Data Processing Agreement (DPA)

Last updated: January 8, 2024

Important notice: For your convenience, we have provided a translation of this page in german. The translation is for informational purposes only, and the definitive version of this page is the English version.

 

In the course of the fulfillment of the contract between xenthics Solutions GmbH, Alte Landstr. 25, 85521 Ottobrunn, Germany (the "Processor") and the customer (the "Customer", together with the Processor the "Parties") regarding the provision of the Processor's software and platform to the Customer (the "Contract") behalf within the scope of the applicable order under the terms of service and privacy policy as each amended from time to time, it is possible that the Processor deals with personal data pursuant to Art. 4 no. 1 General Data Protection Regulation ("GDPR"), i.e. any information relating to an identified or identifiable natural person (e.g. names, addresses or phone numbers of persons who are the Customer's customers), with regard to which the Customer acts as a controller pursuant to data protection law (the "Customer Data‟). This agreement (the "Agreement") specifies the data protection obligations and rights of the Parties in connection with the Processor's use of Customer Data to render the services under the Contract.

1. Scope of the processing

The Processor shall process the Customer Data on behalf and in accordance with the instructions of the Customer within the meaning of Art. 28 GDPR. The Customer remains the controller pursuant to Art. 28 GDPR.

The processing of Customer Data by the Processor occurs in the manner and the scope and for the purpose determined as follows.

Purpose and extent of Data Processing:
Provision of the Centrldesk software as a web application and which functions as a platform for creating business solutions, fulfillment of the Processor’s obligations under the Contract, marketing and quality assurance or as further reasonably instructed by the Customer.

Types of personal data:
Contact data, usage data, any data filled in by the Customer in the Software, Employee Data, Customer Data, Supplier Data, User-generated Data, User data, Profile data, Usernames, password, email, logfiles or any type of data included by the Customer in the software or service.

Types of processing:
Collection, storage, transmission, blocking, deletion, anonymization, pseudonymization, encryption or other use of data.

Categories of data subjects:
Users of the Centrldesk software; possibly other data subjects mentioned or included in data filled in by the Customer in the software or service.

The processing relates to the types of personal data and categories of data subjects specified therein. The duration of processing corresponds to the term of the Contract.

The Processor reserves the right to anonymize or aggregate the Customer Data in such a way that it is no longer possible to identify individual data subjects, and to use them in this form for the purpose of needs-based designing, machine-learning, developing and optimizing as well as rendering of the services agreed as per the Contract. The Parties agree that anonymized and according to the above requirement aggregated Customer Data are not considered Customer Data for the purposes of this Agreement.

The Processor may process and use the Customer Data for the Processor´s own purposes as controller to the extent legally permitted by data protection law, if permitted by a statutory permission or consent by the data subject. This Agreement does not apply to such data processing.

The processing of Customer Data by the Processor shall in principle take place inside the European Union or another contracting state of the European Economic Area (EEA). The Processor is nevertheless permitted to process Customer Data in accordance with the provisions of this Agreement outside the EEA if the Processor informs the Customer in advance (e.g. in the privacy policy) about the place of data processing and if the requirements of Art. 44 to 48 GDPR are fulfilled or if an exception according to Art. 49 GDPR applies.

2. Right of the Customer to issue instructions

The Processor processes the Customer Data in accordance with the instructions of the Customer, unless the Processor is legally required to do otherwise. In the latter case, the Processor shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The instructions of the Customer are in principle conclusively stipulated and documented in the provisions of this Agreement. Individual instructions which deviate from the stipulations of this Agreement or which impose additional requirements shall require the Processor's consent.

The Processor shall ensure that the Customer Data is processed in accordance with the instructions given by the Customer. If the Processor is of the opinion that an instruction given by the Customer infringes this Agreement or applicable data protection law, the Processor is after correspondingly informing the Customer entitled to suspend the execution of the instruction until the Customer confirms the instruction. The Parties agree that the sole responsibility for the processing of the Customer Data in accordance with the instructions lies with the Customer.

3. Legal responsibility of the Customer

The Customer is solely responsible for the permissibility of the processing of the Customer Data and for safeguarding the rights of data subjects in the relationship between the Parties. Should third parties assert claims against the Processor based on the processing of Customer Data in accordance with this Agreement, the Customer shall indemnify the Processor from all such claims upon first request.

The Customer is responsible to provide the Processor with the Customer Data in time for the rendering of services according to the Contract and the Customer is responsible for the quality of the Customer Data. The Customer shall inform the Processor immediately and completely if during the examination of the Processor's results the Customer finds errors or irregularities with regard to data protection provisions or instructions of the Customer.

