Data processing agreement

Last updated: 9 October 2026.

This describes the data-protection roles between you (the customer) and EBORACUM IT LTD, a company registered in England and Wales (company number 17237831), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, when you use SPSync. If your organisation needs a signed, bespoke DPA for procurement, email [email protected] and we will send one; this page is the standing terms that apply either way.

The short version, by edition

• Desktop app, command line, and In your Azure (the managed application in your own subscription). We do not process your SharePoint data at all. It never reaches infrastructure we operate. No controller/processor relationship arises for that data, because we are simply not a party to its processing. See the privacy notice.
• The earlier hosted private preview (invite-only, closed to new customers) has no live deployment today, so no SharePoint data is processed through it as things stand. See the sub-processor list. If and when a tenant on it is deployed, our own infrastructure would process the SharePoint data that tenant chose to replicate, on its documented instructions (which lists to sync, and to where); for that processing, the tenant would be the controller and we would be its processor, and the terms below would apply.
• Diagnostic bundles you send us. A bundle does not contain your SharePoint list content, but it does contain site/list URLs and ids, your replication configuration and recent logs. This is information that can identify your organisation or its setup. We act as your processor for the limited purpose of investigating the issue you reported; today, with no Azure Storage account connected, a bundle is received and immediately discarded rather than kept (see the sub-processor list), which is more conservative than the retention terms below, not less.
• Website, support and licence administration. Contact details, form submissions and licence/activation records are ours to hold as controller, for our own purpose of running the business relationship with you. It is covered by the privacy notice, not this page.

Processor terms (private preview and diagnostic bundles)

Where we act as your processor under the two cases above, we will:

• process the data only on your documented instructions, unless required to do otherwise by law;
• ensure anyone we allow to access it is under a confidentiality obligation;
• take appropriate technical and organisational measures against unauthorised or unlawful processing and against loss, destruction or damage (access to preview infrastructure and to diagnostic storage is restricted to the engineering and support team, and storage is not publicly accessible);
• not engage a further processor for that data without telling you which one and why (see the sub-processor list);
• assist you, so far as reasonably possible, in responding to a data subject's request or a personal data breach affecting that data;
• delete or return the data at the end of the engagement, on request; diagnostic bundles are deleted automatically 60 days after upload regardless; and
• make available the information reasonably necessary to demonstrate compliance with the above.

Where processing happens

Private-preview data processing location: the private preview has no live deployment today (see above). If a tenant is deployed, the intended location is Microsoft Azure, UK South by default, with West Europe and US East available on request, fixed when the tenant is created.

Diagnostic bundles: none are stored today (see above). Once an Azure Storage account is connected for this purpose, they will be held in Microsoft Azure, UK South (see the sub-processor list).

International transfers

Where a sub-processor on our list is based outside the UK or the EEA, or may process data there, we rely on that provider's own standard safeguards for the transfer (such as the UK's International Data Transfer Addendum or equivalent Standard Contractual Clauses in their standard terms). If your organisation needs the specifics of a particular sub-processor's transfer mechanism for your own records, ask us and we will find out.

Sub-processors

See the full sub-processor list. We will give reasonable notice before adding a new sub-processor to a processing activity covered above.

Contact

[email protected] for a signed DPA, a security questionnaire, or any question about how we handle your data.