Data Processing Agreement

1. Scope

This Data Processing Agreement (DPA) forms part of the Terms between the customer and Nebulix for business use of PressCard AI. It applies when Nebulix processes personal data on behalf of a business customer.

2. Roles

The customer is the controller for personal data entered into PressCard AI (client names, user accounts, job records, financial data). Nebulix is the processor for that customer data and may also act as controller for billing, support, and security records.

3. Processing Details

Subject matter: providing printing press workflow management software including job cards, cutting plans, stock, estimates, invoices, delivery notes, accounts, and reports.

Data categories: user names and emails, client names and contacts, job specifications, paper and stock records, financial transactions, and session activity logs.

Purpose: service delivery, security, billing, fraud prevention, and legal compliance.

4. Processor Obligations

• Process customer personal data only on documented instructions, unless required by law.
• Apply appropriate confidentiality, access control, and security safeguards (scrypt hashing, HTTPS, session cookies).
• Assist with reasonable data-subject, audit, deletion, and security requests.
• Notify customers without undue delay after becoming aware of a confirmed personal data breach affecting customer data.

5. Sub-Processors

Nebulix may use the following categories of sub-processors for PressCard AI:

• Hetzner / Coolify for server infrastructure and container hosting
• Stripe for subscription payment processing
• Nebulix Platform (Supabase) for subscription validation records
• Cloudflare for DNS and network security

Nebulix remains responsible for sub-processor performance as required by applicable data-protection law.

6. International Transfers

Customer workspace data is hosted on Hetzner servers in Nuremberg, Germany (EU). Where data is transferred outside the UAE or your home jurisdiction, Nebulix relies on contractual, technical, and organisational safeguards including encryption in transit.

7. Deletion and Return

At the end of the subscription, Nebulix retains workspace data for 90 days to allow for data export, then deletes the workspace. Billing, tax, and legal records are retained as required by applicable law.

8. Contact

DPA requests: [email protected].