Data processing agreement (dpa) — Excalidraw+

Cited by

Facts read from this source

• DPA version Report an error

  “Version: 2026-01-13”

• DPA entity Report an error

  “This Data Processing Agreement (“DPA”) forms part of the Agreement between Excalidraw s.r.o. (“Processor”) and the customer using the Excalidraw+ Services (“Controller”).”

• DPA scope hosted only Report an error

  “This DPA applies solely to the hosted Excalidraw+ Services. It does not apply to the standalone open-source editor available at excalidraw.com.”

• DPA laws covered Report an error

  ““Data Protection Laws” means all laws applicable to the Processing of Personal Data under this DPA, including the EU GDPR, UK GDPR, and Swiss data protection law.”

• DPA not for special categories Report an error

  “The Services are not intended for Processing special categories of Personal Data under Article 9 GDPR.”

• EU only personnel access Report an error

  “Access to Customer Personal Data is strictly limited to authorized personnel located within the European Union, and only where necessary to operate, support, or secure the Services.”

• Non EU no access Report an error

  “Processor personnel located outside the EU do not have access to Customer Personal Data.”

• Trust center URL Report an error

  “A high-level description of these measures is available at https://trust.excalidraw.com.”

• Security measures Report an error

  “These measures include, among others, access controls, encryption, monitoring, incident response, and secure development practices.”

• General authorization Report an error

  “The Controller provides the Processor with general authorization to engage Subprocessors.”

• List URL Report an error

  “The Processor maintains an up-to-date list of Subprocessors at: https://trust.excalidraw.com/subprocessors”

• Notification method Report an error

  “The Processor will notify the Controller of intended Subprocessor changes by email and by updating the list above.”

• No objection rights Report an error

  “The Controller does not have approval or objection rights regarding Subprocessors. If the Controller does not agree with a Subprocessor change, its sole remedy is to discontinue use of the Services and cancel its subscription.”

• US subprocessors Report an error

  “The Controller acknowledges that the Processor uses Subprocessors located outside the EEA, including in the United States.”

• Scc transfers Report an error

  “The Processor ensures lawful international transfers through the EU Standard Contractual Clauses (SCCs), which are incorporated by reference: https://plus.excalidraw.com/standard-contractual-clauses-sccs”

• UK swiss addendum Report an error

  “For transfers subject to United Kingdom or Swiss Data Protection Laws, the SCCs apply together with the applicable international transfer addendum, as described at: https://plus.excalidraw.com/international-transfer-addendum”

• Supplementary measures Report an error

  “The Processor applies supplementary measures, including encryption, strict access controls, and data minimization.”

• Dsr assistance Report an error

  “The Processor will reasonably assist the Controller in fulfilling its obligations to respond to Data Subject requests under Data Protection Laws.”

• Deletion on request Report an error

  “Upon written request from the Controller, the Processor will delete or return Customer Personal Data in accordance with the Controller’s instructions and the Processor’s internal data retention and deletion procedures.”

• Cancellation no deletion Report an error

  “Cancellation of a subscription does not delete Customer Personal Data. Following cancellation, access to workspace content may be disabled. Customer Personal Data is retained and deleted in accordance with the Processor’s internal retention policies.”

• Accounts not auto deleted Report an error

  “User accounts are not deleted automatically and remain active until the user deletes them.”

• Breach notification Report an error

  “The Processor will notify the Controller without undue delay, and in accordance with Czech and EU law, after becoming aware of a Personal Data Breach affecting Customer Personal Data.”

• Audit conditions Report an error

  “Formal audits may be conducted only if required by applicable law and subject to reasonable advance notice and coordination to minimize disruption.”

• Governing law Report an error

  “This DPA is governed by the laws of the Czech Republic, without regard to conflict-of-laws rules.”

• DPA annexes Report an error

  “Annex I – Description of Processing: https://plus.excalidraw.com/description-of-processing Annex II – Technical and Organizational Measures (TOMs): https://plus.excalidraw.com/technical-and-organizational-measures-toms Annex III – Subprocessors: https://trust.excalidraw.com/subprocessors”

Scores citing this record

• The Microsoft 365 Admin Security, AI controls & deployment
• The Microsoft 365 Admin European sovereignty
• The Product Team Lead European sovereignty
• The Public-Sector Project Lead Security, AI controls & deployment
• The Public-Sector Project Lead European sovereignty
• The Skeptic Security, AI controls & deployment
• The Skeptic European sovereignty
• The Works Council Member Security, AI controls & deployment
• The Works Council Member European sovereignty
• The Workshop Facilitator European sovereignty