This data processing agreement (the "Agreement") governs, under Article 28 of the GDPR, how Nubbo processes the personal data you manage with the service when you use it as a business or professional. It forms part of the Terms & Conditions, which link to it and which you accept when you sign up. You accept it by using Nubbo.
1. Parties and roles
- Controller: you, as the holder of the Nubbo account, the "user".
- Processor: Gonzalo Vasco López, tax ID ES34884272B, with address at Rúa Farillon 10, 1ºE, 27890 San Ciprián, Lugo, Spain, owner of Nubbo, "Nubbo".
This Agreement does not apply to the data Nubbo is a controller for: the data of your own account, the data it processes for its own security and abuse prevention, the data of its aggregated cookieless measurement, the delivery records and suppression list of the emails it sends on your behalf and the identification of Nubbo users who visit your resources while signed in, described in the privacy policy.
2. Subject matter and duration
The subject matter of the Agreement is the processing of personal data needed to provide you with the Nubbo service described in the Terms & Conditions. It lasts while you keep your account and, afterwards, until the data is deleted as set out in section 11.
3. Nature and purpose of the processing
Nubbo processes the data only to provide the service to you. The processing consists of: keeping the index of your files (names, paths, sizes and types); generating the presigned URLs through which files travel directly between the browser and your storage; publishing and serving your shared links, galleries, file requests and embeds; recording the visits, downloads, likes, comments and uploads of their visitors and showing you their statistics; sending invitations, deliveries, reminders and passwords by email on your behalf; reading file content ephemerally to generate thumbnails, gallery sizes and watermarks and run your automations; and, only if you give your consent, sending Nubbo AI the content needed for what you ask it.
4. Data subjects and categories of data
Data subjects: the visitors of your links, galleries, file requests and embeds; the people you invite or send something to; the people whose data appears in your files, in their names or in your conversations with Nubbo AI; and anyone else whose data you decide to process with Nubbo.
Categories of data: identification and contact data (name and email); usage data of your resources (visits, downloads, likes, comments, searches and uploads); a visitor identifier that changes every day, derived from the IP address and the browser, the country and the device type; file metadata (names, paths, sizes and types); file content, processed ephemerally; and the data you include in your files and texts.
Special categories: Nubbo is not designed to process special categories of data (Article 9 GDPR). If you store them in Nubbo, you must make sure there is a legal basis that allows it. To protect them, we recommend zero-knowledge encryption, with which Nubbo cannot read the content or the names of your files. Bear in mind that if you send one of those files to Nubbo AI, its content is processed to answer you (section 9 of the privacy policy).
5. Documented instructions
Nubbo processes the data only on your documented instructions. Your use of the service and its settings (what you upload, share, publish, send, automate or ask Nubbo AI) are those instructions. Nubbo does not process the data for its own purposes. If European Union or Member State law required it to process the data otherwise, it will tell you first, unless that law prohibits it. If Nubbo considers that an instruction infringes data protection law, it will inform you immediately.
6. Confidentiality
The people Nubbo authorises to process the data are bound to keep it confidential, by express commitment or by a statutory obligation.
7. Security
Nubbo applies the technical and organisational measures of Article 32 of the GDPR described in Annex I, and may improve them as long as they do not lower the level of protection.
8. Subprocessors
- You give Nubbo a general authorisation to engage the subprocessors on the list of subprocessors. That list also includes providers that only process data Nubbo is a controller for, such as Creem.
- Nubbo enters into a contract with each subprocessor imposing the same data protection obligations as this Agreement, with sufficient guarantees, under Article 28.4 of the GDPR, and remains liable to you for their compliance.
- Before adding or replacing a subprocessor, Nubbo will update the list and announce it by email or in the app promptly and at least 10 days in advance.
- You can object to the change on reasonable data protection grounds by writing to [email protected]. If we cannot find a solution, you can end the service by deleting your account before the change applies, and we will refund the pro-rata part of any fees you prepaid and have not used.
9. Assistance
- Data subject rights: Nubbo helps you handle them with the features of the service (viewing, exporting, disabling and deleting your resources; deleting a resource deletes its visitors' data) and, where these are not enough, by answering your requests by email. If a data subject contacts Nubbo, Nubbo will pass the request on to you without delay.
- Security, breaches, impact assessments and prior consultations: Nubbo will help you comply with Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to it: with the measures in Annex I, with the breach notification in section 10 and by giving you the information you need for a data protection impact assessment or a prior consultation with the supervisory authority.
10. Security breaches
If Nubbo suffers a security breach affecting the data it processes on your behalf, it will notify you without undue delay and in any case within 48 hours of becoming aware of it, by email to your account's address. The notice will include the information in Article 33.3 of the GDPR available at that time and Nubbo will provide the rest as soon as it has it.
11. End of the processing
Before deleting your account you can download your data from Settings › Profile. When you delete the account, the data is kept during the 30-day grace period, unless you choose immediate deletion, and is then erased. It may remain for up to 14 days in the backups before it is erased. The files in your storage are yours and Nubbo does not delete them, except the thumbnails and versions it generated there. All of this applies unless a law requires some data to be kept.
For data minimisation, the export delivers the data of visitors and recipients pseudonymised (masked emails, names cut to their initial and aliases instead of session identifiers). As the controller of that data, you can see it in the app or ask us for the full version at [email protected] and we will deliver it within one month at most.
12. Audits
Nubbo makes available to you the information needed to demonstrate compliance with this Agreement: this document, the privacy policy, the list of subprocessors and answers to your reasonable written inquiries. If a supervisory authority requires it or that information is not enough to demonstrate compliance, we will agree with you on a reasonable audit, carried out by you or by an auditor you mandate, at your cost, with sufficient notice, under confidentiality and without access to other users' data.
13. International transfers
Nubbo only transfers data outside the European Economic Area to the subprocessors on the list and with the Chapter V GDPR safeguards stated there: Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework.
14. Liability
Each party's liability is governed by the limitation of liability section of the Terms & Conditions, without prejudice to the liability towards data subjects set out in Article 82 of the GDPR.
15. Precedence and applicable law
On data protection matters, this Agreement prevails over the Terms & Conditions. Otherwise the Terms & Conditions apply, including their applicable law and jurisdiction.
Annex I. Security measures
- AES-256-GCM encryption of your bucket credentials, two-factor secrets and Nubbo AI conversations, with the key kept outside the database.
- Optional zero-knowledge encryption in your browser, with which Nubbo cannot read the content or the names of encrypted files, unless you yourself send a specific file to Nubbo AI (section 9 of the privacy policy).
- Passwords stored with bcrypt hashing.
- Optional two-factor authentication (TOTP), with recovery codes.
- Files travel directly between the browser and your storage through presigned URLs; the server only reads content ephemerally, without keeping it.
- Communications encrypted with HTTPS (TLS 1.2 or higher) and web servers reachable only through Cloudflare's protection network.
- Sessions with automatic expiry, management of active sessions and a notice when you sign in from a new device.
- Account activity log and access log of what you share with people.
- Per-IP request limits and a captcha on forms.
- Database backups (continuous, daily and nightly), encrypted before they leave the server and kept in the European Union for 14 days. Restoration is tested every week.
- Servers and database in the European Union, reachable only over a private network; production access restricted to the owner and authorised people, with least privilege.
Annex II. Subprocessors
The up-to-date list of subprocessors, with their purpose, the data they process, their location and their safeguards, is on the subprocessors page.
Contact
For any questions about this Agreement, write to [email protected].