Data Processing Agreement

Data Processing Agreement

Between

Loyalista GmbH

represented by Managing Director Daniel Heine

Friedlandstraße 58

44869 Bochum

as Processor (hereinafter referred to as the “Contractor”)

and

_________________

_________________

_________________

(hereinafter referred to as the “Client”)

Preamble

The Client wishes to commission the Contractor to provide the services specified in § 3. The performance of the contract involves the processing of personal data. In particular, Art. 28 GDPR sets out certain requirements for such processing on behalf of a controller. In order to comply with these requirements, the parties enter into the following agreement, the performance of which shall not be remunerated separately unless expressly agreed otherwise.

§ 1 Definitions

(1) Controller pursuant to Art. 4 para. 7 GDPR means the entity which, alone or jointly with other controllers, determines the purposes and means of the processing of personal data.

(2) Processor pursuant to Art. 4 para. 8 GDPR means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

(3) Personal data pursuant to Art. 4 para. 1 GDPR means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

(4) Particularly sensitive personal data means personal data pursuant to Art. 9 GDPR revealing the racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership of data subjects, personal data pursuant to Art. 10 GDPR relating to criminal convictions and offences or related security measures, as well as genetic data pursuant to Art. 4 para. 13 GDPR, biometric data pursuant to Art. 4 para. 14 GDPR, data concerning health pursuant to Art. 4 para. 15 GDPR and data concerning a natural person’s sex life or sexual orientation.

(5) Processing pursuant to Art. 4 para. 2 GDPR means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

(6) Supervisory authority pursuant to Art. 4 para. 21 GDPR means an independent public authority established by a Member State pursuant to Art. 51 GDPR.

§ 2 Details of the Competent Data Protection Supervisory Authority

(1) The competent supervisory authority for the parties is the state data protection authority of the federal state in which the Client or Contractor has its registered office. For the Contractor, this is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia

Kavalleriestr. 2-4

40213 Düsseldorf

Homepage: https://www.ldi.nrw.de

(2) The Client and the Contractor and, where applicable, their representatives shall cooperate, on request, with the supervisory authority in the performance of its tasks.

§ 3 Subject Matter of the Contract

(1) The Contractor provides services to the Client in the field of

·       Provision of cloud services

In doing so, the Contractor obtains access to personal data and processes such data exclusively on behalf of and in accordance with the instructions of the Client. The scope and purpose of the data processing by the Contractor are set out in the main contract (and the associated service description). The Client is responsible for assessing the lawfulness of the data processing.

(2) In order to specify the parties’ respective rights and obligations under data protection law, the parties enter into this agreement. In case of doubt, the provisions of this agreement shall take precedence over the provisions of the main contract.

(3) The provisions of this contract apply to all activities related to the main contract in which the Contractor and its employees or persons commissioned by the Contractor come into contact with personal data originating from the Client or collected for the Client.

(4) The term of this contract shall be governed by the term of the main contract, unless the following provisions give rise to obligations extending beyond that term or rights of termination.

 § 4 Right to Issue Instructions

(1) The Contractor may collect, process or use data only within the framework of the main contract and in accordance with the Client’s instructions; this applies in particular with regard to the transfer of personal data to a third country or to an international organisation. If the Contractor is required by the law of the European Union or the Member States to which it is subject to carry out further processing, it shall inform the Client of these legal requirements before processing.

(2) The Client’s instructions are initially defined by this contract and may subsequently be amended, supplemented or replaced by the Client in writing or in text form by means of individual instructions (individual instruction). The Client is entitled to issue corresponding instructions at any time. This includes instructions with regard to the rectification, erasure and blocking of data. The persons authorised to issue instructions are specified in Annex 5. In the event of a change or prolonged absence of the persons named, the successor or representative must be named to the contractual partner without undue delay in text form.

(3) All instructions issued must be documented by both the Client and the Contractor. Instructions that go beyond the service agreed in the main contract shall be treated as a request for a change in services.

(4) If the Contractor is of the opinion that an instruction from the Client violates data protection provisions, it shall inform the Client thereof without undue delay. The Contractor is entitled to suspend execution of the instruction concerned until it is confirmed or amended by the Client. The Contractor may refuse to execute an instruction that is manifestly unlawful.

 § 5 Type of Data Processed, Categories of Data Subjects

(1) In the course of performing the main contract, the Contractor obtains access to the personal data specified in more detail in Annex 1.

(2) The categories of persons affected by the data processing are set out in Annex 2.

§ 6 Protective Measures of the Contractor

(1) The Contractor is obliged to comply with the statutory provisions on data protection and not to disclose information obtained from the Client’s sphere to third parties or expose it to access by third parties. Documents and data must be protected against access by unauthorised persons, taking into account the state of the art.

