Draft. This document has not yet been reviewed by a lawyer and may change before Pagyra launches. Highlighted text in brackets is still to be supplied or confirmed.
Data processing agreement
Last updated 27 September 2026
The short version: your workspace’s data is yours to control. Pagyra processes it only to run the service for you, keeps it in the United States, uses only the services listed publicly, tells you promptly if something goes wrong, and deletes it when you ask.
1. Scope and roles
This agreement forms part of the terms of service between you (the customer) and Pagyra LLC, a Wyoming limited liability company (“Pagyra”). It applies when Pagyra processes personal data on your behalf in providing the service.
For personal data in your workspace, you are the controller and Pagyra is the processor. Pagyra processes it only to provide the service and on your documented instructions, which are these terms, this agreement, and the choices your admins make in the app.
2. Details of the processing
| Subject matter | Hosting and operating a collaborative document editor for your workspace |
|---|---|
| Duration | For as long as the workspace exists, then until deletion is complete (up to 60 days after an admin deletes it) |
| Nature and purpose | Storing, syncing, searching, displaying, sharing, backing up and exporting workspace content; sending account email; billing |
| Types of personal data | Names and email addresses of members; any personal data within documents, comments and images; display names of anonymous commenters; IP addresses and browser details of share-link visitors |
| Data subjects | Workspace members, people who open or comment through share links, and anyone mentioned in workspace content |
| Special categories | Pagyra does not ask for them. If you choose to put them in documents, you are responsible for having a lawful basis |
3. Pagyra’s obligations
- Process personal data only on your documented instructions.
- Make sure everyone authorised to process it is bound by confidentiality.
- Keep the technical and organisational measures described on the security page, and not reduce their overall level of protection.
- Help you respond to requests from data subjects, and with data protection impact assessments and consultations with authorities, as far as the service allows.
- Notify you of a personal data breach affecting your workspace without undue delay, and in any case within 72 hours of becoming aware of it, with the information you need to meet your own obligations.
4. Subprocessors
You authorise Pagyra to use the subprocessors listed at pagyra.com/subprocessors. Pagyra binds each one by a written contract with data protection obligations at least as protective as these, and remains responsible for them.
Pagyra will notify admins at least 30 days before adding or replacing a subprocessor. You may object on reasonable data protection grounds within that time. If Pagyra cannot reasonably address the objection, you may end your subscription before the change takes effect and will receive a prorated refund of any fees paid in advance for the remaining period.
5. International transfers
Pagyra stores and processes data in the United States. Where personal data is transferred from the European Economic Area, the parties rely on the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (controller to processor), which are incorporated by reference. For transfers from the United Kingdom, the clauses apply as amended by the UK International Data Transfer Addendum issued by the Information Commissioner (version B1.0). For transfers from Switzerland, the clauses apply with the adjustments required by the Federal Data Protection and Information Commissioner, with references to the GDPR read as references to the Swiss Federal Act on Data Protection so far as transfers from Switzerland are concerned.
For the purposes of the clauses: the optional docking clause in clause 7 applies; in clause 9, option 2 (general written authorisation) applies with the 30-day notice period in section 4 of this agreement; the optional wording in clause 11 does not apply; in clauses 17 and 18, the clauses are governed by the law of Ireland and disputes will be resolved before the courts of Ireland; and Annexes I and II are completed by section 2 of this agreement, the parties’ account details, and the security page at pagyra.com/security.
6. Return and deletion
An admin can export the whole workspace in open formats at any time, including after a subscription ends. When an admin deletes the workspace, deletion can be undone for 30 days; after that the content is permanently deleted, and it leaves Pagyra’s backups within a further 30 days, 60 days in all. Pagyra keeps nothing afterwards unless the law requires it.
7. Information and audits
Pagyra will make available the information reasonably needed to show compliance with this agreement, including the security page, subprocessor list and restore-drill records, and will answer reasonable security questionnaires once a year. If that information is not enough to show compliance, you may audit Pagyra’s compliance with this agreement once in any 12-month period, on at least 30 days’ written notice, at your own cost, during normal business hours, yourself or through an independent auditor bound by confidentiality, and without access to other customers’ data or to Pagyra’s systems beyond what is needed for the audit.
8. Liability and order of precedence
Liability under this agreement is subject to the limits in the terms of service. If this agreement and the terms conflict on the protection of personal data, this agreement prevails. Nothing in this agreement limits either party’s liability to data subjects where applicable law does not allow it.
9. Signing
This agreement applies automatically to every customer who accepts the terms of service. If your organisation needs a countersigned copy, email support@pagyra.com. We return a countersigned copy as an electronically signed PDF within 5 working days.