Snapshot 4449
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement
concluded by and between Data Controller
– hereinafter, “Company” –
and Byteplant GmbH Software Solutions & Consulting
Heilsbronner Strasse 4
D-91564 Neuendettelsau
– hereinafter, “Supplier” –
on the processing of personal data on behalf of a controller in accordance with
Article 28 (3) of the EU General Data Protection Regulation (GDPR).
Preamble
This annex details the parties’ obligations on the protection of personal data, associated with the processing of
personal data on behalf of Company as a data controller. Its regulations shall apply to any and all activities
associated with the service agreement, in whose scope Supplier’s employees or agents process Company’s
personal data (hereinafter, “Data”) on behalf of Company as a controller.
§ 1 Scope, duration and specification of contract processing of Data
(1) The scope and duration and the detailed stipulations on the type and purpose of the processing of the
Data under this annex (hereinafter, “Contract Processing”) shall be governed by the service agreement.
Specifically, Contract Processing shall include, but not be limited to, the following Data
Type of data Categories of data subjects Purpose (subject matter) of Storage limitation
affected data processing or use
Postal addresses, Customers, prospects, Data Validation 14 days
email addresses, subscribers, applicants,
telephone suppliers, employees
numbers
(2) Except where this annex stipulates obligations beyond the term of the service agreement, the term of
this annex shall be the term of the service agreement.
(3) The type of data processed and the categories of data subjects shall be determined by the Company
through the choice of products, the use of services and the transmission of data.
DPA Byteplant 03/2023 - Page 1
§ 2 Scope of application and responsibilities
(1) Supplier shall process Data on behalf of Company. Such Contract Processing shall include all activities
detailed in the service agreement and its statement of work.
(2) Within the scope of this annex, Company shall be solely responsible for compliance with the applicable
statutory requirements on data protection, including, but not limited to, the lawfulness of disclosing Data
to Supplier and the lawfulness of having Data processed on behalf of Company. Company shall be the
»controller« in accordance with Article 4 no. 7 of the GDPR.
(3) Company has data sovereignty. Company alone and exclusively decides on the purposes and means of
processing the Data.
(4) Company’s individual instructions on Contract Processing shall, initially, be as detailed in the service
agreement. Company shall, subsequently, be entitled to, in writing, modify, amend or replace such
individual instructions. Instructions not foreseen in or covered by the service agreement shall be treated
as requests for changes to the statement of work. Company shall, without undue delay, confirm in writing
any instruction issued orally.
§ 3 Supplier’s obligations
(1) Except where expressly permitted by Article 28 (3)(a) of the GDPR, Supplier shall process data subjects’
Data only within the scope of the statement of work, the service agreement, this annex and the
instructions issued by Company.
(2) Where Supplier believes that an instruction would be in breach of applicable law, Supplier shall notify
Company of such belief without undue delay. Supplier shall be entitled to suspend performance on such
instruction until Company confirms or modifies such instruction. Until then, the Supplier may continue
processing on the basis of the previous instructions.
(3) Supplier shall, within Supplier’s scope of responsibility, organise supplier’s internal organisation so it
satisfies the specific requirements of data protection. Supplier shall, within Supplier’s scope of
responsibility, implement technical and organisational measures to ensure the adequate protection of
Company’s Data, which measures shall fulfil the requirements of the GDPR and specifically its Article 32.
Details of the measures taken are documented in Annex 1 to this annex. Company is familiar with these
technical and organisational measures, and it shall be Company’s responsibility to decide if such
measures ensure a level of security appropriate to the risk.
(4) The technical and organisational measures are subject to technical progress and further development.
Supplier reserves the right to modify the measures and safeguards implemented, provided, however,
that the level of security shall not be less protective than initially agreed upon.
(5) Supplier documented the implementation of the technical and organisational measures before the start
of processing and submitted them to Company for inspection in Annex 1. If accepted by the Company,
the documented measures become the basis of the contract.
(6) Supplier shall support Company, insofar as is agreed upon by the parties, and where possible for
Supplier, taking into account the type of processing and the information available to him, in fulfilling data
subjects’ requests and claims, as detailed in chapter III of the GDPR and in fulfilling the obligations
enumerated in Articles 33 to 36 of the GDPR. Supplier is entitled to demand an appropriate
remuneration from Company for such support.
