (signed via Google platform)
• Privacy policy: cloud.google.com/privacy

Partner Accountant (Filing Service)

• Role: Reviewing tax data and filing Form 11 returns on behalf of users who purchase the filing add-on
• Data processed: Name, income records, expense records, RCT credits, tax year summary
• Location: Republic of Ireland
• DPA: Filed standard DPA (available on request from dpo@filed.ie)

3. What Our DPAs Require

All Data Processing Agreements we enter into require the processor to:

• Process personal data only on Filed's documented instructions
• Ensure all staff with data access are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Not engage sub-processors without Filed's prior written authorisation
• Assist Filed in responding to data subject rights requests
• Notify Filed within 48 hours of any personal data breach
• Delete or return all personal data at the end of the agreement
• Allow Filed to audit compliance with the DPA

4. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Your Rights

The existence of DPAs does not affect your rights as a data subject. You may still request access to, correction of, or deletion of your personal data at any time. See our Privacy Policy for full details of your rights.

6. Contact

For questions about our data processing arrangements or to request a copy of our standard DPA template:

Data protection: dpo@filed.ie
General enquiries: legal@filed.ie
Website: filed.ie/privacy