Data processing agreement

Parties

This agreement sets out in detail the data protection obligations of the parties arising from the use of AngebotPilot under the Terms (main agreement). [PLACEHOLDER: method of conclusion, e.g. “The agreement is concluded electronically upon registration.”]

§ 1 Subject matter and term

1. The subject matter is the processing of personal data by the processor on behalf of the controller in the course of providing the AngebotPilot software.
2. The term corresponds to the term of the main agreement. The obligations under § 10 continue to apply after the end of the agreement.

§ 2 Nature, purpose, types of data and data subjects

Nature of the processing

Collecting, storing, organising, displaying, transmitting (sending e-mails), exporting, anonymising and deleting data within the scope of the functions of AngebotPilot.

Purpose

Creating, sending and tracking quotations, automatic reminders, online acceptance or rejection by recipients, customer and job management, collaboration within a team.

Types of data

Contact and master data of customers (name, company, address, service address, e-mail address, telephone number, VAT identification number, notes); content of quotations and jobs (line items, prices, texts, dates); communication data (sending logs with recipient, subject, content, status, timestamps); usage data of the customer link (time of first and last opening, number of views); decisions of recipients (name entered, time, optional message); unsubscriptions from reminders; names and e-mail addresses of the controller’s team members; files uploaded by the controller.

Data subjects

Customers and prospective customers of the controller and their contact persons; employees and team members of the controller.

Special categories of personal data (Art. 9 GDPR) are not subject to the processing; the controller does not record such data in AngebotPilot.

§ 3 Instructions

1. The processor processes the data only on documented instructions from the controller, unless it is required to process them by law; in that case, it informs the controller of that legal requirement before processing, unless the law prohibits such information.
2. The controller generally gives instructions by using and configuring the software (e.g. creating, sending, deleting, exporting, reminder settings) and additionally in text form.
3. If the processor considers that an instruction infringes data protection provisions, it informs the controller without undue delay.

§ 4 Confidentiality

The processor only engages persons who have been bound to confidentiality or are subject to a statutory obligation of secrecy. Data of the controller is accessed only insofar as this is necessary for operation, maintenance or support.

§ 5 Technical and organisational measures

The processor implements appropriate technical and organisational measures pursuant to Art. 32 GDPR (Annex 1). It may further develop the measures provided that the level of protection is not reduced.

§ 6 Sub-processors

1. The controller authorises the use of the sub-processors listed in Annex 2.
2. The processor informs the controller in text form of any intended addition or replacement of a sub-processor at least [PLACEHOLDER: notice period, e.g. 4 weeks] in advance. The controller may object for good cause relating to data protection; if no agreement is reached, the controller may terminate the main agreement extraordinarily (for cause).
3. The processor contractually binds sub-processors to a level of data protection that corresponds to this agreement.

§ 7 Assistance obligations

1. The processor assists the controller by appropriate technical and organisational measures in responding to requests from data subjects (Art. 15–22 GDPR). The controller can fulfil many requests itself in the software, for example by editing, exporting, anonymising or deleting customer data.
2. If a data subject contacts the processor directly, the processor forwards the request to the controller without undue delay.
3. The processor also assists the controller in ensuring compliance with the obligations under Art. 32 to 36 GDPR, taking into account the information available to the processor.

§ 8 Notification of personal data breaches

The processor notifies the controller of personal data breaches without undue delay after becoming aware of them, providing the information the controller needs for its notification to the supervisory authority (Art. 33 GDPR).

§ 9 Evidence and audits

The processor makes available to the controller all information necessary to demonstrate compliance with this agreement. Audits, including inspections, are possible after timely advance notice, during normal business hours and without disrupting operations. In the first instance, compliance may be demonstrated by self-disclosures and appropriate documentation.

§ 10 Deletion and return

1. The controller can export (CSV) and delete its data itself at any time during the term of the agreement.
2. After the end of the provision of services, the processor deletes the controller’s data within [PLACEHOLDER: period, e.g. 30 days], unless Union law or German law requires the data to be stored. Data in backups is overwritten as part of the regular backup cycle [PLACEHOLDER: duration].
3. Deletion is confirmed in text form on request.

§ 11 Transfers to third countries

Processing outside the EU or the EEA only takes place if the requirements of Art. 44 et seq. GDPR are met, for example on the basis of an adequacy decision (e.g. EU-US Data Privacy Framework) or of EU Standard Contractual Clauses.

§ 12 Final provisions

1. Liability is governed by Art. 82 GDPR. Otherwise, the liability provisions of the main agreement apply.
2. In the event of any conflict between this agreement and the main agreement, the provisions of this agreement prevail in matters of data protection.
3. Amendments and additions must be made in text form. German law applies.

Annex 1: Technical and organisational measures (TOMs)

Annex 2: Sub-processors

GitHub Pages merely serves the program files of the web app and does not process any content from AngebotPilot; GitHub is therefore not a sub-processor for the data listed in § 2.

Signatures