Legal

Terms of use, privacy notice and data processing agreement for DC Relay, a service of Digital Crafted GmbH. Version 1.0, 24 October 2026. The German version is binding; this translation is for information.

1. Summary

Everyone confirms this summary before first use. The full texts below are binding.

Purpose: DC Relay is only for exchanging files for business purposes. Only send data you are allowed to pass on. You are responsible for content, third-party rights, confidentiality agreements and export control.
Not allowed: malware, unlawful content, getting around security measures, and passing on credentials or personal links.
No archive: transfers are deleted for good after 30 days at the latest. There is no backup of the files. Keep your originals yourself.
Data: we process name, e-mail address, IP address and order data (subject, file names, sizes, checksums) to run the service and prove deliveries. The log is kept for 4 years. Accounts are deleted after 500 days without sign-in. The operator sees metadata, but no file contents through the application. As the server's administrator, the operator technically has access to the storage.
Liability: the service is provided without guaranteed availability. We are fully liable for intent, gross negligence, injury to life, body or health and under the Product Liability Act. Otherwise we are only liable for breach of essential obligations, limited to the typical, foreseeable damage.
Blocking: in case of misuse we may block access and withdraw transfers.

German law applies.

2. Terms of use

§ 1 Provider and scope

(1) DC Relay is run by Digital Crafted GmbH (the "operator", "we"). Address and registration details are in the imprint.

(2) These terms apply to every use of DC Relay: with an account (staff, customers, administrators) and without one (recipients of a personal link, people uploading through a file request).

(3) DC Relay is meant for companies, authorities and self-employed persons acting in their professional capacity (§ 14 BGB). Use as a consumer is not intended.

(4) Users' own terms only apply if we agree to them in writing. Individual contracts with an organisation (e.g. on quotas or fees) take precedence over these terms.

§ 2 Service

(1) DC Relay lets the parties to a transfer upload, provide and download files, with e-mail notification, checksum, malware scan, acknowledgement of receipt and log.

(2) DC Relay is neither an archive nor a backup. Every transfer is deleted automatically and for good 30 days after it was created at the latest, earlier depending on its classification. No backup copy of transferred files is made. Not even the operator can restore deleted files.

(3) The malware scan reduces the risk but cannot rule out malware for certain. Check received files with your own protection before opening them.

(4) We aim for smooth operation but do not guarantee any particular availability. Maintenance, security updates and faults can interrupt the service from time to time.

(5) We may develop the service further and change features, as long as the core of the service (secure file exchange) remains.

§ 3 Access and accounts

(1) Accounts are created by the operator, by an organisation's administrators or through an invitation. Details given must be true.

(2) Credentials, recovery codes, the authenticator app and personal links must be kept secret and must not be passed on. If you suspect that someone unauthorised knows them, change your password and inform us or your administrator straight away.

(3) Two-factor sign-in is mandatory for certain roles and classifications.

(4) Accounts without sign-in are deleted after 500 days. Before that you get six reminders by e-mail during the last 28 days. Signing in keeps the account.

§ 4 Users' obligations

(1) Only transfer content you are entitled to pass on. You are responsible for complying with copyright and other property rights, confidentiality agreements, data protection law and export control rules.

(2) In particular, it is not allowed to:

transfer malware or files meant to harm systems,
transfer unlawful content,
get around, test or overload security measures without our written consent,
use the service as general storage, as a public download platform or for sending advertising.

(3) Choose the classification to match the content and check recipient addresses before sending. A personal link is only for the person it was sent to.

(4) Only transfer personal data of others where you are entitled to.

§ 5 Rights to content

All rights to transferred content remain with the users or rights holders. The operator only receives the rights technically needed for storing, checking, providing and deleting it. Content is not analysed and not used for any other purpose.

§ 6 What the operator sees

(1) To run the service and detect misuse, the operator sees metadata of all organisations: organisations, users, subject, sender, recipients, file names, sizes, status and the log.

(2) The application gives the operator no access to file contents. As the server's administrator, the operator technically has access to the storage and uses it only where strictly necessary for operation, security or a legal obligation.

