Data Processing Agreement

Version 2026-10-16. Effective 16 October 2026. This Data Processing Agreement forms part of the Nestify Terms of Service.

1. Scope and parties

This Data Processing Agreement ("DPA") is entered into between Raligo AB, reg. no. 559568-8275, Krukmakargatan 18, 118 51 Stockholm, Sweden ("Raligo", "we") and the customer organization that accepts the Nestify Terms of Service (the "Customer"). It governs the personal data that Raligo processes on the Customer's behalf when the Customer uses the Nestify web application at app.nestifysystems.com (the "Service").

This DPA is incorporated into the Terms of Service by reference. The Customer accepts it when its owner accepts the Terms on first sign-in, and again whenever a new version of the Terms or this DPA is accepted in the Service. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. A DPA that the parties have signed separately remains binding and prevails over this document.

This DPA applies to Customer Content as defined in the Terms. It does not apply to the personal data of the Customer's users that Raligo processes as a controller for its own purposes (account, billing, security, communication). That processing is described in the Privacy Policy.

2. Definitions

"GDPR" means Regulation (EU) 2016/679. "Personal data", "processing", "controller", "processor", "sub-processor", "data subject", "supervisory authority" and "personal data breach" have the meanings given in the GDPR. "Customer Personal Data" means personal data contained in Customer Content: files the Customer uploads or connects (for example PDF and AI print files, which may contain names, addresses, order numbers or images of persons), the parts and geometry extracted from them, the settings the Customer chooses, and the exports the Service produces. "Applicable Data Protection Law" means the GDPR, the Swedish Data Protection Act (2018:218) and any other law that applies to the processing.

3. Roles

The Customer is the controller of Customer Personal Data. Raligo is the processor. The Customer decides what it uploads and connects, and is responsible for having a lawful basis for the processing and for giving data subjects the information required by Applicable Data Protection Law.

Where the Customer connects a cloud storage account (Dropbox or Microsoft OneDrive) for hotfolders, the storage provider acts under the Customer's own agreement with that provider. The provider is not a sub-processor of Raligo. Raligo accesses only the folders the Customer selects, as the Customer's processor.

4. Instructions

Raligo processes Customer Personal Data only on the Customer's documented instructions. The Customer's instructions are: the Terms, this DPA, the settings the Customer chooses in the Service, and the actions the Customer takes in it, such as uploading a file, starting a nest, connecting a hotfolder or downloading an export. Processing required by Union or Member State law is also permitted; Raligo informs the Customer of that requirement before processing, unless the law prohibits it.

Raligo tells the Customer without undue delay if, in Raligo's opinion, an instruction infringes Applicable Data Protection Law. Raligo may then pause the affected processing until the instruction is confirmed or changed.

The Customer confirms that it has the right to upload the Customer Content, including any personal data in it, and that it does not upload special categories of personal data (GDPR article 9) or data on criminal convictions. The Service is not designed for such data.

5. Raligo's obligations

Confidentiality. Raligo ensures that every person it authorizes to process Customer Personal Data is bound by a confidentiality obligation. Raligo's staff do not open Customer Content except to investigate a security incident, an abuse report or a fault the Customer has reported, and only to the extent needed.

Security. Raligo implements the technical and organizational measures in Annex 2 and keeps them up to date with the state of the art, the risks of the processing and GDPR article 32. Raligo may change the measures, but not in a way that lowers the level of protection.

Data subject requests. Raligo helps the Customer respond to requests from data subjects under GDPR articles 15 to 22, by appropriate technical and organizational measures and as far as possible given the nature of the processing. A request that reaches Raligo directly and concerns Customer Personal Data is forwarded to the Customer without undue delay. Raligo does not answer it on the Customer's behalf unless instructed.

Assistance. Raligo helps the Customer meet its obligations under GDPR articles 32 to 36 (security, breach notification, data protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to Raligo. Raligo may charge a reasonable fee for assistance that goes beyond what the Service provides as standard.

Personal data breach. Raligo notifies the Customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice is sent to the organization owner's email address and describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Raligo may provide the information in phases as it becomes available.

Records and cooperation. Raligo keeps the records required by GDPR article 30(2) and cooperates with the competent supervisory authority on request.

6. Sub-processors

The Customer gives Raligo a general authorization to use the sub-processors listed in Annex 3. Raligo imposes on each sub-processor, by written contract, data protection obligations that give at least the same level of protection as this DPA. Raligo remains fully liable to the Customer for the sub-processor's performance.

Raligo informs the Customer at least 10 days before it adds or replaces a sub-processor that processes Customer Personal Data, by email to the organization owner or by a notice in the Service, and keeps Annex 3 current at nestifysystems.com/dpa. The Customer may object in writing within that period on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service, or the Service, with effect before the change takes place, and receives a pro rata refund of prepaid fees for the remaining period.

