The DPA,
ready to countersign.

Most ateliers do not need a separate DPA — our Terms of Service include all GDPR-required clauses. For enterprises, agencies, and regulated industries, the template below covers everything your legal team will ask for. Sign it once, email it once.

DPA template · PDF

drape-dpa-template-v3.2.pdf

18 pages · 380 KB · GDPR Article 28 compliant

⤓ Download PDF

What this document covers

Subject matter, duration, nature and purpose of processing. Categories of data subjects and personal data. Obligations and rights of the controller. Sub-processors (Hetzner, AWS Frankfurt, Stripe, Plausible, Brevo — full list in Annex II).

Sub-processors we use

Hetzner (Frankfurt, Germany) — primary hosting.

AWS Frankfurt (Germany) — secondary hosting and replicas.

Stripe (Dublin, Ireland) — payment processing.

Plausible (Hanau, Germany) — privacy-friendly analytics.

Brevo (Paris, France) — transactional email.

We will notify you 30 days before any new sub-processor. Full list, with contact and DPA on file, is in Annex II of the template.

Standard Contractual Clauses

For data transfers outside the EEA, we use the European Commission's Standard Contractual Clauses (2021/914). We currently do not transfer personal data outside the EEA in normal operations.

How to countersign

Download the template, fill the controller details (you), sign, scan, email to legal@drape.studio. We countersign within two working days. You will receive the double-signed PDF for your records.

Custom DPA for Maison plan

Maison plan customers can request modifications to the template (specific retention, additional security clauses, region-specific addenda). Email legal@drape.studio and our back office will engage.