Data Processing (DPA)

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. Subject matter and duration

1.1 Subject matter

The subject matter of the order results from the Service Specification, to which reference is hereby made, and from any additional services agreed in the Main Agreement (hereinafter the “Service Agreement”).

In doing so, the Contractor processes personal data on behalf of the Client within the meaning of Art. 4(2) and Art. 28 GDPR on the basis of this Agreement.

Unless otherwise provided in the Service Agreement, the data processing comprises in particular the provision of cloud infrastructure (IaaS), hosting, virtual servers, storage, network and platform services as well as managed services of the Contractor. Processing takes place exclusively on the basis of instructions within the framework of Art. 28 GDPR.

In addition, the Contractor processes technical usage data and metadata (“Usage Data”) to the extent necessary for the performance of the contract, ensuring system security, error analysis, performance optimisation, capacity planning, misuse detection, billing and the provision of usage overviews and analyses.

Where possible, these data are processed in anonymised or pseudonymised form. The processing of anonymised data for statistical, security-related or operational purposes of the Contractor remains permissible.

1.2 Duration

The duration of this order corresponds to the term of the Service Agreement.

Processing ends at the latest upon complete erasure or return of all personal data in accordance with the provisions of this Agreement.

The Client may terminate the Agreement at any time without notice if there is a serious breach by the Contractor of data protection provisions or of the provisions of this Agreement, if the Contractor cannot or will not carry out an instruction of the Client, or if the Contractor refuses the Client’s audit rights in breach of contract.

2. Nature and purpose of the processing, type of personal data and categories of data subjects

2.1 Nature of the processing

The nature and purpose of the processing of personal data by the Contractor on behalf of the Client are specifically described in the Service Agreement.

The processing of personal data under this Agreement shall in principle take place exclusively in Germany or within the European Union or the European Economic Area.

Any relocation of the processing or of partial services to a third country requires the prior documented consent of the Client and is permissible only if the requirements of Art. 44 et seq. GDPR are met.

Where sub-processors in third countries are used, the Contractor shall ensure that appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place, in particular through the conclusion of the EU Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914 or on the basis of an adequacy decision of the European Commission.

2.2 Type of personal data

The types of personal data generated by the Client and used by the Contractor include in particular the following types and categories of data:

Personal master data

Communication data

Contract master data

Contract billing and payment data

Usage data

Planning and control data

Logging and log data

IP addresses

Content data

Employee data

Information provided by third parties

The specific type of data is determined by the Client through its use of the services.

2.3 Categories of data subjects

The following categories of data subjects in particular may be affected by the processing:

Customers

Prospective customers

Employees

Suppliers

Commercial agents

Contact persons

Users

other third parties whose data are processed by the Client

3. Technical and organisational measures

Before the start of processing, the Contractor shall document the implementation of the necessary technical and organisational measures set out prior to the award of the order, in particular with regard to the specific performance of the order, and hand them over to the Client for review.

Upon acceptance by the Client, the documented measures become the basis of the order.

Where the review or an audit by the Client reveals a need for adjustment, this shall be implemented by mutual agreement.

The Contractor shall establish security pursuant to Art. 28(3)(c), Art. 32 GDPR, in particular in conjunction with Art. 5(1) and (2) GDPR.

Overall, the measures to be taken are measures of data security and measures to ensure a level of protection appropriate to the risk with regard to:

confidentiality,

integrity,

availability,

the resilience of the systems.

In doing so, the state of the art, the costs of implementation and the nature, scope and purposes of the processing shall be taken into account, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons.

The technical and organisational measures are subject to technical progress and further development.

In this respect, the Contractor is permitted to implement alternative adequate measures. In doing so, the security level of the specified measures must not be undercut.

Material changes shall be documented.

The Contractor’s technical and organisational measures pursuant to Art. 32 GDPR as applicable from time to time are set out in the document “Technical and Organisational Measures (TOMs)”.

This document forms part of this Agreement and is provided to the Client in electronic form. The current version is also available in the Contractor’s Trust Center.

The Contractor is entitled to further develop the technical and organisational measures while maintaining the same or a higher level of protection.

The Contractor maintains processes for the:

detection,

assessment,

handling,

documentation

of security incidents.

Access to personal data takes place exclusively on a need-to-know basis and only by authorised persons.

4. Rectification, restriction and erasure of data

The Contractor may not rectify or erase the data processed on behalf of the Client, or restrict their processing, on its own authority, but only on the documented instruction of the Client.

Where a data subject contacts the Contractor directly in this regard, the Contractor will forward this request to the Client without undue delay.

5. Quality assurance and other obligations of the Contractor

In addition to complying with the provisions of this order, the Contractor has statutory obligations pursuant to Art. 28 to 33 GDPR.

The Contractor guarantees in particular:

the maintenance of confidentiality pursuant to Art. 28(3)(b), Art. 29 and Art. 32(4) GDPR,

the obligation of all employees to maintain confidentiality,

the processing of personal data in compliance with data protection law,

the regular review of the technical and organisational measures,

cooperation with supervisory authorities,

informing the Client without undue delay of inspections and measures by supervisory authorities.

