Data Processing Agreement (DPA)
Data Processing Agreement for GDPR Article 28 compliance
Version 1.0
Last updated: August 13, 2026
Available on every plan
If you process personal data through Kworia, your organization may need a Data Processing Agreement (DPA) under GDPR Article 28. DPA execution is available on all plans at no additional cost.
GDPR Article 28 Template
Our DPA follows the European Data Protection Board guidelines and covers all mandatory provisions.
Current Subprocessors
A current list of all third-party services that process data on behalf of Kworia.
Security Measures
Technical and organizational measures we implement to protect your data.
Data Subject Rights
How we support your obligations regarding data subject access requests.
Download DPA Template
Download our standard DPA template, review it with your legal team, and return the signed copy.
How to Use This DPA
-
1
Download the Template
Click the download button above to get our standard DPA template.
-
2
Review with Your Legal Team
Have your legal team review the agreement. Contact us if you need modifications.
-
3
Fill in Your Details
Add your company information to the designated sections.
-
4
Sign and Return
Sign the DPA and email it to support@kworia.com.
-
5
Confirmation
We will countersign and return the fully executed DPA within 5 business days.
Frequently Asked Questions
Do I need a DPA?
If you process personal data of EU residents through Kworia (e.g., customer names, addresses on invoices), a DPA is required under GDPR Article 28.
Is the DPA included in my plan?
DPA execution is available on all plans at no additional cost. Enterprise customers get priority legal support.
Can I modify the DPA?
Our standard DPA covers most requirements. For Enterprise customers, we can accommodate reasonable modifications. Contact our legal team.
Where is my data processed?
All invoicing data is processed within the European Union, except by the two processors that operate outside it: payment data is processed by Stripe Inc. (USA) and transactional and document-delivery email is carried by Resend, Inc. (USA), both under Standard Contractual Clauses. The application runs in EU datacenters, your documents are stored with Impossible Cloud in Germany (eu-central-2), and ArchiveVault fiscal archives are stored in France (eu-west-3). See our subprocessor list for details.