Upon request, the Customer shall provide the Processor with the information specified in Art. 30 para. 2 GDPR, insofar as it is not already available to the Processor.

If the Processor is required to provide information to a governmental body or person on the processing of Customer Data or to cooperate with these bodies in any other way, the Customer is obliged to assist the Processor at first request in providing such information and in fulfilling other appropriate cooperation obligations.

4. Requirements for personnel and systems

The Processor shall commit all persons engaged in processing Customer Data to confidentiality with respect to the processing of Customer Data.

5. Security of processing

The Processor takes necessary appropriate technical and organizational measures according to Art. 32 GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the Customer Data, as well as the different likelihood and severity of the risk to the rights and freedoms of the data subjects, in order to ensure a level of protection of Customer Data appropriate to the risk. The implemented technical and organizational measures include the measures as listed in Annex A.

The Processor shall have the right to modify technical and organizational measures during the term of this Agreement, as long as they continue to comply with the statutory requirements.

6. Engagement of further processors

The Customer grants the Processor the general authorization to engage further processors with regard to the processing of Customer Data. Further processors engaged at the time of conclusion of this Agreement are listed below:

Name of the further processor Data processing purpose
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany Cloud infrastructure services
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany Cloud infrastructure services

 

In general, no authorization is required for contractual relationships with service providers that are concerned with the examination or maintenance of data processing procedures or systems by third parties or that involve other additional services, even if access to Customer Data cannot be excluded, as long as the Processor takes reasonable steps to protect the confidentiality of the Customer Data. If the Customer objects, the Processor is entitled to terminate the Contract and this Agreement with a notice period of three months until the end of a month.

The agreement between the Processor and the further processor must impose the same obligations on the further processor as those incumbent upon the Processor under this Agreement. The Parties agree that this requirement is fulfilled if the contract has a level of protection corresponding to this Agreement.

Subject to compliance with the requirements of Sec. 1 of this Agreement, the provisions of this Sec. shall also apply if a further processor in a third country is involved. The Customer hereby authorises the Processor to conclude an agreement with another processor on behalf of the Customer based on the standard contractual clauses for the transfer of personal data to processors in third countries pursuant to the decision of the European Commission of February 5th in 2010. The Customer declares its willingness to cooperate in fulfilling the requirements of Art. 49 GDPR to the extent necessary.

7. Data subjects' rights

The Processor shall support the Customer within reason by virtue of technical and organisational measures in fulfilling the Customer's obligation to respond to requests for exercising data subjects' rights.

As far as a data subject submits a request for the exercise of its rights directly to the Processor, the Processor will forward this request to the Customer in a timely manner.

The Processor shall inform the Customer of any information relating to the stored Customer Data, about the recipients of Customer Data to which the Processor may disclose it in accordance with the instructions and about the purpose of storage, as far as the Customer does not have this information at its disposal and as far as the Customer is not able to collect it itself.

The Processor shall, within the bounds of what is reasonable and necessary, enable the Customer to correct, delete or restrict the further processing of Customer Data, or at the instruction of the Customer correct, block or restrict further processing itself, if and to the extent that this is impossible for the Customer. In this case, the Processor shall be reimbursed for the expenses and costs incurred by the Processor in this regard and substantiated vis-à-vis the Customer.

Insofar as the data subject has a right of data portability vis-à-vis the Customer in respect of the Customer Data pursuant to Art. 20 GDPR, the Processor shall support the Customer within the bounds of what is reasonable and necessary in handing over the Customer Data in a structured, commonly used and machine-readable format, if the Customer is unable to obtain the data elsewhere. In this case, the Processor shall be reimbursed for the expenses and costs incurred by the Processor in this regard and substantiated vis-à-vis the Customer.

8. Notification and support obligations of the Processor

Insofar as the Customer is subject to a statutory notification obligation due to a breach of the security regarding the Customer Data (in particular pursuant to Art. 33, 34 GDPR), the Processor shall inform the Customer in a timely manner of any reportable events in the Processor´s area of responsibility. The Processor shall assist the Customer in fulfilling the notification obligations at the Processor's request to the extent reasonable and necessary. In this case, the Processor shall be reimbursed for the expenses and costs incurred by the Processor in this regard and substantiated vis-à-vis the Customer.

The Processor shall assist the Customer to the extent reasonable and necessary with data protection impact assessments to be carried out by the Customer and, if necessary, subsequent consultations with the supervisory authority pursuant to Art. 35, 36 GDPR. In this case, the Processor shall be reimbursed for the expenses and costs incurred by the Processor in this regard and substantiated vis-à-vis the Customer.

