Terms & Conditions

Order processing according to Art. 28 AB. 3 GDPR

Between the customer (address) (Client) vis-à-vis 4OfficeAutomation GmbH, Schlägelweg 46a, 31275 Lehrte, HRB 203395, Hildesheim Local Court (Contractor)

1. object and duration of the order

The subject matter of the data handling order includes the creation of e-mail newsletters and their transmission to named recipient addresses, in each case to the extent specified by the client. The duration of this order (term) corresponds to the term of the service agreement.

2. nature and purpose of the intended processing of personal data

• The data to be processed includes, in particular, lists of recipients of an e-mail newsletter and associated personalization data to an extent determined by the client at its own discretion, as well as log data generated by processing the order.
• The provision of the contractually agreed data processing shall take place exclusively in a member state of the European Union or in another state party to the Agreement on the European Economic Area. Any relocation to a third country requires the prior consent of the client and may only take place if the special requirements of Art. 44 et seq. GDPR are fulfilled.

3. technical and organizational measures

• The Contractor shall document the implementation of the technical and organizational measures set out and required prior to the award of the contract before the start of processing, in particular with regard to the specific execution of the contract, and submit them to the Client for review. If accepted by the client, the documented measures shall form the basis of the order. If the client's review/audit reveals a need for adjustment, this must be implemented by mutual agreement.
• The contractor must establish security in accordance with Art. 28 para. 3 lit. c, 32 GDPR, in particular in conjunction with Art. 5 para. 1, para. 2 GDPR. Overall, the measures to be taken are data security measures and measures to ensure a level of protection appropriate to the risk with regard to the confidentiality, integrity, availability and resilience of the systems. The state of the art, the implementation costs and the nature, scope and purposes of the processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons within the meaning of Art. 32 para. 1 GDPR must be taken into account.
• The technical and organizational measures are subject to technical progress and further development. In this respect, the contractor is permitted to implement alternative adequate measures. In doing so, the security level of the specified measures must not be undercut. Significant changes must be documented.

4. rectification, restriction and erasure of data

• The Contractor may not rectify, erase or restrict the processing of data processed on behalf of the Client without authorization, but only in accordance with documented instructions from the Client. If a data subject contacts the Contractor directly in this regard, the Contractor shall forward this request to the Client without delay.
• If included in the scope of services, the deletion concept, right to be forgotten, rectification, data portability and information shall be ensured directly by the contractor in accordance with documented instructions from the client. Any costs incurred for this shall be borne by the client.

5. quality assurance and other obligations of the contractor

In addition to complying with the provisions of this contract, the Contractor has legal obligations pursuant to Art. 28 to 33 GDPR; in this respect, the Contractor guarantees compliance with the following requirements in particular:

• Data Protection Officer The contractor is not obliged to appoint a data protection officer. Mr. Johannes Vorwerk, Managing Director, 05132/946 7012 jvorwerk@mynewsletter.rocks is designated as the contact person at the Contractor.
• Confidentiality Maintaining confidentiality in accordance with Art. 28 para. 3 sentence 2 lit. b, 29, 32 para. 4 GDPR. When carrying out the work, the Contractor shall only use employees who have been obliged to maintain confidentiality and who have previously been familiarized with the data protection provisions relevant to them. The Contractor and any person subordinate to the Contractor who has access to personal data may only process this data in accordance with the instructions of the Client, including the powers granted in this contract, unless they are legally obliged to process it.
• The implementation of and compliance with all technical and organizational measures required for this order in accordance with Art. 28 para. 3 sentence 2 lit. c, 32 GDPR [details in Annex 1]
• The Client and the Contractor shall cooperate with the supervisory authority in the performance of their tasks upon request.
• Immediate information of the client about control actions and measures of the supervisory authority, insofar as they relate to this order. This also applies if a competent authority is investigating the processing of personal data in the context of administrative offense or criminal proceedings relating to the processing of personal data by the contractor.
• If the Client is subject to an inspection by the supervisory authority, administrative offense or criminal proceedings, a liability claim by a data subject or a third party or any other claim in connection with the commissioned processing at the Contractor, the Contractor shall support the Client to the best of its ability. Any costs incurred for this shall be borne by the Client.
• The Contractor shall regularly monitor the internal processes and the technical and organizational measures to ensure that the processing in its area of responsibility is carried out in accordance with the requirements of the applicable data protection law and that the protection of the rights of the data subject is guaranteed.