7. International transfers

Raligo stores and processes Customer Personal Data in the EU: the database and file storage in Ireland, the application and the nesting engine in the Netherlands. Raligo does not transfer Customer Personal Data outside the EU/EEA, and does not permit a sub-processor to do so, unless the transfer is covered by an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for a certified recipient) or by the Standard Contractual Clauses adopted by the Commission, with supplementary measures where needed. Annex 3 states the location and transfer mechanism for each sub-processor. The Customer may ask for a copy of the safeguards.

8. Deletion and return

The Service deletes Customer Content on a fixed schedule. Source files, extracted parts and exports of a nest are deleted 48 hours after the nest finishes. The job record stays listed as expired for a further 7 days and is then deleted. Files that a hotfolder fetched from the Customer's cloud storage follow the same schedule; the originals stay in the Customer's own storage, in the provider's trash or recycle bin.

The Customer can delete a nest and its files at any time in the Service. When the Customer's account or organization is closed, or on the Customer's written request, Raligo deletes all remaining Customer Personal Data within 30 days, unless Union or Member State law requires longer storage. Billing records are kept for 7 years under the Swedish Bookkeeping Act, but they contain no Customer Content. Backups held by a sub-processor are overwritten within that sub-processor's backup retention period, at most 7 days.

Before deletion, the Customer may download its exports from the Service. Raligo does not provide a separate return of Customer Content beyond that.

9. Audits

Raligo makes available to the Customer the information needed to show compliance with GDPR article 28, including this DPA, Annex 2 and the current sub-processor list. On request, Raligo provides summaries of the security certifications and audit reports of its sub-processors (for example SOC 2 reports for Supabase, Railway and Sentry) to the extent they are available to Raligo.

If that information is not enough to show compliance, the Customer may audit the processing once per calendar year, or after a personal data breach, with at least 30 days' written notice. The audit is carried out during business hours, does not disrupt the Service, covers only the processing of Customer Personal Data, and is performed by the Customer or an independent auditor bound by confidentiality. The Customer bears its own costs and reimburses Raligo's reasonable costs for time beyond one working day. Audits of a sub-processor are done through the sub-processor's own audit mechanisms.

10. Liability

Each party is liable for damage caused by processing that breaches this DPA or Applicable Data Protection Law, as set out in GDPR article 82. Between the parties, the limitations and exclusions of liability in section 12 of the Terms apply to claims under this DPA, except where Applicable Data Protection Law does not allow liability to be limited.

11. Term and changes

This DPA applies for as long as Raligo processes Customer Personal Data on the Customer's behalf, and the obligations in sections 5 and 8 survive until all Customer Personal Data has been deleted. Raligo may update this DPA to reflect changes in law, in the Service or in the sub-processors. For a material change Raligo gives at least 30 days' notice by email or in the Service and asks the Customer to accept the new version. If the Customer does not accept, it may terminate the Service under section 14 of the Terms. The version date at the top shows the current version.

12. Governing law

This DPA is governed by Swedish law. Disputes are settled as set out in section 15 of the Terms, without prejudice to the data subjects' rights and the supervisory authorities' powers under the GDPR.

Questions about this DPA: hello@nestifysystems.com.

Annex 1: Details of the processing

Annex 2: Technical and organizational security measures

• Encryption in transit. All connections to the Service, between its components and to sub-processors use TLS.
• Encryption at rest. The database and file storage are encrypted at rest by the hosting provider. Access tokens for connected cloud storage are additionally encrypted with a key held only by Raligo.
• Tenant isolation. Every database table that holds customer data is protected by row-level security tied to the Customer's organization. File storage is private, and paths are scoped per organization. Signed, short-lived URLs give the nesting engine access to the files of one job only.
• Access control. Only the organization's own members can see its nests and exports. Raligo staff access production systems with individual accounts and multi-factor authentication. Staff do not open Customer Content except as stated in section 5.
• Least privilege for services. The nesting engine holds no database credentials. Internal endpoints require a shared secret compared in constant time.
• Secure development. Secrets are never stored in source code. Dependencies are pinned and vendored for the engine. Changes pass automated tests, type checks and static analysis before release. Staging and production are separate environments with separate data.
• Error monitoring without content. Error reports exclude request bodies, cookies, IP addresses, database values and file contents. Screen recordings taken on errors mask all text and block all images.
• Deletion. Files are deleted on the schedule in section 8 by an automated job, and the Customer can delete a nest at any time.
• Security headers and hardening. Strict transport security, content security policy, no framing, and a non-root runtime for the nesting service.
• Incident response. A documented process for detecting, assessing and reporting personal data breaches within the time in section 5.
• Sub-processor assurance. Sub-processors that host Customer Personal Data hold SOC 2 Type II or ISO 27001 certification and are bound by data processing agreements.

Annex 3: Sub-processors

Current as of 2026-10-16. Changes are announced under section 6.

The following parties receive data but are not sub-processors of Customer Personal Data: Stripe (payments; processes the Customer's billing data as described in the Privacy Policy), and the cloud storage provider the Customer connects for hotfolders (Dropbox or Microsoft), which acts under the Customer's own agreement.