Snapshot 7831
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data processing by Nextcloud GmbH for Nextcloud Enterprise customers We differentiate fundamentally from cloud service providers: we develop and deliver the Nextcloud Enterprise software to our customers, who operate it themselves or through a hosting provider of their choice. We have no access to any data customers process within their Nextcloud installations. We do not provide hosting services and consequently do not act as data controller for personal data processed on customer-operated or third-party hosted Nextcloud instances. The following only applies to Nextcloud Enterprise customers: In certain defined situations, we may collect limited personal data from and about these customers. Such collection occurs only where customers actively interact with us, for example when requesting support or sharing diagnostic information. There are ten specific circumstances in which we may collect personal data, outlined below. No. Processing activity Personal data Retention period 1 When admins provide their names and email addresses to subscribe to the Nextcloud security update newsletter, including log. Name, email address (can be pseudonymous) Email log that includes the content and metadata Message ID, Status (Delivered, Processed, Undeliverable), Email address, Subject, Tag (always empty), Date and Time, Bounce reason (if undelivered). Until consent is withdrawn 45 days. 2 When procurement officials contact us with pre-contractual questions, sign-up for licenses and communicate about procurement and legal issues, including log. Name, email address, name of company/organisation + contents of the communication Email log that includes the content and metadata Message ID, Status (Delivered, Processed, Undeliverable), Email address, Subject, Tag (always empty), Date and Time, Bounce reason (if undelivered). 7-10 years statutory retention periods under the German Fiscal Code (AO) and German Commercial Code (HGB) for relevant business correspondence. 45 days. 3 When admins ask for third level support from us and share data about themselves and possibly other colleagues in the support ticket and/or attachment. This processing includes the registration of metadata about the filing of support tickets. Contents of support request + attachments, plus technical data. Support tickets 3 years after contract termination. Admins can request Nextcloud to delete all support tickets older than 13-15 months. Support metadata: retained as long as the ticket exists. Plus: Nextcloud’s sub-processor Zammad retains the Zammad Production Log with technical data relating to the use of the Support portal for 42 days. In incidental cases Nextcloud has to retain a specific support ticket for 7-10 years, for compliance with statutory retention periods under the German Fiscal Code (AO) and German Commercial Code (HGB). This is only the case if a support ticket documents a contractual dispute, where a customer asks for reimbursement or damages via a support ticket, and engages in legal procedures against Nextcloud. 4 When admins voluntarily share Diagnostic Data with us, in one of three ways: When they install the Support App; When they share the System Information Report; When they share the Usage Survey data. IP-address + Subscription key + Instance ID. The Support app and Usage Survey app collect the number of users (pseudonymous data) together with configuration data such as version and installed apps. The System Information Report can contain customer identifiers (Talk URLs). Nextcloud additionally technically always collects the IP address when a customer uses the Support app and shares Usage Survey data or when a customer files a support request and shares a System Information Report. As long as the contract exists. IP addresses collected by the Support Portal are stored for 7 days. 5 When admins and legal employees of organisations visit Nextcloud.com to look up legal and technical information. This includes processing of personal data via functional cookies, and registration of visitor data in a webserver access log. (Nextcloud.com) IP address, browser, OS, timestamp, visited page. 7 days in webserver access log, only processed in RAM memory before aggregation for analytics Maximum expiry date for cookies in visitor’s browser: 30 days. Nextcloud does not store the cookie information in any other log. 6 When admins visit the admin and support portal to file support tickets. This includes processing of personal data via functional cookies, and registration of visitor data in a web server access log. (Support portal) IP address, browser, OS, timestamp, visited page. 7 days in webserver access log, only processed in RAM memory before aggregation for analytics Maximum expiry date for cookies in visitor’s browser: 30 days. Nextcloud does not store the cookie information in any other log. 7 When admins and end users update the software (software update and release download logs). (Software update) IP address, query string containing the Subscription Key (for Enterprise instances) and configuration information such as the current Nextcloud and PHP versions, installation date, and the chosen release channel. 14 days. 8 When admins and end users enable push notifications from Nextcloud on their mobile devices. Device ID and the date on which the device was registered as well as the public key used for push notification delivery. Until the app is deinstalled or the account removed from the device. 