(3) Interventions by the operator (e.g. blocking, withdrawing) require a reason and appear in the affected organisation's log.

§ 7 Blocking

If there is a well-founded suspicion of a breach of these terms or a threat to the service, we may block access temporarily or permanently and withdraw transfers. We take the legitimate interests of those affected into account and inform them unless that would defeat the purpose.

§ 8 Fees

Use is free of charge for recipients and uploaders. Fees for organisations are agreed separately.

§ 9 Liability

(1) We are fully liable for intent and gross negligence, for injury to life, body or health, under the Product Liability Act and to the extent of any guarantee given.

(2) For slightly negligent breach of an essential contractual obligation (one whose fulfilment makes proper performance possible in the first place and on whose observance you may regularly rely), liability is limited to the typical, foreseeable damage.

(3) Otherwise liability for slight negligence is excluded. This applies in particular to the loss of files after the deletion period and to damage caused by malware in transferred files, provided we exercised customary care.

(4) These limitations also apply to our staff and agents.

§ 10 Data protection and processing on behalf

How we process personal data is described in the privacy notice. If an organisation uses DC Relay for its own transfers, the data processing agreement also applies.

§ 11 Term and termination

(1) Use without an account ends when the transfer or file request expires. Accounts run for an indefinite period and can be ended by either side at any time in text form.

(2) When an account or organisation ends, its data is deleted. Log entries remain until their 4-year period expires.

§ 12 Changes to these terms

We may change these terms for the future, for example for new features or changes in the law. Changed terms are shown on next use and must be confirmed again. Without confirmation, further use is not possible.

§ 13 Final provisions

(1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods.

(2) The place of jurisdiction for merchants, legal entities under public law and special funds under public law is the operator's registered office.

(3) If a provision is invalid, the rest remains valid and the statutory rule takes its place.

3. Privacy notice

Information under Art. 13 and 14 of the General Data Protection Regulation (GDPR) on the processing of personal data in DC Relay.

Controller

Digital Crafted GmbH, address see imprint. Contact for data protection requests: via the contact details in the imprint.

If another organisation uses DC Relay for its own transfers, that organisation is the controller for the data of its transfers, and we process it on its behalf (see data processing agreement). In that case, please contact the organisation that sent you the transfer first.

What data, what for, on what basis, and for how long

Data	Purpose	Legal basis	Retention
Account data: name, e-mail address, organisation, role, password hash, two-factor key (encrypted)	Sign-in, permissions, notifications	Art. 6(1)(b) GDPR (contract); for customers' staff (f) (legitimate interest in the cooperation)	until the account is deleted, at the latest 500 days after the last sign-in
Transfers: files, subject, message, project, reference, recipient addresses	Transfer and delivery	(b) or (f)	files at most 30 days; order data without file contents until the account or organisation is deleted
Metadata: file names, sizes, checksums, scan result, times of download and acknowledgement	Proof of delivery, integrity	(f) (proof), (b)	as order data
Log: action, time, IP address, browser identifier, affected accounts and addresses	Security, misuse detection, proof towards the parties	(f) (security and proof), (c) (legal obligations)	4 years, then deleted automatically
Server logs with IP address	Operation and troubleshooting	(f)	30 days; the log file of the audit log 1 year
Feedback you send through the application	Handling your request	(f), where applicable (b)	until handled, at most 500 days

Providing the data is required for use. Without an e-mail address and the log, a secure, provable exchange is not possible. There is no automated decision-making or profiling.

Recipients

The parties to a transfer see the details that belong to it (e.g. sender, subject, file names).
Administrators and auditors of your organisation see its orders and log.
The operator sees metadata of all organisations (see terms of use § 6).
Notifications are sent through the operator's e-mail service provider.
Authorities only receive data where there is a legal obligation.

The server is located in Germany. No transfer to countries outside the EU or EEA is intended.

Cookies and local storage

DC Relay only uses technically necessary cookies: a session cookie after sign-in and a session cookie for recipients of a link. The browser also stores language, colour scheme and the last selected organisation. There are no analytics, advertising or tracking cookies and no third-party content.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Log entries are not deleted before their period expires where they are needed as proof or for the defence of legal claims (Art. 17(3)(e) GDPR).

