Agreement text

Note: This is an English translation provided for convenience. The German version is legally binding.

Data Processing Agreement

within the meaning of Art. 28(3) GDPR

between

dem Kunden (Angaben werden beim Abschluss aus dem Kundenkonto übernommen)

hereinafter the "Controller"

and

OW Media Solutions GmbH
Daimlerstr. 47
48308 Senden

hereinafter the "Processor"

1. General Provisions and Subject Matter of the Agreement

1.1 The subject matter of this Agreement is the processing of personal data on behalf of the Controller by the Processor (Art. 28 GDPR). The Controller is the controller within the meaning of Art. 4(7) GDPR.

1.2 The content of the engagement, the categories of data subjects and the types of data, as well as the purpose of the Agreement, are set out in Annex 1.

1.3 The processing of data by the Processor takes place exclusively within the territory of the Federal Republic of Germany, a Member State of the European Union or a Contracting State of the EEA Agreement. Processing outside these states takes place only under the conditions of Chapter 5 of the GDPR (Art. 44 et seq.) and with the prior consent or on the prior instruction of the Controller.

2. Term of the Agreement and Termination

This Agreement is concluded for an indefinite period and may be terminated by either party by ordinary termination with a notice period of three months. The right to extraordinary termination for good cause remains unaffected.

3. Instructions of the Controller

3.1 The Controller has a comprehensive right to issue instructions to the Processor with regard to the nature, scope and modalities of the data processing. The Processor shall inform the Controller without undue delay if the Processor is of the opinion that an instruction of the Controller infringes statutory provisions. If an instruction is issued whose lawfulness the Processor doubts on substantiated grounds, the Processor is entitled to suspend its execution temporarily until the Controller expressly confirms or amends it. If there is a possibility that the Processor would be exposed to a liability risk by following the instruction, the execution of the instruction may be suspended until the liability in the internal relationship has been clarified – or until the Controller has provided other appropriate security to avert damage to the Processor.

3.2 Processing that deviates from the instructions of the Controller or takes place without instructions of the Controller is permissible only if the Processor is obliged to process the data under the law of the European Union or of the Member States. In the event of such processing, the Processor shall inform the Controller without undue delay of the intended or already initiated processing, unless the relevant law of the European Union or of the Member State prohibits such notification on important grounds of public interest; in this case, the notification shall be made without undue delay as soon as the legal obstacles no longer exist.

3.3 Instructions shall generally be issued in writing or in an electronic format (e.g. by e-mail). Oral instructions are permissible in justified individual cases and shall be confirmed by the Controller without undue delay in writing or in an electronic format. The confirmation shall expressly state the reasons why the instruction could not be issued in text form. The Processor shall document the person, date and time of the instruction issued by the Controller in an appropriate form.

3.4 At the request of the Processor, the Controller shall designate one or more persons authorised to issue instructions. Changes in personnel shall be communicated to the Processor without undue delay.

4. Control Powers of the Controller

4.1 The Controller is entitled to verify compliance with the statutory and contractual provisions on data protection and data security before the start of the data processing and regularly during the term of the Agreement, to the extent necessary. The Controller shall ensure that the control measures are proportionate and do not interfere with the Processor's operations more than necessary.

4.2 The results of the controls and instructions shall be documented by the Controller in an appropriate manner.

5. General Obligations of the Processor

5.1 The processing of the data that is the subject of this Agreement by the Processor takes place exclusively on the basis of the contractual agreements in conjunction with any instructions issued by the Controller. Processing deviating from this is permissible only if the Processor is obliged to process the data under the law of the European Union or of the Member States. In the event of such processing, the Processor shall inform the Controller without undue delay of the intended or already initiated processing, unless the relevant law of the European Union or of the Member State prohibits such notification on important grounds of public interest; in this case, the notification shall be made without undue delay as soon as the legal obstacles no longer exist.

5.2 The Processor shall ensure that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). Before being made subject to the obligation of confidentiality, the persons concerned may not be given access to the personal data provided by the Controller.

6. Technical and Organisational Measures

The Processor has defined appropriate technical and organisational measures to ensure an adequate level of protection and has recorded them in Annex 2 of this Agreement. The measures described therein were selected in compliance with the requirements of Art. 32 GDPR. The Processor shall review and adapt the technical and organisational measures regularly and as occasion requires.