9. Deletion and return of Customer Data

Upon termination of this Agreement, the Processor shall, in the discretion of the Customer,

  • either delete or return the Customer Data, and
  • delete existing copies thereof

unless the Processor is obligated by law to further store the Customer Data.

The Processor may keep documentations which serve as evidence of the orderly and accurate processing of Customer Data, also after the termination of this Agreement.

10. Evidence and audits

The Processor shall provide the Customer, at the Customer's request, with all information required and available to the Processor to prove compliance with its obligations under this Agreement.

The Customer shall be entitled to audit (including inspections) the Processor with regard to compliance with the provisions of this Agreement, in particular the implementation of the technical and organizational measures.

In order to carry out inspections in accordance with Sec. 10, the Customer is entitled to access the business premises of the Processor in which Customer Data is processed within the usual business hours (Mondays to Fridays from 9 am to 6 pm) after timely advance notification in accordance with Sec. 10 at its own expense, without disruption of the course of business and under strict secrecy of the Processor's business and trade secrets.

The Processor is entitled, at its own discretion and taking into account the Customer's legal obligations, not to disclose information which is sensitive with regard to the Processor's business or if the Processor would be in breach of statutory or other contractual provisions as a result of its disclosure. The Customer is not entitled to get access to data or information about the Processor's other customers, cost information, quality control and contract management reports, or any other confidential data of the Processor that is not directly relevant for the agreed audit purposes.

The Customer shall inform the Processor in good time (usually at least two weeks in advance) of all circumstances in relation to the performance of the audit. The Customer may carry out not more than one audit per calendar year.

If the Customer commissions a third party to carry out the audit, the Customer shall obligate the third party in writing in the same way as the Customer is obliged vis-à-vis the Processor according to this Sec. 10. In addition, the Customer shall by way of written agreement obligate the third party to maintain secrecy and confidentiality unless the third party is subject to a professional obligation of secrecy. At the request of the Processor, the Customer shall immediately submit to the Processor the commitment and confidentiality agreements with the third party. The Customer may not commission any of the Processor's competitors to carry out the audit.

At the discretion of the Processor, proof of compliance with the obligations under this Agreement may be provided, instead of an inspection, by submitting an appropriate current opinion or report from an independent authority (e.g. auditor, audit department, data protection officer, IT security department, data protection auditors or quality auditors) or a suitable certification by IT security or data protection audit (the "Audit Report"), if the Audit Report makes it possible for the Customer in an appropriate manner to convince itself of the Processor's compliance with the contractual obligations contained in this Agreement.

11. Contract term and termination

The term and termination of this Agreement shall be governed by the term and termination provisions of the Contract. A termination of the Contract automatically results in a cancellation of this Agreement. An isolated termination of this contract is excluded.

12. Liability

The Processor's liability under this Agreement shall be governed by the disclaimers and limitations of liability provided for in the Contract. As far as third parties assert claims against the Processor which are caused by the Customer's culpable breach of this Agreement or one of the Customer´s obligations as the controller in terms of data protection law, the Customer shall upon first request indemnify and hold the Processor harmless from these claims.

The Customer undertakes to indemnify the Processor upon first request against all possible fines imposed on the Processor corresponding to the Customer's part of responsibility for the infringement sanctioned by the fine.

13. Final provisions

In case individual provisions of this Agreement are ineffective or become ineffective or contain a gap, the remaining provisions shall remain unaffected. The Parties undertake to replace the ineffective provision by a legally permissible provision which comes closest to the purpose of the ineffective provision and that thereby satisfies the requirements of Art. 28 GDPR.

In case of conflicts between this Agreement and other arrangements of the Parties, in particular the Contract, the provisions of this Agreement shall prevail.

The exclusive place of jurisdiction for all disputes arising from and in connection with this Agreement shall be, to the extent permitted by law, Munich City.

 

Annex A

According to Art. 32 GDPR controller and processor of personal data must take technical and organizational measures (TOM) to ensure that the security and protection requirements of data protection are met. Technical measures are to be understood as all protection attempts that are physically implementable in the broadest sense, such as securing doors and windows or measures implemented in software and hardware, such as setting up a user account and password requirement. Organizational measures are to be understood as protection attempts that are implemented through instructions, procedures and processes.

Category of Measures Description of Category Technical Measures Organisational Measures
pseudonymisation and encryption Cryptographic measures to ensure that information is hashed when transferred and can only become readable again by using the correct encryption key.

