Data Processing Agreement Summary

Last updated: 12 April 2026

This page is a practical summary of how ExpressCSV approaches controller/processor responsibilities for customers using the service to collect or import personal data about their own users.

It is not a substitute for a signed DPA. If your organization needs an executed DPA, contact care@expresscsv.com.

Roles

In most customer import workflows:

• the customer is the controller for the end-user data it uploads through the importer
• ExpressCSV is the processor providing the import, validation, transformation, and delivery workflow

ExpressCSV remains a controller for its own business data such as account management, billing, support, security, and service analytics.

Processing scope

When ExpressCSV acts as a processor, the service may process customer import data to:

• receive files and auth tokens
• preview rows and headers
• validate and map fields
• run transformation logic
• deliver results back to the customer workflow
• provide support, reliability, and security operations related to the importer

Core commitments

Our processor terms are intended to cover the standard areas customers expect, including:

• processing on documented customer instructions
• confidentiality obligations for authorized personnel
• appropriate technical and organizational security measures
• use of subprocessors needed to run the service
• assistance with data subject requests where applicable
• assistance with security incidents and breach notifications where required
• deletion or return of customer data at the end of services, subject to legal or operational exceptions

Subprocessors and transfers

ExpressCSV uses third-party providers to run the service. See the Subprocessors page for the current public summary.

Where customer data is transferred internationally, we rely on appropriate contractual and organizational safeguards for the processing context.

Security and deletion

ExpressCSV is designed to process import data for the active workflow rather than maintain a long-lived customer data warehouse.

Even so, limited storage may still occur for:

• in-flight processing
• error handling and retries
• operational logs
• billing and service records
• optional browser-side Recovered sessions support

See the Retention page for the public summary of retention practices.

Requesting a signed DPA

To request a signed DPA, email care@expresscsv.com and include:

• your company name
• the billing or account email
• the expected use case
• the legal contact for signature