Data processing agreement (dpa) — Nextcloud Files (Nextcloud Hub)

Cited by

Facts read from this source

• No hosting no controller Report an error

  “We do not provide hosting services and consequently do not act as data controller for personal data processed on customer-operated or third-party hosted Nextcloud instances.”

• No customer data access Report an error

  “We have no access to any data customers process within their Nextcloud installations.”

• Processing scope Report an error

  “The following only applies to Nextcloud Enterprise customers:”

• Ten processing activities Report an error

  “There are ten specific circumstances in which we may collect personal data, outlined below.”

• Newsletter retention Report an error

  “Name, email address (can be pseudonymous) Email log that includes the content and metadata Message ID, Status (Delivered, Processed, Undeliverable), Email address, Subject, Tag (always empty), Date and Time, Bounce reason (if undelivered). Until consent is withdrawn 45 days.”

• Procurement retention Report an error

  “7-10 years statutory retention periods under the German Fiscal Code (AO) and German Commercial Code (HGB) for relevant business correspondence.”

• Support tickets retention Report an error

  “Support tickets 3 years after contract termination. Admins can request Nextcloud to delete all support tickets older than 13-15 months.”

• Zammad log retention Report an error

  “Nextcloud’s sub-processor Zammad retains the Zammad Production Log with technical data relating to the use of the Support portal for 42 days.”

• Diagnostic data ip retention Report an error

  “IP addresses collected by the Support Portal are stored for 7 days.”

• Website cookies Report an error

  “Maximum expiry date for cookies in visitor’s browser: 30 days. Nextcloud does not store the cookie information in any other log.”

• Update log retention Report an error

  “IP address, query string containing the Subscription Key (for Enterprise instances) and configuration information such as the current Nextcloud and PHP versions, installation date, and the chosen release channel. 14 days.”

• Push notification data Report an error

  “Device ID and the date on which the device was registered as well as the public key used for push notification delivery. Until the app is deinstalled or the account removed from the device.”

• Dsar retention Report an error

  “If admins and end users file a Data Subject Rights’ request (log of privacy and access requests). Reply to a DSAR can contain any of the above mentioned data. 2 years after the request.”

• Seven data sources Report an error

  “Data collected for the 10 circumstances above comes from these 7 sources:”

• Push proxy no decryption Report an error

  “It therefore cannot decrypt the content of push notifications. The proxy verifies the notification signature, re-signs it with the appropriate developer certificate, and forwards it to Google (Firebase Cloud Messaging) or Apple (APNs). No notification content is logged or stored in persistent form.”

• System report no secrets Report an error

  “System Information reports do not collect the ID of the Nextcloud instance, or passwords/secrets/tokens and hostnames.”

• Transfer mechanism disclosure Report an error

  “Storage locations outside the EU/EEA are shown together with the applicable transfer mechanism.”

• Ac pm Report an error

  “AC PM, LLC Email content United States (adequacy decision under Art. 45 GDPR, limited to organisations certified under the EU-US Data Privacy Framework) Email delivery service (Postmark)”

• Collabora Report an error

  “Collabora Ltd Company name, name, email address, number of licenses, duration of contract, support data United Kingdom (adequacy decision under Art. 45 GDPR, renewed 19 December 2025 and valid until 27 December 2031) Provision of licenses and support services for Nextcloud Office”

• Collabora EU only support Report an error

  “(EU-only support is available on request; please contact your account manager)”

• Hetzner Report an error

  “Hetzner Online GmbH Name, email address Germany Hosting of portal.nextcloud.com”

• Odoo Report an error

  “Odoo SA Name, email address (commercial and admin) European Union Provision of security information and updates”

• Openproject Report an error

  “OpenProject GmbH Company name, name, email address, number of licenses, duration of contract, support data Germany Provision of licenses and support services for OpenProject”

• Open xchange Report an error

  “Open-Xchange AG Company name, name, email address, number of licenses, duration of contract, support data Germany Provision of licenses and support services for Dovecot Pro”

• Sendent Report an error

  “Sendent BV Company name, name, email address, number of licenses, duration of contract, support data Netherlands Provision of licenses and support services for MS Outlook Add-in, MS Exchange Connector, MS Teams Integration”

• Stalwart Report an error

  “Stalwart Labs Ltd. Company name, name, email address, number of licenses, duration of contract, support data United Kingdom (adequacy decision under Art. 45 GDPR, renewed 19 December 2025 and valid until 27 December 2031) Provision of licenses and support services for Stalwart”

• Struktur Report an error

  “Struktur AG Company name, name, email address, number of licenses, duration of contract, support data Germany Provision of licenses and support services for the Nextcloud Talk High Performance Back-end and SIP bridge”

• Thinkfree Report an error

  “Thinkfree Inc. Company name, name, email address, number of licenses, duration of contract, support data Republic of Korea (adequacy decision under Art. 45 GDPR of 2021, confirmed on review 23 July 2026) Provision of licenses and support services for Thinkfree Office”

• Xwiki Report an error

  “XWiki SAS Company name, name, email address, number of licenses, duration of contract, support data France Provision of licenses and support services for XWiki”

• Zammad Report an error

  “Zammad GmbH Name, email address, support tickets Germany Provider of the Nextcloud support portal”

• Entity Report an error

  “© 2016 - 2026 Nextcloud GmbH”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Agency Producer European sovereignty
• The Architecture Practice Partner European sovereignty
• The Data Protection Officer European sovereignty
• The IT Lead European sovereignty
• The Skeptic European sovereignty
• The Tax Adviser European sovereignty