(7) Supplier warrants that all employees involved in Contract Processing of Company’s Data and other such
persons as may be involved in Contract Processing within Supplier’s scope of responsibility shall be
DPA Byteplant 03/2023 - Page 2
prohibited from processing Data outside the scope of the instructions. Furthermore, Supplier warrants
that any person entitled to process Data on behalf of Controller has undertaken a commitment to secrecy
or is subject to an appropriate statutory obligation to secrecy. All such secrecy obligations shall survive
the termination or expiration of such Contract Processing.
(8) Supplier shall notify Company, without undue delay, if Supplier becomes aware of breaches of the
protection of personal data within Supplier’s scope of responsibility. Supplier shall implement the
measures necessary for securing Data and for mitigating potential negative consequences for the data
subject; the Supplier shall coordinate such efforts with Company without undue delay.
(9) 14 days after completion of the delivery of Data, Supplier shall delete such Data in its possession and
processing or validation results generated in connection with the service agreement containing personal
data.
(10) Where required by law, Supplier shall appoint a data protection officer in writing. Only a natural person
who has a verifiable technical qualification and the necessary reliability in accordance with the statutory
provisions may be appointed data protection officer.
§ 4 Company’s obligations
(1) Company undertakes to data minimization. Data provided to the Supplier may only contain the
information directly required for the execution of the respective Contract Processing. The company
undertakes to make personal data anonymous as far as technically possible before it is handed over to
the Supplier.
(2) Company shall notify Supplier, without undue delay, and with reasonable detail, of any defect or
irregularity with regard to provisions on data protection detected by Company in the results of Supplier’s
work.
(3) Where a data subject asserts any claims against Supplier in accordance with Article 82 of the GDPR,
Company shall support Supplier in defending against such claims, where possible. .
(4) Company shall notify to Supplier the point of contact for any issues related to data protection arising out
of or in connection with this annex.
(5) Company is obliged to treat confidentially all knowledge of business secrets and data security measures
of the Supplier acquired within the scope of the order. This obligation shall continue to apply even after
termination of the service agreement.
§ 5 Enquiries by data subjects
(1) Supplier shall correct, delete or restrict the data processed only in accordance with the documented
instructions of Company. Where a data subject asserts claims for rectification, erasure or access against
Supplier, and where Supplier is able to correlate the data subject to Company, based on the information
provided by the data subject, Supplier shall refer such data subject to Company. Supplier shall forward
the data subject’s claim to Company without undue delay. Supplier shall support Company, where
possible, and based upon Company’s instruction insofar as agreed upon.
(2) Supplier shall not be liable in cases where Company fails to respond to the data subject’s request in
total, correctly, or in a timely manner.
DPA Byteplant 03/2023 - Page 3
§ 6 Options for documentation
(1) Supplier shall document and prove to Company Supplier’s compliance with the obligations agreed upon
in this annex by appropriate measures.
(2) Where, in individual cases, audits and inspections by Company or an auditor appointed by Company are
necessary, such audits and inspections will be conducted during regular business hours, and without
interfering with Supplier’s operations, upon prior notice, and observing an appropriate notice period (at
least four weeks) and prior provision of a detailed written examination schedule.
(3) Supplier may also determine that such audits and inspections are subject to prior notice, the observation
of an appropriate notice period, and the execution of a confidentiality undertaking protecting the data of
other customers and the confidentiality of the technical and organisational measures and safeguards
implemented. Supplier shall be entitled to reject auditors which are competitors of Supplier. This applies
also if another important reason in the selection of another inspector exists for Supplier. Supplier shall be
entitled to request a remuneration for Supplier’s support in conducting inspections. Supplier’s time and
effort for such inspections shall be limited to one day per calendar year, unless agreed upon otherwise.
(4) Where a data protection supervisory authority or another supervisory authority with statutory
competence for Company conducts an inspection, para. 2 above shall apply mutatis mutandis. The
execution of a confidentiality undertaking shall not be required if such supervisory authority is subject to
professional or statutory confidentiality obligations whose breach is sanctionable under the
applicable criminal code.