The Contractor does not use the personal data provided for processing for any other purposes, in particular not for its own purposes.

Copies or duplicates of the personal data are not created without the knowledge of the Client.

The Contractor has appointed a data protection officer.

The Contractor regularly reviews its internal processes and the technical and organisational measures in order to ensure that processing within its area of responsibility is carried out in accordance with the requirements of the applicable data protection provisions.

6. Sub-processing

For the purposes of this Agreement, sub-processors are only those third parties that process personal data of the Client on behalf of the Contractor and whose activity directly serves the provision of the contractually owed services.

The Client grants the Contractor general authorisation to engage further processors pursuant to Art. 28(2) GDPR.

The sub-processors engaged from time to time are disclosed to the Client as follows:

The Contractor informs the Client of any intended changes concerning the addition or replacement of further processors.

The Client may object within 14 days of receipt of the information on important grounds relating to data protection law.

The Contractor ensures that an agreement is concluded with each sub-processor imposing on it at least the data protection obligations laid down in this Agreement between the Client and the Contractor.

Ancillary and auxiliary services are not deemed to be sub-processing, in particular:

telecommunications services,

transport services,

cleaning services,

security guard services,

energy supply,

fire protection,

air-conditioning technology,

alarm technology,

maintenance services,

consulting services,

unless these are used to process personal data of the Client in the context of the main service.

Purely ancillary and auxiliary services in which there is no access to, or handling of, the primary personal data of the Client (in particular: cleaning, security guarding, energy supply, transport services) are not deemed to be sub-processing.

7. Audit rights of the Client

The Client has the right, in consultation with the Contractor, to carry out inspections or to have them carried out by auditors to be designated in each individual case.

The Contractor ensures that the Client can satisfy itself of the Contractor’s compliance with its obligations under Art. 28 GDPR.

The Contractor undertakes to provide the Client, upon request, with the necessary information and, in particular, to demonstrate the implementation of the technical and organisational measures.

Where appropriate,

certifications,

attestations,

audit reports,

report extracts,

ISO 27001 evidence,

BSI IT-Grundschutz evidence,

TOM documentation

may also be used to provide the evidence.

Inspections must not disproportionately impair the Contractor’s business operations and shall in principle take place after reasonable advance notice.

Unless there is a specific reason, the Client is entitled to carry out a maximum of one audit per calendar year.

The Client is not granted access to:

data of other customers,

internal security architectures,

operating and business secrets,

confidential internal processes,

unless this is strictly necessary for carrying out the data protection audit.

8. Notification obligations in the event of incidents and personal data breaches

The Contractor assists the Client in complying with the obligations set out in Art. 32 to 36 GDPR.

These include in particular:

ensuring an appropriate level of protection,

the obligation to report personal data breaches without undue delay,

assisting the Client with data protection impact assessments,

assistance with consultations with supervisory authorities,

assistance with data subject requests.

Assistance services that go beyond the contractually agreed services may be remunerated separately.

9. Rights and obligations and authority of the Client to issue instructions

The Client shall in principle issue instructions in writing or in a documented electronic format.

The instructions result in particular from:

this Agreement,

the service descriptions,

the services booked,

the service configurations,

documented individual instructions.

The Client shall confirm oral instructions in text form without undue delay.

The Contractor shall inform the Client without undue delay if it considers that an instruction infringes data protection provisions.

The Contractor is entitled to suspend the execution of the instruction concerned until it is confirmed or amended by the Client.

The Client is responsible for:

the lawfulness of the processing,

safeguarding the rights of data subjects,

the admissibility of the instructions,

the existence of appropriate legal bases pursuant to Art. 6 GDPR.

10. Erasure and return of personal data

Upon completion of the contractually agreed work, or earlier upon request by the Client, the Contractor shall, with regard to all documents, data sets and processing results that have come into its possession in connection with the contractual relationship:

hand them over,

or, after prior consent, destroy them in compliance with data protection law.

The following are exempt from this:

statutory retention obligations,

backup copies,

documentation serving as evidence.

The record of erasure shall be presented upon request.

Documentation that serves as evidence of proper data processing may be stored beyond the end of the Agreement in accordance with statutory retention periods.

11. Final provisions

Both parties undertake to treat as confidential:

personal data,

security measures,

technical information,

operating and business secrets.

This obligation continues beyond the termination of this Agreement.

Should individual provisions of this Agreement be or become invalid, the validity of the remaining provisions shall remain unaffected.

Amendments and additions to this Agreement require text form.

Where this Agreement does not contain any provisions, the provisions of the Main Agreement apply.

In the event of contradictions, the provisions of this Agreement take precedence over the provisions of the Main Agreement.

German law applies.

The place of jurisdiction is – to the extent permissible – the registered office of the Contractor.