Data Processing Agreement (GDPR)

Last updated: July 11, 2026

This Data Processing Agreement (DPA) describes how 7awel handles customer personal data as a "Data Processor" in compliance with the European Union's General Data Protection Regulation (GDPR).

1. Scope and Roles

For API integrations and developer endpoints:

  • The Customer: Acts as the "Data Controller" who determines the purpose and scope of the file inputs uploaded to the API.
  • 7awel: Acts as the "Data Processor" executing file transformations, spreadsheet conversions, or data extractions on behalf of the controller.

2. Processing Protocol

We process personal data included in customer file uploads only under the following strict conditions:

  • Instructions: Processing is executed solely via automated REST API endpoints triggered directly by the Controller.
  • Transient Nature: All personal data contained in the files is processed dynamically. Files are sandbox-isolated and deleted permanently immediately after completion of the API request response. No backups or archives of the processed documents are retained.

3. Subprocessors

We do not share, sell, or distribute transient file uploads with any third-party subparcessors. All server operations run in dedicated and secured data centers located in Europe.

4. Security Measures

We implement technical and organizational measures (TOMs) to secure personal data, including:

  • Full end-to-end transport layer security (HTTPS TLS 1.3).
  • Sandbox container isolation preventing cross-tenant access.
  • Internal server firewalls and vulnerability scanning.

5. Breach Notification

In the unlikely event of a security breach affecting account profile records, we will notify the Controller within 72 hours of verification. Since transient files are not retained, data breaches do not expose historical customer document contents.

6. Data Deletion and Portability

Controllers can delete their accounts and profile records at any time. All stored databases, API logs, and settings will be permanently wiped out within 30 days of the account cancellation.