§ 7 Subcontractors (further processors on behalf of Company)
(1) The provision of the services requires the use of technical infrastructure. For this purpose, Company
consents to the assignment of the following subcontractors for data center operation:
OVH GmbH, St. Johanner Str. 41-43, 66111 Saarbrücken, Germany
datafabrik.de / meerfarbig GmbH & Co. KG, Kruppstr. 105, 60388 Frankfurt am Main, Germany
M247 EUROPE S.R.L, Sos. Fabrica de Glucoza No. 11B, Level 1, District 2, Bucharest, Romania
(2) The performance of the services email / phone number validation of Supplier is generally possible
without the use of additional subcontractors and processing takes place exclusively within the European
Union.
(3) The validation of postal addresses requires a matching with a reference dataset. This processing takes
place exclusively on the territory of the European Union. In the case of US postal addresses the
provision of the validation service is not possible without the involvement of a US service provider. In this
respect, Company hereby consents to Supplier’s use of this subcontractor.
(4) In all other respects, Supplier shall inform Company prior to the involvement of or changes to the
subcontractors as listed in §7 (1). Supplier shall conclude, with such subcontractors, the contractual
instruments necessary to ensure an appropriate level of data protection and information security. Where
Supplier commissions subcontractors, Supplier shall be responsible for ensuring that Supplier’s
obligations on data protection resulting from the services agreement, any applicable statement of work
and this annex are valid and binding upon subcontractor.
(5) Supplier shall, prior to the use or replacement of subcontractors as listed in §7 (1), inform Company
thereof. Company shall be entitled to reject any change notified by Supplier, within a period of fourteen
days and only for materially important reasons. Where Company fails to reject such change within
fourteen days, Company shall be deemed to have consented to such change. Where a materially
important reason for such contradiction exists, and failing an amicable resolution of this matter by the
DPA Byteplant 03/2023 - Page 4
parties, Supplier shall be at his own discretion, to provide the service without the intended change or, if
the performance of the service is unreasonable for Supplier without the intended change, discontinue the
service for Company.
(6) For the purposes of this provision, no subcontracting relationships are services which the Supplier has
with third parties as an ancillary service to assist in the Contract Processing. These include, for example,
telecommunications services, printing, postal and transport services, maintenance and user services,
cleaning staff or the disposal of data carriers.
§ 8 Liability and damages
(1) Company and Supplier shall be liable to data subject in accordance with Article 82 of the GDPR.
(2) Supplier is not liable for the content of the delivered data. Supplier’s liability is therefore excluded in
cases in which the resulting damages were caused by incorrect data provided by Company.
Furthermore, Supplier’s liability is excluded if Company has violated its obligations arising from this
annex (in particular according to § 4 para. 1 of this annex).
§ 9 Obligations to inform, mandatory written form, choice of law
(1) Where the Data becomes subject to search and seizure, an attachment order, confiscation during
bankruptcy or insolvency proceedings, or similar events or measures by third parties while in Supplier’s
control, Supplier shall notify Company of such action without undue delay. Supplier shall, without undue
delay, notify to all pertinent parties in such action, that any Data affected thereby is in Company’s sole
property and area of responsibility, that Data is at Company’s sole disposition, and that Company is the
responsible body in the sense of the GDPR.
(2) The agreement is concluded by the electronic confirmation of Company and Supplier's machine
signature provided below.
(3) No modification of this annex and/or any of its components – including, but not limited to, Supplier’s
representations and warranties, if any – shall be valid and binding unless made in writing , and
furthermore only if such modification expressly states that such modification applies to the regulations of
this annex. The foregoing shall also apply to any waiver or modification of this mandatory written form.
(4) In case of any conflict, the data protection regulations of this annex shall take precedence over the
regulations of the service agreement. Where individual regulations of this annex are invalid or
unenforceable, the validity and enforceability of the other regulations of this annex shall not be affected.
(5) German law applies. Place of jurisdiction is Ansbach.
Neuendettelsau - March 27, 2023
Joachim Hönig
Dr. Joachim Hönig
Managing Director Byteplant GmbH
Annex 1
Exhibit on technical and organisational security measures in accordance with Article 32 of the GDPR
DPA Byteplant 03/2023 - Page 5