Data Processing Agreement

Section 1 Parties, Subject Matter of this Agreement and Order of Precedence

This agreement on the processing of personal data on behalf of a controller (the “Agreement”) is concluded between:

{{controller.name}}, {{controller.address}}, represented by {{controller.representative}} — hereinafter the “Controller”.

Data protection officer of the Controller, where one exists: {{controller.dpo}}.

and

Bernhard Götzendorfer (sole proprietorship), Rittingergasse 15/11, 1210 Vienna, Austria, GISA number 38550959, GLN 9110028021398, email office@gotzendorfer.at — hereinafter the “Processor”, operating under the name EventDrop.

The Controller uses the Processor’s platform in the course of a professional or commercial activity. It is therefore the controller within the meaning of Art. 4(7) GDPR for the personal data processed within its event; the Processor is a processor within the meaning of Art. 4(8) GDPR and processes exclusively on documented instructions.

The Controller is the organisation named in the header of this Agreement, not the individual acting for it. Employees who operate the account or administer an event do not thereby become controllers themselves. This Agreement covers all events assigned to the account named, insofar as the organisation determines the purposes and essential means of the processing and the Processor carries it out for the organisation.

Where the Controller itself acts as a processor for a third party — for instance an agency acting for its client — the sub-processing required for that arrangement must be agreed separately; this Agreement does not cover that case. The Controller documents the purposes and legal bases of its processing, fulfils its information obligations towards data subjects, and names the persons authorised to issue instructions.

This version of the Agreement carries the version identifier 2026-10-01.1. The version and the date of conclusion are recorded in the Controller’s account and can be retrieved there at any time.

In the event of a conflict between this Agreement and the general terms and conditions of the service relationship, this Agreement prevails insofar as the processing of personal data on behalf of the Controller is concerned. In the event of a conflict between the body of this Agreement and its annexes, the body of the Agreement prevails.

Section 2 Subject Matter, Scope and Duration of the Processing

The subject matter of the processing is the provision of a platform through which guests at an event organised by the Controller upload image and video files, and through which those files can be displayed, managed, moderated and downloaded within an access-restricted album.

The Processor processes the personal data processed on behalf of the Controller exclusively for the purpose of providing that service and of fulfilling its obligations under this Agreement. Processing of that data for the Processor’s own purposes — in particular for advertising, profiling, the training of artificial intelligence models, or disclosure to third parties for their own purposes — does not take place.

This is to be distinguished from processing which the Processor carries out under its own responsibility and which is not the subject of this order: the handling and billing of the service relationship including the payment services used for it, reach and conversion measurement on the Processor’s own marketing pages, statutory obligations that apply to it directly as a provider, and the counting of the use of the service per event in order to measure and improve the service. Usage counting records counts of operations such as gallery views, downloads and views of the live photo wall — without names, session identifiers or IP addresses —, links them to the Controller’s account via the event, and is deleted together with the event, at the latest after one year. Those operations concern the Processor’s own contract, usage and visitor data, not the content of an event; they are described in the Processor’s privacy policy.

The duration of the processing is tied to the service relationship between the parties. The Agreement begins upon its conclusion and ends automatically upon termination of the service relationship, without any need for separate notice. There is no separate minimum term.

Obligations which by their nature extend beyond the end of the Agreement — in particular confidentiality under Section 5, deletion or return under Section 10, and the evidentiary obligations under Section 11 — continue to apply after termination until they have been fulfilled.

Section 3 Nature and Purpose of the Processing, Types of Personal Data, Categories of Data Subjects

Nature of the processing: collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure by transmission to the recipients authorised by the Controller, restriction, erasure and destruction — in each case within the scope of hosting and operating the platform.

Purpose of the processing: provision of access-restricted photo and video albums for the events of the Controller, including moderation, administration by the persons authorised by the Controller, and provision for download.

