Data Processing Agreement (DPA)

(1) This Data Processing Agreement (hereinafter “DPA”) governs the processing of personal data on behalf of the customer in connection with the provision of web hosting, DNS hosting, and domain registration and management services (hereinafter “Services”) by Bredow Systems, owner Jan Christopher Bredow (hereinafter “Provider” or “Processor”) for its customers (hereinafter “Customer” or “Controller”).

(2) This DPA automatically becomes part of the agreement existing between the parties (offer or service description within the meaning of the Provider’s Terms & Conditions, hereinafter “Main Agreement”), insofar as the Provider processes personal data on behalf of the Customer in the course of providing the Services. No separate signature is required for this. Upon request, the Provider will also make this DPA available to the Customer as a separately signable document.

(3) In the event of conflicts between this DPA and the Main Agreement, this DPA shall prevail on matters concerning the processing of personal data.

(1) Depending on the Services booked by the Customer, the subject matter of the processing includes in particular:

1. Web hosting (provision of storage space, server infrastructure, and, where applicable, e-mail mailboxes)
2. DNS hosting (management of name server entries and DNS zones)
3. Domain registration and management (rental or sale and administration of domains, communication with the respective registry or registrar, e.g. DENIC eG for .de domains)

(2) The processing takes place for the duration of the Main Agreement.

(3) The purpose of the processing is the provision and operation of the commissioned infrastructure, the registration, administration and renewal of domains, technical support and troubleshooting, and the creation of backup copies in connection with the provision of the Services.

(1) Data subjects include in particular the Customer’s employees and contact persons as well as the Customer’s own customers, users, or website visitors whose data is processed via the infrastructure provided by the Provider.

(2) The data processed includes in particular master and contact data (name, address, e-mail address, telephone number) in connection with domain or hosting administration, access credentials, usage and log data (including IP addresses and access times), and content data that the Customer itself processes via the hosted systems (e.g. website content, e-mails, databases), insofar as such data contains personal data.

(1) The Provider processes personal data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by Union or Member State law to which the Provider is subject; in such a case, the Provider shall inform the Customer of that legal requirement before processing, unless that law prohibits such information.

(2) The Services agreed in the Main Agreement constitute the initial instruction. Further instructions shall be given in text form or confirmed in text form without undue delay.

(3) If the Provider considers an instruction from the Customer to be unlawful, it shall inform the Customer thereof without undue delay and is entitled to suspend implementation of that instruction until it is confirmed or amended.

(1) The Provider processes personal data exclusively within the scope of this DPA and the Customer’s instructions.

(2) The Provider ensures that all persons with access to the data are bound to confidentiality; this obligation continues to apply after the end of the respective activity.

(3) The Provider supports the Customer, to the extent reasonably possible, in fulfilling data subjects’ rights (Art. 12 to 22 GDPR) and in complying with the obligations under Art. 32 to 36 GDPR. If a data subject contacts the Provider directly, the Provider shall forward the request to the Customer without undue delay, without responding to it itself, unless instructed otherwise.

(4) The Provider’s contact person for data protection matters relating to this DPA is Jan Christopher Bredow, e-mail: info@bredow.systems. The Provider is not legally required to appoint a data protection officer and has not appointed one.

(1) The Provider implements technical and organizational measures pursuant to Art. 32 GDPR that ensure a level of protection appropriate to the risk, including access control, encrypted transmission, regular data backups, and separation of data belonging to different customers.

(2) A detailed overview of the measures taken (TOMs), including a current list of the sub-processors engaged, is made available to the Customer by the Provider upon request.

(3) The Provider is entitled to adapt the measures taken in line with the state of the art, provided the original level of protection is not reduced.

(1) The Provider shall notify the Customer without undue delay, and no later than 48 hours after becoming aware, of any breach of the security of personal data that affects data of the Customer processed under this DPA, and shall communicate the circumstances known to it (nature of the incident, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed).

(2) The assessment of whether the incident is subject to notification requirements under Art. 33, 34 GDPR, and any resulting notification to the supervisory authority or notification of data subjects, is the responsibility of the Customer as Controller.

(1) The Customer grants the Provider general authorization to engage sub-processors for the provision of the contractually agreed Services (general authorization).

(2) A current overview of the sub-processors engaged forms part of the Provider’s technical and organizational measures (TOMs, see §6(2)) and is made available to the Customer upon request.

(3) The Provider shall inform the Customer in text form before engaging a new sub-processor or replacing an existing one. The Customer may object to such a change within 14 days of receiving the notice for good, data-protection-related cause relating to the sub-processor in question; if no objection is raised within this period, the change is deemed approved.

(4) The Provider shall impose the obligations set out in this DPA on every sub-processor in a manner equivalent to Art. 28 GDPR.

(5) Ancillary services used by the Provider to support the performance of the contract that do not involve access to the Customer’s personal data (e.g. telecommunications services, maintenance and user support, or disposal of data carriers) do not constitute sub-processing within the meaning of this provision.

(1) The Customer has the right to satisfy itself of the Provider’s compliance with this DPA before the processing begins and thereafter at reasonable intervals; the Provider shall provide suitable evidence upon request.

(2) On-site audits are possible upon reasonable prior notice (at least 2 weeks), taking into account the Provider’s legitimate confidentiality interests, and no more than once per year, unless a specific occasion justifies an additional audit. The Customer shall bear the costs of an on-site audit unless it reveals deficiencies for which the Provider is responsible.

(1) Upon termination of the Main Agreement, the Provider shall delete all personal data processed on behalf of the Customer or return it at the Customer’s choice, unless storage is required under Union or Member State law.

(2) If the Customer does not issue a deviating instruction regarding the return of data within 30 days of the end of the contract, the Provider is entitled to irrevocably delete the data concerned thereafter; this corresponds to the period set out in the Provider’s Terms & Conditions.

Unless otherwise provided in this DPA, the liability of the parties shall be governed by the applicable statutory provisions and, in addition, by the liability provisions of the Provider’s Terms & Conditions. Art. 82 GDPR remains unaffected.

(1) Amendments to this DPA require text form; this also applies to any waiver of this form requirement.

(2) The Provider is entitled to amend this DPA insofar as necessary to comply with data protection requirements, provided this does not unreasonably alter the overall contractual structure; amendments will be made available to the Customer at least 6 weeks before they take effect.

(3) Should any provision of this DPA be or become invalid, the validity of the remaining provisions shall remain unaffected.

(4) The laws of the Federal Republic of Germany apply. The place of jurisdiction is, to the extent legally permissible, Hamburg, Germany.