9 If a customer chooses to engage one of our (sub-) processors (e.g. technology partners). (Commercial Contact Data – depends on the technology partner), number of licenses, duration of the contract. As long as necessary to fullfil the contract. 10 If admins and end users file a Data Subject Rights’ request (log of privacy and access requests). Reply to a DSAR can contain any of the above mentioned data. 2 years after the request. Data collected for the 10 circumstances above comes from these 7 sources: 1. Data collection via outbound mail (admins) 2. Data collection via outbound mail (commercial contact data) The logs contain Message ID, Status (Delivered, Processed, Undeliverable), Email address, Subject, Tag (always empty), Date and Time, Bounce reason (if undelivered). 3. Data collection via support portal log User actions (ticket creation, updates, login events) Internal application processes Errors and warnings API requests Database interactions Permission problems Email processing results Incoming mail fetch results IMAP/POP3 connection status Mail parsing errors Ticket creation from emails Successful logins Failed login attempts Session creation Logout events API authentication OAuth / LDAP authentication (if used) 4. Diagnostic Data collection via Usage Survey data If admins share Usage Survey data with us, they share the unique ID of the Nextcloud instance (for example: ocee3ii9ih59). The Usage Survey gathers broad insights into how Nextcloud is used. It collects high-level diagnostic data, such as installed apps, PHP versions, and Nextcloud release versions. It is much more comprehensive than the Support app and is primarily used for ecosystem statistics. Admins can choose to share some or all of the following categories of data via the Usage Survey Data: Server instance details (version, memcache used, status of locking/previews/avatars) PHP environment (version, memory limit, max execution time, max file size) Database environment (type, version, database size) App list (for each app: name, version, enabled status) Statistics (number of files, users, storages per type, comments and tags) Number of shares (per type and permission seting) Encryption information (is it enabled, what is the default module) via Support App The Support App collects strictly functional and targeted data that are directly relevant for troubleshooting support cases, alongside the user count required for account and license management. subscription key instance id user count version active user count app list Data collection via System Information Report The report includes very detailed configuration and status information. We have taken steps to remove identifying data from the report, as marked with the words: “***REMOVED SENSITIVE VALUE***”. System Information reports do not collect the ID of the Nextcloud instance, or passwords/secrets/tokens and hostnames. However, the report can include some data that can help identify the specific customer, via URLs that include the organisation name of the customer. Since we have the contact data for the admin and the commercial contact person, this data is identifiable for us. As mentioned in the table, we also collect the IP address with which the (identifiable) admin connects to the support portal. We only retain these IP addresses for 7 days. 5. Data collection via webserver access log Example: 127.0.0.1 - max [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326 "http://www.example.com/start.html" "Mozilla/4.08 [en] (Win98; I ;Nav) 6. Update and download logs Example of update check by self-hosted Nextcloud server <ip> - - [26/Feb/2026:00:00:21 +0000] "GET /customers/<subscriptionKey>/?version=27x1x11x3x1677622860.9738x1772064018xstablexx2024-06-25T10:28:34+00:00%20883b016f74f1f65a55c42c75fe04c1262936a190x8x2x30x3x1 HTTP/1.1" 200 5360 "-" "Nextcloud Server Crawler" 9401 Whenever an admin downloads a new version of the software from Nextcloud’s hosted repository (not from the GitHub repository), the download request is logged. This log contains the IP address, the timestamp, and the specific file requested (e.g., a .zip archive). <ip> - - [26/Feb/2026:03:02:18 +0000] "GET /server/releases/nextcloud-29.0.16.zip HTTP/1.1" 200 24386311 "-" "Nextcloud Updater" 247256452 7. Push proxy log The push proxy (running on servers managed by Nextcloud) operates with deliberately limited knowledge: it holds the user public key, device identifier, push token, and the Google/Apple developer certificate, but not the device private key. It therefore cannot decrypt the content of push notifications. The proxy verifies the notification signature, re-signs it with the appropriate developer certificate, and forwards it to Google (Firebase Cloud Messaging) or Apple (APNs). No notification content is logged or stored in persistent form. (Potential) subprocessors Nextcloud GmbH engages a limited number of subprocessors. Not every subprocessor is relevant to every customer, it depends on the scope of the Nextcloud Enterprise subscription. Storage locations outside the EU/EEA are shown together with the applicable transfer mechanism. No. Subprocessor Data transferred Location of storage Purpose of processing Duration Locations of access 1 AC PM, LLC Email content United States (adequacy decision under Art. 45 GDPR, limited to organisations certified under the EU-US Data Privacy Framework) Email delivery service (Postmark) Same as subscription United States 2 Collabora Ltd