1. Parties and application
This Data Processing Agreement (DPA) is between the customer identified in the STRG account or order (Customer) and Stack Technology GmbH, Zollergasse 7/1/5, 1070 Wien, Austria (STRG). Contact: .
This DPA forms part of the Terms of Service whenever STRG processes Customer Personal Data on Customer’s behalf. It supplements the Terms of Service and takes precedence for processing of Customer Personal Data. Mandatory data protection law and any applicable transfer clauses take precedence over conflicting contractual terms.
2. Roles and processing instructions
Customer is the controller, or a processor authorized by its controller. STRG acts as processor or subprocessor for personal data contained in customer objects, object metadata and instructions submitted to the service (Customer Personal Data). GDPR terms have the meanings given in Regulation (EU) 2016/679.
STRG will process Customer Personal Data only on documented instructions, including the agreement, selected region, API requests and authorized console or agent actions. STRG will promptly inform Customer if an instruction appears to infringe applicable data protection law. Where processing is required by EU or Member State law, STRG will notify Customer beforehand unless prohibited by law. Customer determines lawful purposes, provides notices and authorizes its users.
3. Processing schedule
- Subject and purpose: provision, protection and support of object storage and customer-requested related tools.
- Nature: receiving, organizing, storing, retrieving, copying, transmitting, restricting and deleting data; support access only where necessary and authorized.
- Duration: service term and the return or deletion process described in section 10.
- Frequency: ongoing as instructed by Customer.
- Data subjects: Customer’s users, employees, contractors, customers and other individuals represented in uploaded data.
- Data categories: identifiers, contact details, customer-selected documents, media and other personal data submitted by Customer.
- Sensitive data: Customer must identify special-category or criminal-offence data before production use so the parties can agree additional safeguards and suitability.
- Locations: customer-selected storage region for objects; provider processing and operational access are subject to sections 5 and 6 and the provider disclosure.
- Customer contact: the account’s designated privacy or administrative contact, as confirmed in the order.
4. Confidentiality and security
STRG will restrict processing to authorized personnel subject to confidentiality obligations and implement appropriate technical and organizational measures under Article 32 GDPR. Measures will be maintained and reviewed against risk; changes must not materially reduce the agreed level of protection.
The security schedule covers encrypted transport, encryption of stored objects, least-privilege access, credential revocation, administrative access logging, vulnerability and patch management, incident handling, availability and restoration procedures, and regular effectiveness testing. STRG maintains documentation of its security measures and makes relevant compliance information available under section 9. This agreement does not represent a certification or independent audit report.
5. Subprocessors
Customer gives general written authorization for subprocessors in the provider disclosure. STRG will impose data protection obligations providing substantially the same protection and remains responsible for their performance of those obligations. The provider disclosure on the Subprocessors and service providers page identifies OVHcloud and Cloudflare, with Stripe separately listed for billing. Processing scope and locations depend on the contracted services and customer configuration; billing providers are distinguished from processors of stored objects.
STRG will notify Customer’s designated contact at least 30 days before adding or replacing a customer-data subprocessor, allowing an objection on reasonable data protection grounds. The parties will seek a practical alternative. If none is available, Customer may end the affected service before the change, export its data and receive a refund of unused prepaid fees for that service.
6. International transfers
STRG will transfer Customer Personal Data outside the EEA only on documented instructions and in compliance with Chapter V GDPR. Where required, the parties will execute the relevant EU transfer clauses with completed annexes and assess supplementary safeguards before transfer. This DPA alone is not an international-transfer mechanism. Choosing an EU bucket does not by itself settle the location of support access or operational metadata.
7. Assistance and individual rights
STRG will promptly forward requests relating to Customer Personal Data and will not respond on Customer’s behalf unless authorized or legally required. Taking account of processing and available information, STRG will assist Customer with individual rights, security duties, breach notifications, impact assessments and prior consultation under Articles 32–36 GDPR.
8. Personal data breaches
STRG will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notification will describe the known nature, affected categories and approximate numbers where available, likely consequences, response measures and a contact point. Information may be provided in stages as the investigation proceeds. STRG will cooperate in containment, remediation and Customer’s legal notification duties.
9. Information and audits
STRG will provide information reasonably needed to demonstrate compliance with Article 28 GDPR and permit and contribute to audits, including inspections by Customer or an independent auditor. Reasonable notice, confidentiality and safeguards for other customers apply; these arrangements must not prevent a legally required audit, urgent investigation or supervisory-authority access.
10. Return and deletion
At the end of processing, Customer may choose return or deletion of Customer Personal Data, unless EU or Member State law requires retention. Customer may export its data through the service during the service term. Following termination, STRG will return or delete Customer Personal Data, at Customer’s choice, and delete remaining copies without undue delay unless EU or Member State law requires retention. Until erased, backup data will remain protected and excluded from ordinary use.
Customer should export its data before closing the account. Customer-configured immutable retention, legal holds and applicable law may restrict immediate erasure. Where deletion from backups cannot occur immediately, STRG will isolate the data from ordinary processing, maintain protection and erase it through the backup lifecycle. STRG will explain applicable restrictions and provide confirmation of deletion on request.
11. AI features
AI processing is limited to customer-authorized prompts, selected context and tool actions. STRG will not use Customer Personal Data, prompts or assistant conversations to train general-purpose AI models. Any AI provider accessing Customer Personal Data must be identified and authorized in the provider disclosure before use, with applicable no-training terms and transfer safeguards.
12. Contact and agreement
Questions, processing instructions and requests under this DPA can be sent to . Customer will keep its administrative and privacy contacts current. Any separately negotiated processing terms apply to the extent agreed in writing and permitted by applicable data protection law.