Types of personal data:

• Image and video files including the persons depicted therein, together with the technical metadata of those files (file name, file type, file size, image dimensions, and time of capture where contained in the file). Location data contained in the EXIF data of image files is removed on upload and is not stored.
• Names of guests provided voluntarily when uploading, commenting or reacting. Providing a name is optional; uploading without a name is possible and is the normal case.
• Comment texts written by guests and reactions to individual items, insofar as the Controller has enabled those functions for its event.
• A technical session identifier for the guest. It is generated randomly on the server, stored in an HttpOnly cookie, and serves to associate a guest’s own contributions, to enforce limits, and to group a guest’s contributions in the Controller’s event analytics. It is not linked to any user account and is not displayed to the Controller. It is a pseudonymous, not an anonymous attribute: it groups the contributions of the same device and is therefore capable of relating to a person.
• Reports concerning individual items, including the IP address of the reporting person as well as a contact address and language voluntarily provided by that person, used solely to process the report and to communicate the decision pursuant to Art. 16(5) of Regulation (EU) 2022/2065.
• Results of the automated image analysis (image description, keywords, a score used for pre-selection, a flag for potentially inappropriate content), insofar as the Controller has not disabled that function for its event (Section 12).
• Account and contact data of the persons the Controller has authorised for the event (email address, display name, language setting, role).

Categories of data subjects:

• Guests at the event who upload, comment on, react to or view content.
• Employees of the Controller, insofar as they attend the event or are depicted in uploaded material.
• Third parties depicted in uploaded image or video material without having uploaded it themselves.
• Persons whom the Controller has authorised to administer the event (host, co-administrators, helpers).

The Processor discloses the scope of the event analytics because it goes beyond a purely technical quota check: the basis of the count is the voluntarily provided name, failing which the session identifier. The analytics show the number of uploads per guest identifier and present the most active guests in a ranking ordered by upload count. That ranking is labelled with a serial number; neither the name provided nor the session identifier is displayed. There is no matching across several events, and no biometric identification.

This is therefore a pseudonymous evaluation capable of relating to an individual, not an anonymous statistic. The Controller determines whether it is necessary and permissible for its purpose, informs the data subjects accordingly, and observes any applicable co-determination rights where employees are affected. The Processor does not pre-empt that assessment.

The Controller may disable the ranking of the most active guests for each event individually. For an event with the ranking disabled, the ranking is neither produced nor displayed, and the number of uploads per guest identifier is not shown. For events created with the occasion “Corporate Event”, the ranking is disabled by default at creation; the Controller may change this default.

Special categories of personal data within the meaning of Art. 9(1) GDPR are not a purpose of the processing. The Processor points out that image material may in fact reveal such data; there is no targeted collection, evaluation or enrichment of such data. The Processor does not employ facial recognition, biometric identification, or any matching of persons across multiple images.

Section 4 Processing on Documented Instructions (Art. 28(3)(a) GDPR)

The Processor processes the personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The following constitute documented instructions: this Agreement including its annexes, the scope of service selected by the Controller within the service relationship, and the settings made in the application by the Controller or by the persons it has authorised — in particular access protection, runtime, enabling of the comment and reaction functions, and the settings governing the AI-assisted functions under Section 12.

Any further individual instructions shall be issued by the Controller in text form to the contact address stated in Section 8. Instructions given orally shall be confirmed in text form without undue delay.

If the Processor is of the opinion that an instruction infringes the General Data Protection Regulation or other data protection provisions of the Union or of the Member States, it shall inform the Controller thereof without undue delay (Art. 28(3), second subparagraph, GDPR). It is entitled to suspend execution of the instruction concerned until the Controller has confirmed or amended it.

The Processor does not access the content of the event unless this is necessary to provide the service, to remedy a fault, to process a report, to carry out an instruction of the Controller, or to comply with a legal obligation.

Section 5 Confidentiality (Art. 28(3)(b) GDPR)

The Processor ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. That obligation continues to apply after the respective activity has ended.

The Processor is a sole proprietorship without employees. The person authorised to process the data is the owner; he is himself directly bound to confidentiality. The deputy he has designated is authorised to process the data exclusively in the event of his unavailability under Section 9, and only after having been bound in text form to confidentiality and to data secrecy under § 6 of the Austrian Data Protection Act (DSG); before that, the deputy is given no access to the systems. This statement is made expressly, because wording suggesting an organisation with committed staff would not correspond to the actual circumstances.

Should employees, freelancers or contractors be engaged in future who may gain access to the Controller’s personal data, they shall be bound to confidentiality in text form and informed of the obligations arising from this Agreement before commencing their activity.

Access to personal data is limited to what is necessary for the respective task.

Section 6 Technical and Organisational Measures (Art. 28(3)(c), Art. 32 GDPR)

The Processor takes all measures required pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures in place at the time this Agreement is concluded are described in Annex 2 (Technical and Organisational Measures). Annex 2 forms part of this Agreement.

The measures are subject to technical progress and further development. The Processor is entitled to adapt them; the level of protection described in Annex 2 may not be reduced in doing so. Material changes are documented and communicated to the Controller on request.

