This page contains the Wartungshelden data processing agreement (DPA). It applies insofar as we process personal data on behalf of our customers when providing our maintenance services.
Note:
This agreement applies insofar as Wartungshelden processes personal data on behalf of the customer in the course of the commissioned services.
Data processing agreement (DPA)
between
the customer / client
– hereinafter the “controller” –
and
Wartungshelden
Reiner Schmeinck
Waltraudstraße 19
45888 Gelsenkirchen
Germany
Email: info@wartungshelden.de
Telephone: 0209 98898746
– hereinafter the “processor” –
also jointly referred to as the “parties”.
1. Subject matter and duration of processing
This agreement governs the rights and obligations of the parties in connection with the processing of personal data by the processor on behalf of the controller.
The subject matter of processing is the provision of maintenance, care, security, backup, monitoring, support and other technical services for the controller’s WordPress websites.
The duration of this agreement follows the duration of the main maintenance services contract between the parties. This DPA also ends when the main contract ends, subject to statutory retention obligations.
2. Nature and purpose of processing
The processor processes personal data exclusively for the purpose of performing the commissioned maintenance services.
Processing may include the following activities in particular:
- access to the controller’s WordPress system
- technical care and maintenance
- update management
- security checks
- malware scans
- creation of backups
- restoration of datasets
- error analysis and troubleshooting
- monitoring and technical logging
- support and administration services
The actual processing takes place only insofar as necessary to fulfil the contractually agreed services.
3. Types of personal data and categories of data subjects
The following categories of personal data in particular may be processed in the course of processing on behalf of the controller:
- master data
- contact data
- communication data
- usage data
- IP addresses
- content data
- customer data
- contract data
- technical log data
- data from databases, forms or website functions
The following persons in particular may be affected by processing:
- customers of the controller
- prospective customers of the controller
- website visitors
- employees of the controller
- contact persons
- other users of the website operated by the controller
4. Binding instructions
The processor processes personal data only on documented instructions from the controller, unless processing is required by law.
Oral instructions must be confirmed in text form without undue delay.
If the processor considers that an instruction infringes data protection law, it will inform the controller without undue delay.
5. Confidentiality
The processor ensures that all persons involved in processing personal data are bound by confidentiality or are subject to an appropriate statutory obligation of secrecy.
The confidentiality obligation continues after this agreement ends.
6. Technical and organisational measures
The processor takes appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
These measures may include in particular:
- access protection for systems and user accounts
- authorisation concepts
- two-factor authentication, where available
- encryption, where technically appropriate
- protection of administration access
- logging of technical access
- backups
- protection against unauthorised access
- measures for restorability and availability
- regular review and updating of security measures
The processor may adapt the technical and organisational measures to technical progress, provided that the level of protection is not reduced.
7. Assistance obligations
Taking account of the nature of processing and the information available to it, the processor assists the controller in fulfilling its statutory obligations.
This concerns in particular:
- assistance with requests from data subjects
- assistance with security of processing
- assistance with notifications of personal data breaches
- assistance with data protection impact assessments, where required
8. Notification of personal data breaches
The processor informs the controller without undue delay if it becomes aware of a personal data breach in connection with processing on behalf of the controller.
Where possible, the notification should contain all information the controller needs to fulfil its statutory reporting and notification obligations.
9. Sub-processors
The controller grants the processor general authorisation to engage further processors insofar as necessary to fulfil the contract.
The processor informs the controller of intended changes concerning the addition or replacement of further processors, thereby giving the controller the opportunity to object.
The processor ensures that sub-processors are contractually bound by data protection obligations that essentially correspond to the obligations set out in this agreement.
Typical sub-processors used may include in particular:
- hosting providers
- backup providers
- security and monitoring providers
- cloud providers
- email and communication services
- support and remote maintenance tools
10. Transfers to third countries
Personal data is processed in a third country or by a service provider in a third country only insofar as the statutory requirements are met.
If sub-processors or other technical service providers outside the EU or EEA are used, the processor ensures that appropriate safeguards are in place.
11. Audit rights and evidence
The controller may verify compliance with the obligations set out in this agreement to a reasonable extent, or have compliance verified by third parties.
On request, the processor provides the controller with the information necessary to demonstrate compliance with data protection obligations.
As a rule, checks must take place after reasonable prior notice, during normal business hours and without unreasonable disruption to operations.
Where evidence can be provided through appropriate documentation, audit reports, certificates or other records, these take precedence.
12. Return and deletion
After completion of the processing services, the processor must, at the controller’s choice, either delete or return all personal data, unless there is a statutory obligation to store it.
Statutory retention obligations remain unaffected.
Backup copies within normal backup and archiving processes may remain for technically necessary retention cycles and must subsequently be deleted or overwritten in compliance with data protection requirements.
13. Obligations of the controller
The controller remains responsible for the lawfulness of processing and for safeguarding the rights of data subjects.
The controller must inform the processor fully and without undue delay if it identifies errors or irregularities regarding data protection requirements.
The controller is responsible for ensuring that personal data processing on its website is lawful and that the data protection information provided to data subjects is complete and correct.
14. Liability
The parties’ liability is governed by statutory provisions and, additionally, by the provisions of the main contract concluded between the parties, insofar as these have been validly agreed.
Mandatory data protection liability provisions remain unaffected.
15. Final provisions
Amendments and additions to this agreement require at least text form.
If individual provisions of this agreement are or become invalid in whole or in part, the validity of the remaining provisions remains unaffected.
German law applies insofar as legally permissible.
This DPA applies insofar as Wartungshelden processes personal data on behalf of the customer in the course of the commissioned services. This DPA does not apply if there is no access to personal data or no processing on behalf of the controller.
Annex 1: Technical and organisational measures (TOM)
Physical access control
- protection of workplaces, devices and storage media against unauthorised physical access
System access control
- password protection
- individual user accounts
- two-factor authentication, where available
Data access control
- role-based permissions
- restriction of administrator rights to necessary persons
Transfer control
- encrypted transmission, where technically available
- use of secure communication channels
Input control
- logging of technical or administrative access, where technically possible
Processing instruction control
- clear internal processes for handling maintenance orders
- selection of suitable technical service providers
Availability control
- backup strategies
- protection against data loss
- restoration measures
Separation requirement
- separate processing by project, website or customer, where technically and organisationally feasible