(2) Within its area of responsibility, the Contractor shall organise its internal operations in such a way that they meet the specific requirements of data protection. It shall take all necessary technical and organisational measures to ensure an appropriate level of protection for the Client’s data pursuant to Art. 32 GDPR, including at least the measures listed in Annex 3 relating to

·       Physical access control

·       System access control

·       Data access control

·       Disclosure control

·       Input control

·       Instruction control

·       Availability control

·       Separation control

The Contractor reserves the right to modify the security measures implemented, provided that it ensures that the contractually agreed level of protection is not reduced.

(3) The Contractor has appointed an internal data protection officer for data protection

            X          not appointed

(4) Persons employed by the Contractor in data processing are prohibited from collecting, processing or using personal data without authorisation. The Contractor shall bind all persons entrusted by it with the processing and performance of this contract (hereinafter referred to as employees) accordingly (confidentiality obligation, Art. 28 para. 3 lit. b GDPR) and shall ensure compliance with this obligation with due care. These obligations must be worded in such a way that they continue to apply even after termination of this contract or of the employment relationship between the employee and the Contractor. The Client shall be provided with suitable evidence of these obligations upon request.

§ 7 Information Obligations of the Contractor

(1) In the event of disruptions, suspected data protection breaches or breaches of the Contractor’s contractual obligations, suspected security-related incidents or other irregularities in the processing of personal data by the Contractor, persons employed by it within the scope of the assignment or third parties, the Contractor shall inform the Client without undue delay in writing or in text form. The same applies to audits of the Contractor by the data protection supervisory authority. Notification of a personal data breach shall contain at least the following information:

a) a description of the nature of the personal data breach, where possible including the categories and approximate number of data subjects concerned, the categories concerned and the approximate number of personal data records concerned;

b) a description of the measures taken or proposed by the Contractor to remedy the breach and, where applicable, measures to mitigate its possible adverse effects.

(2) The Contractor shall without undue delay take the measures necessary to secure the data and mitigate possible adverse consequences for the data subjects, inform the Client thereof and request further instructions.

(3) In addition, the Contractor is obliged to provide the Client with information at any time insofar as its data is affected by a breach pursuant to paragraph 1.

(4) If the Client’s data held by the Contractor is at risk due to attachment or seizure, insolvency or composition proceedings or other events or measures by third parties, the Contractor shall inform the Client thereof without undue delay, unless prohibited from doing so by a court or administrative order. In this connection, the Contractor shall without undue delay inform all competent bodies that the authority to make decisions regarding the data lies exclusively with the Client as the “Controller” within the meaning of the GDPR.

(5) The Contractor shall inform the Client without undue delay of any material change to the security measures pursuant to § 6 para. 2.

(6) Any change in the person of the internal data protection officer/contact person for data protection must be communicated to the Client without undue delay.

(7) The Contractor and, where applicable, its representative shall maintain a record of all categories of processing activities carried out on behalf of the Client containing all information pursuant to Art. 30 para. 2 GDPR. The record shall be made available to the Client upon request.

(8) The Contractor shall cooperate to an appropriate extent in the preparation of the record of processing activities by the Client. It shall provide the Client with the information required in each case in a suitable manner.

§ 8 Audit Rights of the Client

(1) Before commencement of data processing and thereafter on a regular basis, the Client shall satisfy itself as to the technical and organisational measures of the Contractor. For this purpose, it may, for example, obtain information from the Contractor, request the submission of existing expert attestations, certifications or internal audits, or personally inspect the Contractor’s technical and organisational measures during normal business hours after timely coordination, or have them inspected by a competent third party, provided that such third party is not in competition with the Contractor. The Client shall conduct inspections only to the extent necessary and shall not disproportionately disrupt the Contractor’s business operations.

(2) The Contractor undertakes, at the Client’s oral or written request, to provide within a reasonable period all information and evidence necessary to carry out an inspection of the Contractor’s technical and organisational measures.

(3) The Client shall document the result of the inspection and communicate it to the Contractor. In the event of errors or irregularities identified by the Client, in particular when reviewing the results of the assignment, it shall inform the Contractor without undue delay. If the inspection identifies circumstances whose future avoidance requires changes to the prescribed process, the Client shall inform the Contractor without undue delay of the necessary procedural changes.

(4) At the Client’s request, the Contractor shall provide the Client with a comprehensive and up-to-date data protection and security concept for processing on behalf of the Client as well as information on persons authorised to access the data.

(5) Upon request, the Contractor shall provide the Client with evidence of the employees’ obligation pursuant to § 6 para. 4.