The Processor reviews the effectiveness of the measures where there is a specific reason to do so and whenever there are material changes to the processing.

Section 7 Further Processors (Art. 28(2) and (4), Art. 28(3)(d) GDPR)

The Controller grants the Processor general written authorisation within the meaning of Art. 28(2), second sentence, GDPR to engage further processors. The further processors engaged at the time this Agreement is concluded are listed in Annex 1 (Sub-processors), together with their processing purpose and their place of processing. Annex 1 forms part of this Agreement.

Where the Processor intends to engage or replace a further processor, it shall inform the Controller in text form at least 30 days before the change takes effect — to the email address held in the Controller’s account and, where provided, to the data protection officer contact named in the Agreement — stating the name, the processing purpose and the place of processing.

The Controller may object to the intended change on data protection grounds within 14 days of receiving that information. Where the Controller has objected in time, the change does not take effect as against that Controller before its objection period has expired; because the objection period is shorter than the advance notice period under paragraph 2, at least the difference between the two periods remains thereafter, before the change takes effect, for a termination under this paragraph. No suspension of the change beyond that point for individual Controllers, and no waiver of a recipient required to operate the service, is undertaken (Annex 1, “Consequence of an objection”). In the event of an objection, the parties shall seek an amicable solution until the intended effective date of the change. If no such solution is reached by then, the Controller is entitled to terminate the service relationship and this Agreement extraordinarily with immediate effect before the change takes effect. Fees already paid in advance shall be refunded pro rata for the period that can no longer be used following termination. An objection shall not result in any disadvantage for the Controller.

The Processor imposes on each further processor, by way of a contract, the same data protection obligations as are set out in this Agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing meets the requirements of the General Data Protection Regulation. Where a further processor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the performance of that further processor’s obligations, as for its own conduct (Art. 28(4) GDPR); the extent of that liability is governed by Section 13.

Ancillary services obtained by the Processor from third parties which are not intended to involve access to the Controller’s personal data — such as telecommunications and postal services or cleaning services — do not constitute the engagement of a further processor within the meaning of this provision. The Processor nevertheless takes appropriate precautions to protect the data in those cases as well.

Section 8 Assistance with the Rights of Data Subjects (Art. 28(3)(e) GDPR)

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the General Data Protection Regulation.

The following routes, already implemented in the application, are available to the Controller for this purpose:

• Deletion of individual images, videos, comments and reactions by the Controller and the persons it has authorised, directly through the interface (Art. 17 GDPR).
• Hiding individual items as a measure less severe than deletion, for example while processing an objection under Art. 21 GDPR.
• Complete deletion of an event including all associated records and all stored files, including derived thumbnails and uploaded logos.
• Export of the records stored in the Controller’s account via the account settings, as a structured JSON file (Art. 15 and Art. 20 GDPR). The export covers the records on the account, events, uploads, comments, reactions, authorisations, reports and the further tables held against the account; it contains the metadata of the image and video files, not the files themselves. Those are provided separately via the next route. The export alone is therefore not a complete return within the meaning of Section 10.
• Download of an event’s image material as an archive file. Where that route is not included in the scope of service booked, the Processor shall make the material available on request in text form within 14 days; the right to return under Section 10 exists irrespective of the scope of service booked.

Where a data subject contacts the Processor directly, the Processor shall forward the matter to the Controller without undue delay and shall not answer it itself, unless legally obliged to do so. Contact address of the Processor for all matters arising from this Agreement: office@gotzendorfer.at.

The assistance under this Section is included in the fee for the service. Reimbursement of expenses may be considered only for demonstrably exceptional manual effort which does not originate from the Processor’s sphere of responsibility, and only insofar as it has been agreed in advance in text form. Compliance with statutory time limits may not be made contingent upon any such agreement.

Section 9 Assistance with the Obligations under Art. 32 to 36 GDPR (Art. 28(3)(f) GDPR)

Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the General Data Protection Regulation.

Where the Processor becomes aware of a personal data breach affecting the Controller’s data, it shall notify the Controller without undue delay and in any event within 48 hours of becoming aware. The binding contact address of the Controller for notifications under this Section, for notices under Section 7 and for any other declarations arising from this Agreement is the email address held in its account; where a data protection officer contact is stated in the header of this Agreement, the notification is additionally sent to that contact. The Controller keeps both entries up to date; a change takes effect once stored in the account or, as the case may be, upon documented receipt by the Processor. The notification shall contain, where available:

1. a description of the nature of the breach, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
2. the name and contact details of a point of contact where more information can be obtained;
3. a description of the likely consequences of the breach;
4. a description of the measures taken or proposed to address the breach and, where appropriate, to mitigate its possible adverse effects.

