Data processing agreement (DPA)

This data processing agreement (DPA) pursuant to Art. 28 GDPR is concluded automatically and electronically when our services are used.

Contracting parties

Between
the customer / website operator
– hereinafter referred to as the “controller” –

and
René Braun | Blitzmoon, Andresenstraße 12, 24113 Kiel, Germany
– hereinafter referred to as the “processor” –

§ 1 Subject matter, duration and specification

(1) The processor provides services for the controller in the areas of WordPress maintenance, managed hosting, technical support, troubleshooting and data backup in accordance with the underlying main contract (maintenance contract/terms and conditions).
(2) This agreement governs the rights and obligations of the parties under data protection law in connection with the processing of personal data by the processor on behalf of the controller.
(3) The term of this agreement follows the term of the main contract. It ends automatically when the main contract ends.

§ 2 Type of data and categories of data subjects

As the systems looked after (e.g. CMS, shop systems, CRM) can contain a variety of data structures, the processing is extended as a precaution to all categories of data that may arise.

(1) Types of personal data processed:
- Master data: names, addresses, customer numbers.
- Contact data: email addresses, telephone numbers.
- Content data: text entered in forms, chat logs, comments, uploaded media.
- Contract and payment data: billing addresses, order histories, payment information (where shops are looked after).
- Usage data and metadata: IP addresses, server log files, device information, access times.
- Authentication data: user names, password hashes (encrypted).

(2) Categories of data subjects:
- Customers and prospective customers of the controller.
- Visitors and users of the controller's website/online shop.
- Employees and administrators of the controller.

§ 3 Obligations of the controller

Within the scope of this agreement, the controller alone is responsible for compliance with the statutory provisions of data protection law, in particular for the lawfulness of passing data on to the processor and for the lawfulness of the data processing (Art. 4 No. 7 GDPR).

§ 4 Obligations of the processor

(1) The processor processes personal data exclusively within the scope of the agreements made and on the documented instructions of the controller.
(2) The processor ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality.
(3) The processor assists the controller in responding to requests from data subjects (Art. 15 to 22 GDPR) and in complying with the obligations under Art. 32 to 36 GDPR (data security, notification obligations in the event of data breaches).

§ 5 Use of sub-processors & location-independent work

(1) The controller agrees to the engagement of the following sub-processors:
- Rockinghoster (Germany): provision of the server infrastructure / hosting.
- pCloud (EU servers): primary storage of encrypted data backups.
- Own NAS system (location: non-EU country): fallback backup for disaster recovery. Transmission and storage are strictly encrypted, so that the plain data cannot be accessed without the key held in Germany.

(2) Location-independent work (remote work) and external service providers: The processor provides its services independently of location. This includes the work of the owner and of permanent employees as well as the legitimate use of external freelancers (sub-processors) to perform the main contract.

(3) System access across locations (EU and third countries): The administrative activities, and the associated temporary or permanent access to the controller's systems and data, can take place worldwide – both from within the European Union (EU) and from non-EU countries (third countries).

(4) Data security and legal safeguards for access from third countries: If access takes place from a third country, the processor ensures the protection of the data by strict technical and organisational measures (e.g. use of company-internal VPN connections and two-factor authentication). If, in addition, external freelancers are used in a third country for which there is no adequacy decision by the EU Commission, the processor additionally and mandatorily concludes EU standard contractual clauses (SCC) with them to maintain the level of data protection, and contractually obliges them to strict confidentiality (NDA).

§ 6 Technical and organisational measures (TOMs)

The processor warrants the implementation of the required technical and organisational measures (TOMs) pursuant to Art. 32 GDPR. These include at least:

- Physical access control: exclusion of unauthorised persons from the data processing facilities. All administrative activities take place in non-public, lockable home-office premises of the processor and its permanent employees. There is no public access.
- System access control: prevention of unauthorised use of the systems. Use of company VPNs for critical connections; mandatory two-factor authentication (2FA) for all administrative accesses (hosting panel, CRM, cloud storage); use of secure, individual user names and strong passwords.
- Data access control: restriction of access to authorised persons. Strict application of the “need-to-know” principle (freelancers receive only temporary access, which is deleted or changed once the task is complete).
- Transfer control & encryption: protection of data in transit. Complete SSL/TLS encryption of data traffic; additional strong encryption of database backups before transfer to external storage media (NAS).

§ 7 Deletion and return of data

After completion of the contractual work, or at the request of the controller, the processor must hand over to the controller, or delete in compliance with data protection law, all data and documents that have come into its possession as well as any processing or usage results created in connection with the contractual relationship. This does not apply to backups, which are subject to the agency's usual retention period (e.g. 6 months) before they are deleted automatically, or to data for which there is a statutory retention obligation.