Back to home

Legal

Data Processing Agreement

pursuant to Art. 28 GDPR for the use of Slayper. This is a translation; the German version is legally binding.

Parties

Controller (hereinafter “Customer”): the company that uses Slayper, as specified in the customer account or in the order.

Processor (hereinafter “Slayper”): David Hörnlein-Ulrich | Slayper, Kolonie 2, 14798 Havelsee, Germany, info@slayper.com.

This Data Processing Agreement (DPA) applies for the entire term of the Customer's use of Slayper. It is concluded when the Customer accepts it in text form, for example by email to info@slayper.com or as part of the order.

Section 1 Subject matter and term

(1) Slayper provides the Customer with a service for the end-to-end encrypted transfer of files, with apps, download and upload pages, upload links, inbox, address book, transfer records and interfaces to business software. In doing so, Slayper processes personal data on behalf of the Customer. The nature, purpose, types of data and data subjects are set out in Annex 1.

(2) Processing takes place exclusively in the European Union, currently in Germany. Any relocation to a third country requires the prior consent of the Customer and fulfillment of the requirements of Art. 44 et seq. GDPR.

(3) This DPA ends when the use ends. The provisions on deletion and return (Section 9) continue to apply beyond that.

Section 2 Instructions

(1) Slayper processes the data only on documented instructions from the Customer, unless a legal obligation requires otherwise; in that case, Slayper informs the Customer of this obligation in advance, unless the law prohibits this. Instructions are this DPA, the Customer's settings and actions in the service (for example recipients, protection, expiry, integrations) and individual instructions in text form.

(2) If Slayper considers an instruction to be unlawful, Slayper informs the Customer without undue delay and may suspend its execution until it is confirmed.

Section 3 Obligations of Slayper

(1) Slayper ensures that all persons who have access to the data are bound to confidentiality.

(2) Slayper implements the technical and organizational measures pursuant to Art. 32 GDPR set out in Annex 2 and adapts them to the state of the art. The level of protection must not decrease in the process.

(3) Slayper supports the Customer with appropriate measures in responding to requests from data subjects (Art. 12 to 22 GDPR) and in complying with the obligations under Art. 32 to 36 GDPR. Slayper forwards requests from data subjects that reach Slayper to the Customer without undue delay.

(4) Slayper notifies the Customer of personal data breaches without undue delay, where possible within 24 hours of becoming aware of them, with the information pursuant to Art. 33(3) GDPR, insofar as available.

(5) Slayper maintains a record of processing activities pursuant to Art. 30(2) GDPR.

(6) Contents of transfers, file names, messages, references and address books are encrypted on the users' devices. Slayper has no access to the keys and cannot read this content. To that extent, Slayper's obligations to hand over or rectify data relate only to the encrypted data.

Section 4 Obligations of the Customer

(1) The Customer is responsible for the lawfulness of the processing, in particular for informing recipients and uploaders pursuant to Art. 13 and 14 GDPR. For this purpose, Slayper provides the privacy policy for the service, to which the Customer can refer.

(2) The Customer informs Slayper without undue delay if it detects errors or irregularities in the processing.

(3) If the Customer uses an integration with its own business software, it is itself responsible for the processing of the data transmitted there (Annex 1, No. 6).

Section 5 Sub-processors

(1) The Customer approves the sub-processors listed in Annex 3.

(2) Slayper informs the Customer in text form at least 30 days in advance of any intended addition or replacement. Within this period, the Customer may object for an important reason relating to data protection law. If the parties do not reach an agreement, the Customer may terminate the contract for the use of Slayper with effect from the date of the change.

(3) Slayper contractually binds sub-processors to the obligations of this DPA and is liable for their compliance pursuant to Art. 28(4) GDPR.

(4) Services that do not concern personal data of the Customer do not constitute sub-processing, in particular the anchoring of fingerprints (hashes) of the transfer records via OpenTimestamps (Annex 1, No. 5).

Section 6 Transfer records

(1) For every transfer, Slayper creates a transfer record on behalf of the Customer. It serves exclusively the Customer's documentation, in particular its accountability under Art. 5(2) GDPR.

(2) Transfer records are automatically deleted ten years after the respective event. During the term of the contract, they can be neither modified nor deleted early by the Customer or by Slayper; this is an instruction of the Customer within the meaning of Section 2. Statutory deletion obligations remain unaffected.

(3) Transfer records prove the download and the complete, unaltered decryption of files, not that a specific person has taken note of them. They are not qualified trust services within the meaning of the eIDAS Regulation.

Section 7 Audit rights

(1) Slayper makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular a current description of the measures pursuant to Annex 2.

(2) The Customer may carry out audits, including inspections, itself or through an auditor bound to confidentiality, after timely notice, during normal business hours and without disrupting operations. The data centers of the sub-processors are audited on the basis of their own evidence and certificates.

Section 8 Liability

Liability is governed by Art. 82 GDPR. Otherwise, the liability provisions of the contract for the use of Slayper apply.

Section 9 Deletion and return

(1) Transfers and requests are automatically deleted in accordance with the periods in Annex 1, No. 4.

(2) After the use ends, Slayper makes the transfer records available to the Customer for download for 30 days (Art. 28(3)(g) GDPR). Slayper then deletes all of the Customer's data: accounts, transfers, requests, address books and transfer records. Entries created in the transfer records of other customers regarding transfers with the Customer belong to their transfer record and are deleted there in accordance with their periods. Any statutory retention obligations of the Customer (for example Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)) are the responsibility of the Customer from that point onward.

Section 10 Final provisions

(1) Amendments and additions must be made in text form.

(2) In the event of conflicts, this DPA takes precedence over other agreements in matters of data protection.

(3) German law applies. If any provision is invalid, the remainder of the DPA remains valid.

Annex 1: Subject matter of the processing

1. Purpose

Provision of the service: encrypted transfer and requesting of files, delivery to the inbox of Slayper accounts, confirmation of recipients, notifications, transfer records and connection to the Customer's business software.

2. Data subjects

3. Types of data

IP addresses are not stored. To defend against password guessing, they are kept in memory for no more than 15 minutes.

4. Periods

5. OpenTimestamps

Every hour, a single fingerprint (32 bytes) covering all new transfer records is sent to public OpenTimestamps servers and anchored in the Bitcoin blockchain. The fingerprint contains no personal data.

6. Integrations

On the Customer's instructions, Slayper reports events to the Customer's business software (time, type, reference ID, email address and browser indication of persons downloading, recipient list, number and size of files, name and email address of uploaders, protection and expiry information). In the embedded window, Slayper passes links including keys, PINs where applicable, and, at the user's request, decrypted files to the business software.

Annex 2: Technical and organizational measures

Confidentiality

Integrity

Availability and resilience

Data minimization and deletion

Organization

Annex 3: Sub-processors

Last updated: October 18, 2026