The Processor maintains a permanently reachable point of contact for notifications under this Section and for requests under Sections 8 and 10. It has designated a deputy. In the event of unavailability, the deputy is given access to the necessary systems and information after having been bound in text form to confidentiality under Section 5; the time limits under this Agreement apply irrespective of the availability of any individual person. The point of contact is named in the preamble; the identity of the deputy is disclosed to the Controller on request.

Where not all information is available immediately, the Processor shall first notify the information available to it and supplement it without undue delay. The Processor makes clear: the 72-hour notification deadline under Art. 33(1) GDPR applies to the Controller. The notification obligation under this Section exists precisely so that the Controller is able to meet that deadline at all.

The Processor shall not make any notification to the supervisory authority or to data subjects on behalf of the Controller unless the Controller expressly instructs it to do so.

On request, the Processor assists the Controller with a data protection impact assessment pursuant to Art. 35 GDPR and with prior consultation pursuant to Art. 36 GDPR by making available the information on the processing available to it, in particular Annex 1 and Annex 2 in their respective applicable versions.

Section 10 Deletion or Return after the End of the Provision of Services (Art. 28(3)(g) GDPR)

After the end of the provision of processing services, the Processor shall, at the choice of the Controller, delete or return all personal data and delete existing copies, unless Union or Member State law requires storage of the personal data.

The Controller shall communicate its choice in text form. If it does not communicate a choice within 30 days of termination, the data shall be deleted. Deletion is the default because it is the outcome more favourable to data protection.

Routes implemented:

• Every event carries an expiry date. After expiry the content is no longer served; after a further 30 days the records and the stored files are deleted automatically.
• The Controller may delete an event itself at any time. Deletion covers the associated records across all tables involved as well as the stored files including derived thumbnails and uploaded logos.
• Where the Controller deletes its account, a period of 30 days begins during which the deletion can still be averted; thereafter the account and all associated events are permanently deleted.
• Before any deletion, the routes for return set out in Section 8 remain open to the Controller (export of account data, download of image material).

Excluded from deletion are exclusively those records which the Processor must retain on the basis of a statutory retention obligation, in particular payment and accounting records pursuant to § 132 of the Austrian Federal Fiscal Code (BAO), as well as the minimised record of the conclusion of this Agreement under Section 14. Those records concern the contractual relationship between the parties, not the content processed within the event; image and video files, comments, guest names and session identifiers are subject to no retention obligation and are deleted in full. The excluded records are restricted in processing for the duration of the retention period.

If a request for return is received in text form before the applicable deletion deadline expires, the Processor completes the return before the data concerned is finally deleted. The Processor expressly points out that this is a manually operated procedure: the automated deletion runs have no per-event suspension. It ensures the precedence of the request for return by making the data concerned available after receipt of the request or — where the remaining time is insufficient — by extending the term of the event concerned until the return is complete, but for no longer than 30 days from receipt of the request. The Controller receives confirmation in text form that the return is complete.

The Processor shall confirm the deletion in text form on request.

Section 11 Evidence and Audits (Art. 28(3)(h) GDPR)

The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

On request, the Processor shall in particular make available:

• Annex 1 and Annex 2 in their respective applicable versions;
• information on the places of processing of the further processors engaged;
• information on the status of the contracts concluded with further processors;
• information on the implementation of the measures described in Annex 2.

The following conditions apply to on-site or remote inspections. They serve to order the procedure and neither exclude nor restrict the right to audit:

• Announcement in text form with a notice period of, as a rule, 14 days. Where there is a specific reason, in particular following a personal data breach or at the request of a supervisory authority, the audit shall be enabled without undue delay and without observing that notice period.
• Conduct during usual business hours and without disproportionate disruption of operations.
• The auditor is bound to confidentiality and is not a competitor of the Processor. Any alleged conflict of interest must be substantiated by the Processor in concrete terms; the selection of a suitable independent auditor remains with the Controller.
• As a rule once per calendar year. Where there is a specific reason within the meaning of the first bullet point, that limitation does not apply.

Each party bears its own costs arising from an audit. Reimbursement of expenses may be considered only for repeated audits within a calendar year that are requested without a specific reason; it is agreed in advance in text form, is reasonable in amount, and must not impede the effective exercise of the right to audit. Audits for a specific reason, and compliance with statutory time limits, are not delayed by questions of cost or of auditor selection.