§ 9 Use of Subcontractors Only with Approval

(1) The contractually agreed services or the partial services described below may be performed with the involvement of subcontractors insofar as these are listed in Annex 4. Within the framework of its contractual obligations, the Contractor is entitled to establish further subcontracting relationships with subcontractors (“subcontracting relationship”). It shall inform the Client thereof without undue delay. The Contractor is obliged to select subcontractors carefully with regard to their suitability and reliability. When engaging subcontractors, the Contractor shall bind them in accordance with the provisions of this agreement and ensure that the Client can also exercise its rights under this agreement (in particular its audit and inspection rights) directly vis-à-vis the subcontractors. If subcontractors are to be involved in a third country, the Contractor shall ensure that an adequate level of data protection is guaranteed by the respective subcontractor (e.g. by concluding an agreement based on the EU Standard Contractual Clauses). Upon request, the Contractor shall provide the Client with evidence of the conclusion of the aforementioned agreements with its subcontractors.

(2) A subcontracting relationship within the meaning of these provisions does not exist if the Contractor engages third parties to provide services that are to be regarded as purely ancillary services. These include, for example, postal, transport and shipping services, cleaning services, telecommunications services without a specific connection to services provided by the Contractor for the Client, and security services.

§ 10 Requests and Rights of Data Subjects

(1) Where possible, the Contractor shall assist the Client by means of appropriate technical and organisational measures in fulfilling its obligations pursuant to Art. 12–22 as well as 32 and 36 GDPR.

(2) If a data subject asserts rights, for example to access, rectification or erasure of their data, directly against the Contractor, the Contractor shall not respond independently, but shall refer the data subject to the Client without undue delay and await the Client’s instructions.

§ 11 Liability

(1) In the internal relationship with the Contractor, the Client alone shall be responsible vis-à-vis the data subject for compensation for damage suffered by a data subject due to unlawful or incorrect data processing or use within the scope of processing on behalf of the Client under data protection laws.

(2) The parties shall each indemnify the other from liability if a party proves that it is in no way responsible for the circumstance that caused the damage suffered by a data subject.

(3) In particular, the Client itself is responsible for fully informing its customers, visitors, users and interested parties about the processing of personal data and for providing corresponding data protection provisions. The Client is responsible for checking whether the Contractor’s advertising measures comply with the legal provisions.

§ 12 Termination of the Main Contract

(1) Upon termination of the main contract or at any time upon the Client’s request, the Contractor shall return to the Client all documents, data and data carriers made available to it or – at the Client’s request, unless there is an obligation under Union law or the law of the Federal Republic of Germany to store the personal data – erase them. This also applies to any backups held by the Contractor. The Contractor shall maintain documented evidence of the proper erasure of any data still existing. Documents to be disposed of shall be destroyed using a document shredder in accordance with DIN 32757-1. Data carriers to be disposed of shall be destroyed in accordance with DIN 66399.

(2) The Client has the right to verify in an appropriate manner the complete return or erasure of the data by the Contractor in accordance with the contract.

(3) The Contractor is obliged to continue to treat confidentially, even after termination of the main contract, any data of which it became aware in connection with the main contract. This agreement shall remain valid beyond the termination of the main contract for as long as the Contractor has personal data that was transmitted to it by the Client or that it collected for the Client.

§ 13 Final Provisions

(1) The parties agree that the Contractor’s defence of a right of retention within the meaning of § 273 BGB with regard to the data to be processed and the associated data carriers is excluded.

(2) Amendments and supplements to this agreement must be made in writing. This also applies to any waiver of this written-form requirement. The precedence of individual contractual agreements remains unaffected.

(3) The Client assures compliance with the data protection provisions of the European Union (GDPR).

(4) Should individual provisions of this agreement be or become wholly or partially legally invalid or unenforceable, this shall not affect the validity of the remaining provisions.

(5) This agreement is governed by German law. The exclusive place of jurisdiction shall be the registered office of the Client.

 Annexes

·       Annex 1 – Description of Data/Data Categories Requiring Protection

·       Annex 2 – Description of Data Subjects/Categories of Data Subjects

·       Annex 3 – Technical and Organisational Measures of the Contractor for the Protection of Data

·       Annex 4 – Approved Subcontractors

·       Annex 5 – Persons Authorised to Issue Instructions

Annex 1 – Description of Data/Data Categories Requiring Protection

·       Contact details of the Client’s customers/interested parties

·       Statistical data of the above-mentioned groups of persons

Annex 2 – Description of the Data Subjects/Categories of Data Subjects Whose Personal Data Is Processed

·       Customers, interested parties

Annex 3 – Technical and Organisational Measures of the Contractor for the Protection of Data

•          Ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services related to processing;

•          Backup - ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident;

•          A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing.

•          Work computers are access-protected; only secure passwords are used. Up-to-date virus scanner and firewall installed, regular updates of the software used.

Annex 4 – Approved Subcontractors

Amazon Web Services GmbH Germany (Krausenstraße 38, 10117 Berlin)

Annex 5 – Persons Authorised to Issue Instructions

The person authorised to issue instructions on behalf of the Contractor is Mr Daniel Heine

The recipient of instructions at the Client is/are the authorised representative(s) of the Contractor.

Bochum, 01.01.2026

(valid without signature pursuant to Art. 28 para. 3 GDPR)