6. subcontracting relationships

• Subcontracting relationships within the meaning of this provision are those services that are directly related to the provision of the main service. This does not include ancillary services which the Contractor uses, e.g. as telecommunications or hosting services, postal/transport services, maintenance and user service or the disposal of data carriers as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. However, the Contractor is obliged to take appropriate and legally compliant contractual agreements and control measures to ensure the data protection and data security of the Client's data, even in the case of outsourced ancillary services.
• The Contractor may only commission subcontractors (other processors) with the prior express written or documented consent of the Client.
• The transfer of personal data of the client to the subcontractor and the subcontractor's initial activities are only permitted once all requirements for subcontracting have been met.
• If the subcontractor provides the agreed service outside the EU/EEA, the Contractor shall ensure the admissibility under data protection law by taking appropriate measures. The same applies if service providers within the meaning of para. 1 sentence 2 are to be used.
• Further outsourcing by the subcontractor is not permitted.

7. control rights of the client

• The Client has the right to carry out inspections in consultation with the Contractor or to have them carried out by inspectors to be named in individual cases. It shall have the right to satisfy itself of the Contractor's compliance with this Agreement in its business operations by means of spot checks, which must generally be notified in good time.
• The Contractor shall ensure that the Client can satisfy itself of the Contractor's compliance with its obligations under Art. 28 GDPR. The Contractor undertakes to provide the Client with the necessary information upon request and, in particular, to provide evidence of the implementation of the technical and organizational measures.
• Proof of such measures, which do not only concern the specific order, can be provided by
  • compliance with approved codes of conduct pursuant to Art. 40 GDPR;

• • certification in accordance with an approved certification procedure pursuant to Art. 42 GDPR; current certificates, reports or report extracts from independent bodies (e.g. auditors, internal audit, data protection officer, IT security department, data protection auditors, quality auditors);
  • suitable certification through an IT security or data protection audit (e.g. in accordance with BSI basic protection).

• The Contractor may claim remuneration for enabling the Client to carry out inspections.

8. notification of violations by the contractor

• The Contractor shall support the Client in complying with the obligations set out in Articles 32 to 36 of the GDPR regarding the security of personal data, reporting obligations in the event of data breaches, data protection impact assessments and prior consultations. This includes, among other things

1. 1. ensuring an adequate level of protection through technical and organizational measures that take into account the circumstances and purposes of the processing as well as the predicted probability and severity of a possible infringement through security breaches and enable the immediate detection of relevant infringement events.
   2. the obligation to report personal data breaches to the client without delay
   3. the obligation to support the client in the context of its duty to inform the data subject and to provide it with all relevant information in this context without delay
   4. Supporting the client for its data protection impact assessment
   5. supporting the client in the context of prior consultations with the supervisory authority

• The Contractor may claim remuneration for support services that are not included in the service description or are attributable to misconduct on the part of the Contractor.

9. authority of the client to issue instructions

• The client shall confirm verbal instructions without delay (at least in text form).
• The Contractor must inform the Client immediately if it is of the opinion that an instruction violates data protection regulations. The Contractor shall be entitled to suspend the implementation of the relevant instruction until it is confirmed or amended by the Client.

 
10. deletion and return of personal data

• Copies or duplicates of the data are not created without the knowledge of the client. Excluded from this are backup copies, insofar as they are necessary to ensure proper data processing, as well as data required to comply with statutory retention obligations.
• After completion of the contractually agreed work or earlier at the request of the Client - at the latest upon termination of the service agreement - the Contractor shall hand over to the Client all documents, processing and usage results and data pertaining to the contractual relationship that have come into its possession or, with prior consent, destroy them in accordance with data protection regulations. The same applies to test and scrap material. The deletion log must be submitted on request.
• Documentation that serves as proof of proper data processing in accordance with the order shall be retained by the Contractor beyond the end of the contract in accordance with the respective retention periods. The Contractor may hand them over to the Client at the end of the contract in order to discharge the Client.