The Processor discloses the following: there is no certification pursuant to Art. 42 GDPR and no attestation under a recognised audit standard. Where other providers present such a document, the information under paragraph 2 and the description in Annex 2 take its place here. This disclosure is made expressly so that the Controller can take it into account in its selection decision under Art. 28(1) GDPR, rather than discovering it only during an audit.

Section 12 Places of Processing and Transfers to Third Countries

The places of processing are stated per further processor in Annex 1. A blanket assurance that all processing takes place exclusively within the European Union or the European Economic Area is expressly not given. This clarification is made because such an assurance would not hold true in relation to individual service providers engaged; the per-provider statement in Annex 1 is verifiable, a blanket statement would not be.

For the AI-assisted functions, the Processor engages Google LLC, United States of America, as a further processor. This concerns the automated image analysis, the suggestion of an invitation text, the suggestions offered when creating an event, and the support chat. Where image analysis is enabled, the image concerned is transmitted to Google for analysis.

The basis for the transfer is the European Commission’s adequacy decision on the EU-US Data Privacy Framework pursuant to Art. 45 GDPR; Google LLC is certified under that framework.

Should that adequacy decision or the recipient’s certification cease to apply, the Processor will base the transfer on the European Commission’s standard contractual clauses pursuant to Art. 46(2)(c) GDPR together with any necessary supplementary measures, and will inform the Controller in advance of the basis then relied upon. If no viable basis can be established, the transfer will be discontinued; in that case the function concerned ceases to be available — this Agreement does not.

The Controller may disable the event-level AI functions for its event. These are two separately switchable functions: the automated image analysis including image description and pre-selection, and the suggestion of an invitation text. Where image analysis is disabled, the uploaded images of that event are not transmitted to Google for that analysis; where the invitation text suggestion is disabled, that event’s details are not transmitted for that purpose.

The Processor expressly points out the limit of that opt-out: the event-level switches do not end every transfer of event data to Google. Two further AI-assisted functions are account-level rather than event-level — the suggestions offered when creating an event, and the support chat. A switch at event level does not reach them.

Neither processes image material. In the support chat, however, in addition to the text entered by the user, the email address of the signed-in account and, for up to five of the most recently created events, their title, plan, active state, storage used and expiry date are transmitted to Google automatically, so that the answer fits the account. The suggestion offered when creating an event concerns only the details entered there, such as an event title. Anyone wishing to exclude those transfers should not use those two functions; there is no separate switch for them.

Section 13 Liability and Limitation of Liability, Termination, Form, Governing Law

Towards data subjects, the parties are liable under Art. 82 GDPR. That liability is neither excluded nor limited by this Agreement. The following paragraphs govern exclusively the relationship as between the parties.

As between the parties, each party bears the damage for which it is responsible. Claims of one party against the other for damages or for reimbursement of expenses arising from this Agreement or from the processing of personal data on the Controller’s behalf are governed by this Section, on whatever legal basis the claim is founded — including the service relationship, tort, or the apportionment under Art. 82(5) GDPR. The liability provisions of the general terms and conditions of the service relationship do not apply to those claims. Where the parties have agreed standard contractual clauses of the European Commission, those clauses prevail in the event of a conflict.

Each party is liable without limitation for intent and gross negligence, for damage resulting from injury to life, body or health, and under the Austrian Product Liability Act (Produkthaftungsgesetz).

In cases of slight negligence, each party’s liability for all damage events of a calendar year together is limited to the higher of the following two amounts: EUR 10,000 or the sum of the fees paid, and not refunded, for the service via the Controller’s account in the twelve months preceding the first damage event of that calendar year. A damage event is attributed to the calendar year in which the event giving rise to the damage occurred. Several items of damage arising from the same cause constitute a single damage event, attributed to the calendar year of the first occurrence. Lost profit is not compensated in cases of slight negligence. The parties agree on this limitation having regard to the relationship between the fee for the service and the potential damage.

The limitation covers all damage and expenses of a damage event, however they are described, in particular costs of investigating and containing a personal data breach, of notifying the supervisory authority and notifying data subjects, of legal advice and legal proceedings and of restoring data, as well as payments to data subjects and fines. Whether any such item is recoverable at all is determined by law; this paragraph does not create any claim.