You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the alleged infringement.

Security

Transfer only over TLS, two-factor sign-in, malware scan, checksums, separated organisations, an unalterable log and automatic deletion. Details are in the help and in annex 1 of the data processing agreement.

4. Data processing agreement (Art. 28 GDPR)

between the organisation using DC Relay for its own transfers (controller) and Digital Crafted GmbH (processor). The agreement becomes part of the use as soon as an administrator of the controller accepts these terms. On request we also provide it as a signed document.

1. Subject and duration

The processor runs DC Relay and processes personal data on behalf of the controller. The agreement applies as long as the controller uses DC Relay and ends when its organisation is deleted.

2. Nature, purpose, data and data subjects

Nature and purpose: storing, checking, providing and deleting files, as well as notification, proof of delivery and logging.
Types of data: contact data (name, e-mail address), credentials, order data, log data (including IP addresses), personal data contained in transferred files (content determined by the controller).
Data subjects: the controller's staff, its customers and partners, recipients and uploaders, and people whose data is contained in files.

3. Instructions

The processor only processes the data on documented instructions from the controller. The instructions are set out in this agreement and in the application's settings; further instructions are given in text form. If the processor considers an instruction unlawful, it says so without delay. It announces processing required by law beforehand unless the law prohibits this.

4. Confidentiality

Persons with access to the data are bound to confidentiality.

5. Technical and organisational measures

The processor takes the measures under Art. 32 GDPR described in annex 1. It may adapt them to the state of the art as long as the level of protection does not drop.

6. Sub-processors

The processor runs the server itself. It uses an e-mail service provider to send notifications. It only engages further sub-processors after informing the controller in text form beforehand, provided the controller does not object for good cause within 14 days. Sub-processors are bound by contract to the same level of protection. A current list is available on request.

7. Assistance

The processor assists the controller with data subject requests, notification of data breaches, data protection impact assessments and requests from supervisory authorities. Much of this the controller can look up itself in the log and the administration area.

8. Data breaches

The processor reports a personal data breach without undue delay after becoming aware of it, with the information under Art. 33(3) GDPR as far as available.

9. Deletion and return

Files are deleted automatically according to the application's periods, at the latest after 30 days. When the agreement ends, all of the controller's data is deleted. Log entries remain until their 4-year period expires and are then deleted. Because of the short periods, returning files is not intended. The controller can export order data and the log beforehand.

10. Evidence and inspections

The processor provides the information needed to demonstrate compliance. After timely notice, the controller may carry out inspections during business hours, or have them carried out by an auditor bound to confidentiality, without disrupting operations disproportionately.

11. Liability

Art. 82 GDPR applies. Otherwise the liability rules of the terms of use apply.

Annex 1: technical and organisational measures

Area	Measures
Physical and system access	Server on the operator's premises, no entry for unauthorised persons; access to the server only for the operator, by key-based sign-in; firewall, only the web interface is reachable from the internet.
Sign-in	Passwords of at least 12 characters, stored as Argon2 hash; two-factor sign-in (mandatory for staff and administrators and for strictly confidential transfers); lock after repeated failed attempts; sessions expire.
Access control	Roles and permissions per organisation; organisations strictly separated and tested automatically; personal links only stored as hash and limited in time; strictly confidential transfers only with an account and two-factor sign-in.
Transmission	Transfer only TLS-encrypted; checksum (SHA-256) for every file; delivery only to the named recipients.
Input control	Unalterable log of all security-relevant actions in the database (changes technically blocked), kept for 4 years.
Availability and integrity	Malware scan with quarantine; storage reserve and quotas; monitoring of hardware and services with alerts; regular security updates; daily backup of the metadata (deliberately no backup of files).
Separation and deletion	Automatic deletion of files after 30 days at the latest, of accounts after 500 days without sign-in, and of the log after 4 years.
Organisation	Operator interventions only with a reason and a log entry; regular review of the measures.

5. Imprint and contact

Provider identification, address and registration details of Digital Crafted GmbH: imprint.

Questions about using the service are answered in the help. Signed-in users can also reach us through Feedback in the application.