Company name, name, email address, number of licenses, duration of contract, support data United Kingdom (adequacy decision under Art. 45 GDPR, renewed 19 December 2025 and valid until 27 December 2031) Provision of licenses and support services for Nextcloud Office Same as subscription Bosnia and Herzegovina, Czech Republic, France, Germany, Hong Kong, Hungary, India, Ireland, Nigeria, Philippines, Portugal (EU-only support is available on request; please contact your account manager) 3 Hetzner Online GmbH Name, email address Germany Hosting of portal.nextcloud.com Same as subscription European Union (Hetzner does not maintain a list of individual countries; according to its statement, access is limited to authorised support personnel and takes place from within the EU) 4 Odoo SA Name, email address (commercial and admin) European Union Provision of security information and updates Same as subscription EU service offices, and the United States, Mexico, Brazil, Kenya, United Arab Emirates, India, Hong Kong, Indonesia and Australia, safeguarded by EU standard contractual clauses. The list reflects established personnel locations and may expand over time. 5 OpenProject GmbH Company name, name, email address, number of licenses, duration of contract, support data Germany Provision of licenses and support services for OpenProject Same as subscription Germany, Spain 6 Open-Xchange AG Company name, name, email address, number of licenses, duration of contract, support data Germany Provision of licenses and support services for Dovecot Pro Same as subscription Finland, France, Germany, Italy, Japan, Netherlands, Spain, United States 7 Sendent BV Company name, name, email address, number of licenses, duration of contract, support data Netherlands Provision of licenses and support services for MS Outlook Add-in, MS Exchange Connector, MS Teams Integration Same as subscription Netherlands, Poland, Philippines 8 Stalwart Labs Ltd. Company name, name, email address, number of licenses, duration of contract, support data United Kingdom (adequacy decision under Art. 45 GDPR, renewed 19 December 2025 and valid until 27 December 2031) Provision of licenses and support services for Stalwart Same as subscription Greece, Italy, Portugal, Slovenia, Spain, United Kingdom 9 Struktur AG Company name, name, email address, number of licenses, duration of contract, support data Germany Provision of licenses and support services for the Nextcloud Talk High Performance Back-end and SIP bridge Same as subscription Germany 10 Thinkfree Inc. Company name, name, email address, number of licenses, duration of contract, support data Republic of Korea (adequacy decision under Art. 45 GDPR of 2021, confirmed on review 23 July 2026) Provision of licenses and support services for Thinkfree Office Same as subscription Republic of Korea 11 XWiki SAS Company name, name, email address, number of licenses, duration of contract, support data France Provision of licenses and support services for XWiki Same as subscription France, Germany, Luxembourg, Romania, Brazil 12 Zammad GmbH Name, email address, support tickets Germany Provider of the Nextcloud support portal Same as subscription Croatia, Cyprus, Germany, Spain We save some cookies to count visitors and make the site easier to use. This doesn't leave our server and isn't to track you personally! See our Privacy Policy for more information. Customize Customize Essentials More details Essential cookies enable basic functions and are necessary for the proper function of the website. Accept cookie Cookie name:wp-wpml_current_language Cookie description:Set the language on the website Cookie expiry:No expiration Consent Accept cookie Cookie name:nc_cookie_banner Cookie description:Saves the cookie containing the user cookies preferences Cookie expiry:30 days Consent Accept cookie Convenience More details Cookies used to save the data entered in forms, such as name, email, phone number, and preferred language. Accept cookie Cookie name:nc_form_fields Cookie description:Remembers the data filled in the forms for the next time (name, email, phone and preferred language) Cookie expiry:30 days Consent Accept cookie Cookie name:nc_utm_parameters Cookie description:We use cookies to store UTM parameters from your visit so we can understand how you arrived at our website. Cookie expiry:30 days Consent Accept cookie Statistics More details Statistics cookies collect information anonymously and help us understand how our visitors use our website. We use cloud-hosted Matomo Accept cookie Service:Matomo Cookies description: _pk_ses*: Counts the first visit of the user _pk_id*: Helps not to double count the visits. mtm_cookie_consent: Remembers that consent for storing and using cookies was given by the user. Cookies expiry:_pk_ses*: 30 minutes _pk_id*: 13 months mtm_cookie_consent: 30 days Consent Accept cookie External media More details Allows connections for loading external media. No cookies from external media services will be set. Accept cookie Service:Play Youtube videos Service description: All of the Youtube videos get unblocked if this setting is saved Cookie expiry: - Consent Accept cookie Service:Play Vimeo videos Service description: All of the Vimeo videos get unblocked if this setting is saved Cookie expiry: - Consent Accept cookie Service:Show OpenStreetMap iframes Service description: All of the OpenStreetMap iframes get unblocked if this setting is saved Cookie expiry: - Consent Accept cookie