Data processing agreement (dpa) — Proton Drive

Cited by

Facts read from this source

• Entity Report an error

  “between Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, Company identification number CHE-354.686.492 (referred to as the "Processor")”

• GDPR DPA available Report an error

  “The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016/679”

• DPA last modified Report an error

  “Last modified: February 10, 2026”

• DPA part of terms Report an error

  “This Data Processing Agreement ("Agreement") forms part of the Contract for Services under Proton AG’s Terms and Conditions (the “Principal Agreement")”

• Subprocessor list Report an error

  “The Company acknowledges and approves the list of Subprocessors outlined in the Processor’s Privacy Policy, understanding that this list may be updated by the Processor regularly”

• Group transfers authorized Report an error

  “Furthermore, the Company authorizes the Processor to disclose and transfer Personal Data to any company within its corporate group.”

• Breach notification Report an error

  “In the event of a Personal Data Breach affecting company Personal Data, the Processor shall notify the Company without delay, providing sufficient information to enable the Company to fulfill its obligations under Data Protection Laws”

• Dpiassistance Report an error

  “Processor shall provide reasonable assistance to Company with any data protection impact assessments, and prior consultations with Supervising Authorities”

• Deletion on cessation Report an error

  “In case of cessation of any Service involving the Processing of Company Personal Data, the Processor shall delete all Company Personal Data to the extent permitted by applicable laws and in accordance with Processor’s Terms and Conditions and Privacy Policy.”

• Copy request deadline Report an error

  “Should the Company require a copy of their data, they must request it before the deletion of their account; requests made after the account has been deleted can no longer be considered.”

• Audit rights Report an error

  “Processor shall make available to Company on request all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, by Company or an auditor mandated by Company”

• Audit frequency limit Report an error

  “Company shall not exercise its audit rights more than once per calendar year except following a Personal Data Breach or an instruction by a regulatory authority.”

• Audit notice period Report an error

  “Company shall give Processor at least sixty (60) days prior written notice of its intention to audit Processor pursuant to this Agreement.”

• Audit nda Report an error

  “Company acknowledges that the signing of a non-disclosure agreement may be required by the Controller prior to the conduction of the audit.”

• Transfer scope Report an error

  “To the extent possible, the Processor shall only transfer or authorize the transfer of Data to countries within Switzerland, the EU and/or countries subject to an adequacy decision, as provided for in art. 45 GDPR and art. 16 Swiss FADP.”

• Scc transfer mechanism Report an error

  “the Parties shall, unless agreed otherwise, rely on Switzerland- and/or EU- and/or UK- approved and then-current standard contractual clauses for the transfer of Personal Data or other transfer mechanisms as provided for by Data Protection Laws.”

• Notices email Report an error

  “Processor shall be notified by email sent to the address: legal@proton.me.”

• English version prevails Report an error

  “In case of discrepancy between the English version of these Terms and any translated version, the English version shall prevail.”

• Services scope Report an error

  “"Services" means online secure services provided by the Processor, such as email, calendar, drive and other services as developed by the Processor.”

• Breach cost allocation Report an error

  “Each party shall bear the costs of the investigation, remediation, mitigation, and other related costs to the extent a Data Breach is caused by such party.”

• Subprocessor flowdown Report an error

  “Processor ensures that Subprocessors are subject to an agreement with Processor no less restrictive and protective than the present Agreement with respect to the protection of Company Personal Data”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Agency Producer Export, API & self-hosting
• The Agency Producer European sovereignty
• The Architecture Practice Partner Export, API & self-hosting
• The Architecture Practice Partner European sovereignty
• The Data Protection Officer Export, API & self-hosting
• The Data Protection Officer European sovereignty
• The IT Lead Export, API & self-hosting
• The IT Lead European sovereignty
• The Skeptic Export, API & self-hosting
• The Skeptic European sovereignty
• The Tax Adviser Export, API & self-hosting
• The Tax Adviser European sovereignty