7. Support Obligations of the Processor

The Processor shall support the Controller pursuant to Art. 28(3)(e) GDPR in fulfilling its obligations to safeguard the rights of data subjects under Chapter III, Art. 12 – 22 GDPR. This applies in particular to the provision of information and the deletion, rectification or restriction of personal data. The Processor shall furthermore support the Controller pursuant to Art. 28(3)(f) GDPR in fulfilling its obligations under Art. 32-36 GDPR (in particular notification obligations). The scope of these support obligations is determined in each individual case, taking into account the nature of the processing and the information available to the Processor.

8. Use of Sub-processors (Subcontractors)

8.1 The Processor is entitled to engage sub-processors (subcontractors). All subcontractor relationships of the Processor already existing at the time of conclusion of the Agreement are exhaustively listed in Annex 3 to this Agreement. For the subcontractors listed in Annex 3, consent is deemed to have been granted upon conclusion of this Agreement.

8.2 If the Processor intends to engage further subcontractors, the Processor shall notify the Controller of this in writing or in electronic form in good time – but no later than two weeks – before their engagement. Following this notification, the Controller has two weeks to object to the engagement of the subcontractor(s). If no objection is made within this period, the engagement of the subcontractor(s) is deemed approved. In urgent cases (e.g. where error analyses or defect remedies are required at short notice), the Processor may reasonably shorten the notification and objection period for subcontractors. If an objection is made within the deadline, the subcontractors concerned may not be engaged. Objections are permissible only if the Controller has justified grounds to believe that the engagement of the sub-processor would restrict data security or data protection, would jeopardise compliance with statutory or contractual provisions and/or other legitimate interests of the Controller conflict with it; the corresponding grounds for suspicion shall be attached to the objection.

8.3 Subcontractors are selected by the Processor in compliance with the statutory and contractual requirements. All contracts between the processor (Processor) and the sub-processor (subcontractor) must satisfy the statutory provisions on the processing of personal data on behalf of a controller; this concerns in particular the implementation of appropriate technical and organisational measures pursuant to Art. 32 GDPR in the subcontractor's operations. Ancillary services which the Processor uses in the exercise of its business activities do not constitute sub-processing relationships within the meaning of Art. 28 GDPR. Ancillary services in this sense are in particular telecommunications services without a specific connection to the main service, postal and transport services as well as other measures intended to ensure the confidentiality and/or integrity of hardware and software and which have no specific connection to the main service. The Processor shall, however, also ensure compliance with the statutory data protection standards for these third-party services (in particular by means of appropriate confidentiality agreements).

8.4 All contracts between the Processor and the sub-processor (subcontractor) must satisfy the requirements of this Agreement and the statutory provisions on the processing of personal data on behalf of a controller.

8.5 The engagement of subcontractors in third countries is permissible only if the statutory requirements of Art. 44 et seq. GDPR are met and the Controller has given its consent.

9. Notification Obligations of the Processor

9.1 Breaches of this Agreement, of instructions of the Controller or of other data protection provisions shall be notified to the Controller without undue delay; the same applies where there is a corresponding justified suspicion. This obligation applies irrespective of whether the breach was committed by the Processor itself, a person employed by the Processor, a subcontractor or any other person engaged by the Processor to fulfil contractual obligations.

9.2 If a data subject, an authority or any other third party requests the Processor to provide information, rectification, restriction of processing or deletion, the Processor shall forward the request to the Controller without undue delay and coordinate the further procedure with the Controller.

9.3 The Processor shall inform the Controller without undue delay if supervisory actions or other measures by an authority are imminent which could also affect the processing, use or collection of the personal data provided by the Controller. In addition, the Processor shall inform the Controller without undue delay of all events or measures by third parties which could endanger or impair the data that is the subject of this Agreement.

10. Termination of the Agreement, Deletion and Return of Data

After completion of the data processing that is the subject of this Agreement or after termination of this Agreement, the Processor shall, at the option of the Controller, delete or return all personal data, provided that the Processor is no longer under any legal obligation to store the data concerned (e.g. statutory retention periods).

11. Data Secrecy and Confidentiality

The Processor is obliged, without time limitation and beyond the end of this Agreement, to treat the personal data obtained in the course of this contractual relationship confidentially. The Processor undertakes to familiarise employees with the relevant data protection provisions and rules on the protection of secrets and to bind them to confidentiality before they commence their work at the Processor.

12. Final Provisions

12.1 Amendments to this Agreement and collateral agreements must be made in written or electronic form which clearly indicates that and which amendment or supplement to the present terms is to be effected thereby.

