Data processing agreement

Agreement on the processing of personal data on behalf of a controller under Art. 28 GDPR for Provomatic Managed-Hosted

As of (filled in when concluded). This is a convenience translation; the German version is binding.

Between (filled in when concluded), (filled in when concluded), customer number (filled in when concluded) (“client”, controller), and Provomatic.de, Dülkener Straße 2, 41068 Mönchengladbach, Germany (“contractor”, processor).

1. Subject matter and duration

1.1 The contractor operates an instance of the Provomatic software for the client under the contract for Provomatic Managed-Hosted (main contract, the contractor’s general terms and conditions). In doing so it processes personal data on behalf of the client.

1.2 This agreement applies for the term of the main contract and beyond until all data has been returned or deleted under section 12.

2. Nature and purpose of the processing

The contractor stores the data of the instance, makes the instance available, creates daily backups, maintains and updates the software and provides support in case of disruptions. The sole purpose is operating the software for the client. The contractor does not process the data for its own purposes.

3. Data and data subjects

The categories of data and data subjects are listed in annex 1.

4. Rights and obligations of the client

The client is responsible for the lawfulness of the processing and for safeguarding the rights of the data subjects. It gives instructions in text form, for example by email or ticket. It confirms oral instructions in text form without delay. Settings that the client makes in the instance itself count as instructions.

5. Processing on instructions

The contractor processes the data only on documented instructions from the client, unless it is required to process them by the law of the European Union or of Germany; in that case it informs the client of that requirement beforehand, unless the law prohibits this (Art. 28 (3) (a) GDPR). If it considers an instruction to be unlawful, it informs the client without delay and may suspend carrying it out until it has been clarified.

6. Confidentiality

The contractor ensures that persons with access to the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

7. Technical and organisational measures

The contractor takes the measures set out in annex 2 (Art. 32 GDPR). It may develop them further as long as the level of protection does not decrease, and documents significant changes.

8. Sub-processors

8.1 The client approves the sub-processors listed in annex 3.

8.2 The contractor informs the client in text form at least 30 days in advance of any intended addition or replacement of a sub-processor. The client may object for an important reason relating to data protection. If the parties cannot agree, the client may terminate the main contract extraordinarily with effect from the date of the change.

8.3 The contractor contractually obliges each sub-processor to an equivalent level of protection and is liable for it as for its own conduct.

9. Rights of data subjects

The contractor supports the client with appropriate measures in answering requests from data subjects (Art. 12 to 22 GDPR). If a data subject contacts the contractor directly, it forwards the request to the client without delay.

10. Personal data breaches

The contractor reports a personal data breach to the client without delay, at the latest within 24 hours after becoming aware of it. It provides the information the client needs for notifications under Art. 33 and 34 GDPR and supports it in doing so.

11. Data protection impact assessment

On request, the contractor supports the client with a data protection impact assessment and a prior consultation of the supervisory authority (Art. 35 and 36 GDPR) insofar as they concern the processing under this agreement.

12. Return and deletion

After the end of the main contract, the contractor makes the data available for export for 30 days (database dump, files) and then deletes it; the backups are deleted within a further 14 days. On the client’s instruction it deletes earlier. Statutory retention obligations of the contractor remain unaffected.

13. Evidence and audits

The contractor provides the client with the information needed to demonstrate compliance with the obligations under this agreement and allows audits by the client or by an auditor appointed by it who is bound to confidentiality. On-site audits take place after notice of at least 14 days during normal business hours and must not disrupt operations unreasonably. Evidence may also be provided through current information and documentation from the contractor.

14. Place of processing

The data is processed exclusively in Germany (data centres in Falkenstein and Nuremberg). A transfer to a country outside the European Union or the European Economic Area takes place only after the client has been informed in advance and under the conditions of Chapter V GDPR.

15. Contacts

For the contractor: Provomatic.de, email [email protected]. For the client: the email address stored in the customer account.

16. Liability and final provisions

16.1 Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability provisions of the main contract apply unless Art. 82 GDPR provides otherwise.

16.2 In the event of conflicts between this agreement and the main contract, this agreement takes precedence in matters of data protection.

16.3 German law applies.

Annex 1: Data and data subjects

Annex 2: Technical and organisational measures

1. Data centre: Operation in data centres of Hetzner Online GmbH in Germany (Falkenstein, Nuremberg); physical access control by Hetzner.
2. Separation: Each client receives its own server with its own database.
3. Access: Roles and permissions in the software; the client’s staff see only what their role allows. Two-factor authentication is available for logging in to the administration.
4. Transmission: Encrypted transmission (HTTPS/TLS with a valid certificate).
5. Stored access data: Access data and API keys of connected services are stored in encrypted form.
6. Traceability: Log of changes by staff that can only be appended to and is chained by checksums.
7. Availability: Daily backup of the instance at Hetzner; the last 14 backups are kept; restore on request.
8. Firewall: Only ports 22 (SSH), 80 and 443 (HTTP/HTTPS) are reachable on each server.
9. Server access: SSH login only with a key; login as root and with a password is disabled.
10. Protection against login attacks: Repeated failed logins are blocked automatically (fail2ban).
11. Up to date: Security updates of the operating system are installed automatically.
12. Hardened installation: The configuration file is readable only by the web server, the program folder is protected against changes by the web server, and the application sends security headers; the TLS certificate is issued by Let’s Encrypt.

Annex 3: Sub-processors