Encryption of "data in transit";
Encryption of laptops/notebooks storage and mobile storage devices ("data at rest");
Pseudonymization through separation of allocation data and storage in separate and secured systems (encrypted if possible)

Internal instruction to anonymize/pseudonymize personal data in the event of disclosure or even after the statutory deletion period has expired
Confidentiality – physical access control Measures to prevent unauthorised persons from gaining access to data Processing systems with which personal data is processed or used.

Manual locking system;
Security locks;
Protection by security company;
Protected containers (numerical codes);
No servers on own premises - only cloud-based

Key Regulation/List;
Visitors' book/log of visitors;
Visitors escorted by staff;
Selection of security guards;
Selection of cleaning services;
Instruction for employees
Confidentiality – data access control Measures to prevent data Processing systems from being used without authorization.

Login with username + password;
Login with biometric data;
Regular password renewal;
Anti-virus/anti-spyware/email protection software clients;
Disk/smartphone encryption;
Automatic desktop lock;
Notebook/tablet encryption;
Cloud multifactor authentication

Manage user permissions;
Creating user profiles;
Desktop lock policy;
Secure Password Policy;
Immediate blocking of authorization when employees leave the company

Confidentiality – data usage control Measures to ensure that persons entitled to use a data Processing system have access only to the data to which they have a right of access, and that personal data cannot be read, copied, altered or removed without authorisation in the course of Processing or use and after storage. Logging of access to applications, specifically when data is entered, modified and deleted;
Regular security updates;
Firewalls;
Use of document shredders or appropriate service providers and physical erasure of data media prior to reuse

Deployment of authorization concepts;
Minimum number of administrators;
Management of user rights by administrators

Confidentiality – transmission control Measures to ensure that personal data cannot be read, copied, altered or removed during electronic transmission or transport or storage onto data carriers, and that it is possible to check and establish to which bodies the transfer of personal data by means of data transmission facilities is envisaged. E-mail encryption;
Logging of accesses and retrievals;
Secure transport containers;
Use of signature procedures;
Documentation of all interfaces
Documentation of data recipients and the duration of the planned transfer or deletion periods;
Overview of regular retrieval and transmission processes;
Transfer in anonymized or pseudonymized form;
Personal handover with protocol
Confidentiality – separation control Measures to ensure that data collected for different purposes can be processed separately.

Physical separation (systems / databases / data storages);
Separation of development, production and test environment

Authorization concepts;
Determination of database rights;
Definition of cloud rights;
Logical client separation

Integrity – input control Full documentation of data management and maintenance must be maintained - to ensure the ongoing integrity of data. Measures for subsequent checking whether data has been entered, changed or removed (deleted), and by whom. Technical logging of data entry, modification and deletion;
Manual or automated control of the logs

Overview of programs which can be used to enter, change or delete data;
Clear responsibilities for deletions;
Assignment of rights to enter, change and delete data on the basis of an authorization concept;
Retention of forms from which data has been transferred to automated processing operations

Availability – availability control Measures to ensure that personal data is protected from accidental destruction or loss. Cloud-based systems with own availability concepts and redundancy Remote data backup at secure, off-site locations;
Data backup concepts
Availability – job control Measures to ensure that, in the case of commissioned Processing of personal data, the data is processed only in accordance with the instructions of the Controller.  

Prior review of the security measures taken by the contractor and their documentation;
Selection of the contractor under due diligence aspects (especially with regard to data protection and data security);
Conclusion of the necessary agreements on commissioned processing or EU standard contractual clauses;
Written instructions to the contractor;
Obligation of the contractor's employees to maintain data secrecy;
Obligation to appoint a data protection officer by the contractor if the obligation to appoint exists;
Agreement on effective control rights vis-à-vis the contractor;
Regulation on the use of further subcontractors;
Ensuring that data is destroyed after completion of the contract;
In the case of longer cooperation: regular audit of the contractor and its level of protection

Resilience Measures to ensure the resilience of the systems and services that guarantee that the systems and services are designed in such a way that even high peak loads and high continuous loads of Processing can be handled.   Monitoring of storage, access and resource usage
Restoration of availability and access Measures to ensure that availability of and access to the data can be restored in a timely manner in the event of a physical or technical incident. Services with own TOM

Verification of backup processes;
Regular data recovery testing and logging of results;
Existence of a contingency plan;
Backup concept

Data protection management Measures to ensure a process for regularly testing, assessing and evaluating the effectiveness of the technical and organisational measures for ensuring the security of the Processing. Documented concepts;
A review of the effectiveness of the technical protective measures is carried out at least annually
Employees sensitized to confidentiality/data secrecy at least annually;
The organization complies with the information obligations according to Art. 13 and Art. 14 GDPR

 

Questions?

Please contact us on privacy@centrldesk.com if you should have any questions.