12.2 If the contracting parties are merchants, legal entities under public law or special funds under public law, the registered office of the Processor is the place of jurisdiction for all disputes arising from this Agreement; exclusive places of jurisdiction remain unaffected.

12.3 Should the GDPR or other statutory provisions referred to herein change during the term of the Agreement, the references herein shall also apply to the respective successor provisions.

12.4 Should individual parts of this Agreement be or become invalid, the validity of the remaining provisions shall remain unaffected.

12.5 All annexes to this Agreement form an integral part of the Agreement.

Annex 1 - Details of the Engagement

Annex 2 - List of the Processor's Existing Technical and Organisational Measures pursuant to Art. 32 GDPR

The Processor implements the following technical and organisational measures to protect the personal data that is the subject of this Agreement. The measures were defined in accordance with Art. 32 GDPR and agreed with the Controller.

1. Securing the Processor's Premises (Physical Access Control)

The Processor's premises are secured against burglary and other unauthorised physical access in the following manner:

• Personal data of the Controller is not stored on the Processor's business premises, but exclusively in a certified data centre of the subcontractor (ISO 27001) within the EU.

2. Securing the Processor's IT Systems (System Access Control)

The Processor's IT systems are secured against unauthorised access (e.g. hacker attacks) in the following manner:

• Password assignment
• Password policies (regular change, minimum length, complexity etc.)
• Creation of user profiles in the IT systems
• Login to the IT systems with individual user name and password
• Access rules for users / user groups in the IT systems (authorisation concept)
• Management of authorisations by system administrators
• Number of system administrators is reduced to the "bare minimum"
• Regular and event-driven updating and review of access rights (in particular when employees leave or similar)
• Use of software firewall
• Access to the servers only via SSH with key-based authentication, no password login
• Automatic blocking after failed login attempts (fail2ban)
• Application services are not directly reachable from the Internet, but only via the upstream web server (TLS)
• Customer accounts with passkeys or password, administrative access with passkeys
• Audio files are stored outside the web directory and are delivered only via verified links

3. Logging of Data Processing Operations (Input Control)

The following measures ensure that the Processor can at any time identify which data processing operations have taken place in its data processing systems (e.g. input, modification, blocking or deletion):

• Logging of access to the Processor's IT systems (log records)
• Logging of inputs, modifications and deletions (log records)
• Logging of the actions of individual users
• Deletions of voice messages are logged with time and reason (deletion log without content)

4. Secure Deletion of Data

The following measures ensure the proper deletion of the data that is the subject of this Agreement:

• Deletion concept
• Proper cleansing of data media before reuse
• Automatic deletion of all voice messages, transcriptions and logs after expiry of the plan-dependent storage period
• Immediate deletion by the Controller via its account possible at any time
• Employees of the Processor have no access to the content of voice messages in the administration interface (no playback, no download)

5. Data Protection at the Processor's Subcontractors

The following measures ensure that the subcontractors selected by the Processor act in compliance with data protection law:

• Selection of subcontractors with due diligence (in particular with regard to data security)
• Conclusion of GDPR-compliant data processing agreements with the subcontractor
• Ongoing and event-driven review of the subcontractor
• Ensuring the destruction of data at the subcontractor after completion of the engagement

6. Securing Data during Transport and Transmission (Transfer Control)

The following measures ensure that personal data is protected against unauthorised third parties during transfer (physical and/or digital):

• Encryption of e-mail traffic
• Encryption of other communication channels
• All transmissions exclusively encrypted (TLS 1.2 or higher), HSTS active

7. Data Backup and Backups (Availability and Recoverability)

The following measures ensure that the data that is the subject of this Agreement is available at all times:

• Backup & recovery concept
• Securing of server rooms
• Alarm notification in the event of unauthorised physical access to server rooms
• Uninterruptible power supply (UPS)
• Air conditioning of server rooms
• Fire and smoke detection systems in server rooms
• Fire extinguishers in server rooms
• Daily backup of the database with limited retention (14 days); voice recordings are deliberately not backed up due to their short storage period and are irretrievably deleted after expiry

8. Review, Evaluation and Adaptation of the Present Measures

The Processor shall review, evaluate and, where necessary, adapt the technical and organisational measures described in this Annex at intervals of 12 months and as occasion requires.

Annex 3 - List of Existing Subcontractors at the Time of Conclusion of the Agreement