A Data Processing Agreement is a central requirement of the GDPR (General Data Protection Regulation) according to Art. 28 paragraph 3. When personal data is transferred to a processor, this processing must be based on a contract between the controller and the processor. This contract regulates the rights and obligations of the client and contractor as well as possible subcontractors. The technical and organizational measures for the protection of personal data are determined in a DPA.

For the storage of personal data on external infrastructures, it may be necessary to conclude a data processing agreement with the respective operator, as prescribed by Article 28 of the EU-GDPR. It is recommended to seek advice from a data protection officer or lawyer on this matter.

We offer our customers the option to conclude a supplementary agreement. There are no additional fees if our contract generator is used.

To conclude the contract, go to the Master Data menu item in the Customer Control Panel (CCP). Switch to the Order Processing tab and click Create AV Contract. We will save a copy of the contract. Your electronic signature is sufficient for us to conclude the contract. You also have the option of sending us your signed version of the contract by post. We will then file the contract in our archive.

A Data Processing Agreement is necessary when personal data is transferred to third parties and processed by them. The processors must ensure that appropriate technical and organizational measures are taken so that the processing is in accordance with the requirements of this regulation and the protection of the rights of the data subject is guaranteed.

A Data Processing Agreement must be concluded if an external service provider has access to personal data. As soon as an external service provider has the opportunity to access personal data within the scope of an order, it should be carefully checked to what extent the regulations on data processing apply.

If an agreement on data processing is missing or incomplete, although it was necessary, fines can be imposed which can vary depending on the violation. Violations of the GDPR are examined and sanctioned by the responsible supervisory authorities.

According to Article 4 GDPR, personal data is “any information relating to an identified or identifiable natural person”. This means that all information that can establish a reference to a person is considered personal data. This includes:

• Name and address
• E-mail address
• Telephone number
• Account data

We offer our customers the option of concluding such a supplementary agreement. Despite the effort involved, we do so without charging any separate costs if our template for the supplementary agreement is used.

To conclude such an additional agreement on data processing with us, proceed as follows:

1. Log in to the Customer Control Panel (CCP).
2. Go to Master Data >  Order Processing.
3. Indicate which data you store with us.
4. Name the circle of affected persons.
5. Read through the contract.
6. If you agree with it, click Generate DPA.
    

You will receive a contract signed and stamped by us. We will store a copy of the contract. Your electronic signature is sufficient for the conclusion. If you wish, you can also send us your version of the contract signed by mail. We will then store the contract in our archive. For details, please consult a lawyer.

Please understand that the conclusion of a completely individual agreement on data processing with our lawyer involves a great deal of effort. This can result in costs that can amount to several hundred euros. Each individual data processing must be managed separately by us, which incurs further costs. Therefore, we only offer the free conclusion of an additional agreement on data processing based on our contract draft. This has been carefully prepared and covers the essential requirements of the GDPR according to our assessment.