For further processors, the Processor is liable to the Controller as for its own conduct (Art. 28(4) GDPR): their fault is attributed to the Processor, and the same rules apply as for its own fault, including the limitation in cases of slight negligence. The obligations under this Agreement and its annexes are binding; they do not give rise to any liability without fault beyond what the law provides. Words such as “ensure” or “make sure” denote the respective obligation, not a guarantee.

Annex 2 discloses that there is no backup for the file store holding image and video files. Material that the Controller needs permanently or independently of the service is secured by the Controller itself using the means set out in Section 8. If it fails to do so although this was possible and reasonable for it, this is taken into account as contributory fault in the event of a loss.

Where a party is held liable by a data subject or another third party, or is fined by a supervisory authority, and intends to seek recourse against the other party for that reason, it shall notify the other party thereof without undue delay in text form and give it the opportunity to take part in the defence. An acknowledgement or settlement without the other party’s consent does not bind the other party; it may object that the claim did not exist or did not exist in that amount.

The term follows from Section 2. In addition, the Controller may terminate this Agreement and the service relationship extraordinarily with immediate effect if it objects to a change of further processors under Section 7 and no amicable solution is reached, or if the Processor seriously breaches obligations under this Agreement and fails to remedy the breach within a reasonable period despite being requested to do so.

Amendments and supplements to this Agreement require the consent of both parties in text form; this also applies to any amendment of this form requirement. Transmission by email is sufficient. Publication of an amended version together with continued use of the service is not sufficient; a deemed acceptance through continued use, as provided for in the general terms and conditions of the service relationship, does not apply to this Agreement. Updates to Annexes 1 and 2 are made in accordance with the procedure set out in Sections 6 and 7 and do not require a separate amendment of the Agreement.

Austrian law applies, excluding its conflict-of-law rules and excluding the United Nations Convention on Contracts for the International Sale of Goods. The General Data Protection Regulation and the mandatory data protection provisions to which the Controller is subject at its place of establishment remain unaffected.

Where the Controller is an entrepreneur within the meaning of the Austrian Commercial Code, the exclusive place of jurisdiction for all disputes arising from this Agreement is Vienna, Austria. Mandatory statutory places of jurisdiction remain unaffected.

Should any provision of this Agreement be or become invalid or unenforceable, the validity of the remaining provisions shall remain unaffected. This also applies within the liability provisions of this Section: the limitation to a maximum amount, the exclusion of lost profit, the rule on data backup and the rules on recourse are independent of one another. The parties shall replace the invalid provision with a valid provision that comes closest to the economic and data protection purpose of the invalid provision.

Section 14 List of Annexes

The following annexes form part of this Agreement:

1. Annex 1 — Further processors (sub-processors), stating the processing purpose, the place of processing and the basis for any transfer to a third country.
2. Annex 2 — Technical and organisational measures pursuant to Art. 32 GDPR.

Changes to Annex 1 are governed exclusively by Section 7. Equivalent or improving technical adjustments to Annex 2 are permitted; the Processor actively notifies the Controller of material changes. Neither the purpose nor the scope of the data may be extended thereby, and the agreed level of protection may not be lowered.

The Processor keeps the wording of every concludable version of this Agreement, including both annexes, unchanged and assigns it to the version identifier under which the Agreement was concluded. A later change to the text creates a new version identifier and does not replace a record of an agreement already concluded. The full record of conclusion (company details, authorised representative, data protection officer contact) is kept for as long as the Controller’s account exists; for that period the Processor will make the contract document available again in text form on request. If the Controller deletes its account, the Processor retains a minimised record — company name, country, version identifier and language version, time of conclusion and of account deletion, and a hash of the account identifier, without any personal details and without the address — and deletes it 3 years after the end of the calendar year in which the account was deleted. This record serves solely as evidence of the conclusion of this Agreement in the event of legal claims or enquiries from a supervisory authority. Anyone who needs the full contract document beyond that point should retrieve it before deleting the account.

The version of the annexes applicable at the time of conclusion, identified by its version identifier, is authoritative. It forms part of the generated contract document and is recorded in the Controller’s account together with the version identifier 2026-10-01.1. The respective current version is additionally available at any time.

Annex 1 — Further processors (sub-processors)

Version of this annex: 2026-10-01 · Version of the continuously maintained list: 2026-09-30 (/datenschutz)

The continuously maintained version of this list lives in the privacy policy. The version stated below is the one that applies to your conclusion.

Annex 2 — Technical and organisational measures pursuant to Art. 32 GDPR

Version of this annex: 2026-09-30

Every measure here is verifiable in the code. What is not built is not listed.