Data processing agreement

1. Parties and conclusion

This agreement is between you as the account holder (the controller) and quebi GmbH, Geitau 22, 83735 Bayrischzell, Germany (the processor). It forms part of the terms of service and applies to every account, including free ones, as soon as you process personal data of others through quebi cloud. No separate signature is needed. If this agreement and the terms conflict on data protection, this agreement prevails.

For content held in an organisation — its shared drives and its members' spaces — the organisation is the controller, acting through its owners and admins, and this agreement is between it and us. Its members use the service under its instructions: the organisation decides who may access that content, what happens to a departing member's space, and when the organisation and everything in it is erased. A member's own account remains a separate controller relationship for what they keep there.

A folder link may let people outside your account add files to your folder. What they send is your content under this agreement from the moment it arrives, with the name and address they chose to give: you are the controller for it, and you decide who may add files, how much and for how long. We process it on your instructions like anything else you store, and delete the record of who sent what with the link.

2. Subject, nature and duration

• Subject and purpose: storing, organising, processing and sharing files and photos as the service provides.
• Types of data: whatever you upload — which may include any kind of personal data, including images of people and the metadata embedded in files.
• Data subjects: the people your content relates to, such as your employees, customers, members, contacts or family.
• Duration: as long as your account exists.

You are responsible for the lawfulness of the processing and for the rights of the data subjects towards you.

3. Instructions

We process the data only on your documented instructions, including with regard to transfers to third countries, unless EU or German law requires otherwise — in which case we tell you first, unless that law prohibits it. Your instructions are this agreement and your use of the product's functions. We will tell you if we believe an instruction infringes data protection law.

4. Confidentiality

Everyone at quebi GmbH authorised to process the data is bound to confidentiality.

5. Security

We take the technical and organisational measures required by Art. 32 GDPR. We may improve them; we will not lower the overall level of protection.

6. Sub-processors

You authorise us to engage sub-processors. We bind each one by contract to data protection obligations equivalent to these, and we remain responsible for them. The sub-processors engaged today are:

• Bunny Magic Containers and Edge Scripting — BunnyWay d.o.o., Slovenia. The application itself.
• Bunny CDN — BunnyWay d.o.o., Slovenia. Delivery.
• Bunny Magic Containers — BunnyWay d.o.o., Slovenia. Editing together, live.
• Bunny Database — BunnyWay d.o.o., Slovenia. Account records, folders, photo metadata.
• Bunny Storage, EU regions — BunnyWay d.o.o., Slovenia. Your files and photos.
• Bunny Storage — BunnyWay d.o.o., Slovenia. JavaScript, stylesheets and the typeface.
• Lettermint — Lettermint B.V., Netherlands. Transactional email.

BunnyWay processes the content you store. Lettermint delivers the emails we send — a sign-up confirmation, a password-reset link, the confirmation of a change of address, the invitations an organisation sends to the people it adds, notification emails, notices of invoices and payment reminders, and the invitations, changes and cancellations an event's organiser sends to guests without an account — and receives the recipient address and that message. A notification email names who did what and the title of what it concerns, such as a card, a document or an event; an event invitation carries the event's title, time and place and the organiser's name and address. Neither ever carries a comment's text, an event's description or a file's content. Our bank, which receives payments as a controller in its own right, and the public DNS resolver we ask about a custom domain you connect to a published site are not sub-processors: neither processes personal data on our instructions.

We inform you at least 30 days before adding or replacing a sub-processor. You can object on reasonable data protection grounds; if we cannot resolve the objection, you can end the contract before the change takes effect. Data is processed only in the EU/EEA.

7. Assistance

Taking into account the nature of the processing, we assist you with requests from data subjects (Art. 12–23 GDPR) — primarily through the product itself, where you can find, download and delete your content — and with your obligations under Art. 32–36 GDPR. If a data subject contacts us directly, we refer them to you.

8. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information we have that you need to meet your own obligations.

9. Deletion at the end

When the contract ends, we delete the data from the live service. Copies in backups expire on the schedule stated in the privacy policy and are used in the meantime only to recover from a loss. Download anything you want to keep beforehand; the product lets you do that yourself.

10. Information and audits

We make available the information needed to demonstrate compliance with Art. 28 GDPR, and allow audits by you or an auditor you mandate who is bound to confidentiality. Audits take place on reasonable notice, during business hours, without disrupting operations, and at your cost. Where our published information answers the question, it takes the place of an on-site audit.

11. Liability and law

Liability follows Art. 82 GDPR and, otherwise, the terms of service. German law applies. Only the German version of this agreement is binding.