Data processing agreement
Last updated: 24 October 2026
This data processing agreement ("DPA") is part of the Stripnest terms of service. It applies between the business that uses Stripnest ("Customer", the controller) and Računalniške storitve, Kristjan Reba s.p., trading as Reba Labs, Slovenia ("Processor"; details in the imprint), whenever the Processor processes personal data on the Customer's behalf through Stripnest. It takes effect when the Customer accepts the terms and needs no signature. If you need a signed copy for your records, write to privacy@reba-labs.com.
Words such as personal data, processing, controller, processor and personal data breach have the meaning given in the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
1. Subject, duration, nature and purpose
| Subject | Providing the Stripnest service: storing uploaded part files, computing strip layouts, keeping and exporting the results |
| Duration | For as long as the Customer's account exists, and until deletion under section 8 |
| Nature | Storage, computation, display, export, backup and deletion on the Processor's servers |
| Purpose | Only to provide the service to the Customer under the terms and the Customer's instructions |
| Data subjects | The Customer's employees and other people it lets use its account; people named in files the Customer uploads |
| Types of personal data | Names, email addresses or other details the Customer puts into part names, projects, quotes or files (for example CAD author fields), and API key names |
The Customer's own account details (sign-in email, billing) are processed by the Processor as a controller under the privacy policy, not under this DPA. Special categories of personal data are not needed for the service, and the Customer should not upload them.
2. Instructions
The Processor processes personal data only on the Customer's documented instructions. The terms, this DPA and the Customer's use of the service's features (uploading, running, exporting, deleting) are those instructions. The Processor informs the Customer if it believes an instruction breaks data protection law, and processes the data otherwise only where EU or Slovenian law requires it, telling the Customer first unless that law forbids it.
3. Confidentiality
Only the owner of the Processor and people working for it under a duty of confidentiality have access to the data, and only as far as needed to run, secure and support the service.
4. Security (Art. 32)
The Processor keeps these technical and organisational measures in place, and may improve them over time:
- Data is stored in the EU (Hetzner data centre in Helsinki, Finland); all connections use HTTPS.
- Each customer's data is separated in the application; every request is checked against the account that owns the data.
- Passwords are stored with scrypt; session tokens, reset links and API keys are stored only as hashes.
- Uploaded files are type-checked and first opened in a separate process with time, memory and CPU limits.
- Server access only by SSH key; no password logins and no root logins over SSH.
- Application logs contain no email addresses, IP addresses, cookies or file contents.
- Nightly backups, kept for 14 days.
- Security fixes are applied to the server and the application as they become available.
5. Sub-processors
The Customer gives general authorisation for the Processor to use sub-processors. The current ones are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH, Germany | Server hosting and storage | Helsinki, Finland (EU) |
| Cloudflare, Inc., USA | DNS, encryption, protection against attacks; requests pass through its network | Global network; EU-US Data Privacy Framework and standard contractual clauses |
| Resend, Inc., USA | Sending service emails such as password reset links | USA; standard contractual clauses |
Stripe processes payment data as an independent controller, not as a sub-processor.
The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for them. It announces a new or replacement sub-processor by updating this page and emailing account holders at least 30 days in advance. The Customer may object on reasonable data protection grounds within that time; if no solution is found, the Customer may cancel and receives a refund of the unused part of a prepaid period.
6. Transfers outside the EU
Personal data is stored in the EU. Where a sub-processor processes it outside the EEA, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
7. Assistance
Taking into account the nature of the processing, the Processor helps the Customer:
- to answer requests from data subjects (access, correction, deletion, portability); the in-app data export and deletion cover most of these, and the Processor forwards any request it receives directly;
- with security, data protection impact assessments and prior consultation, as far as they concern the service.
Personal data breaches: the Processor notifies the Customer without undue delay, and where possible within 48 hours, after becoming aware of a breach affecting the Customer's data, with the information available at the time, and keeps it informed.
8. Deletion and return
The Customer can export its data at any time (Account → Download my data). When the Customer deletes data or its account, the Processor deletes it from the live system at once and from backups within 14 days, unless EU or Slovenian law requires it to be kept.
9. Audits
The Processor makes available the information needed to show compliance with Art. 28 GDPR, in the first place by answering written questions and through this DPA. Where that is not enough, the Customer may carry out an audit, or have an independent auditor bound to confidentiality carry one out, at its own cost, with at least 30 days' notice, during working hours and at most once a year, unless a breach or a supervisory authority requires otherwise.
10. Liability and order of precedence
Liability under this DPA follows section 10 of the terms of service, except where the GDPR provides otherwise. If this DPA and the terms conflict on data protection, this DPA prevails. This DPA is governed by the law of the Republic of Slovenia.
Contact
Data protection questions: privacy@reba-labs.com