./legal/avv/en
Data Processing Agreement pursuant to Art. 28 GDPR
Data Processing Agreement (AVV) · orboto
Version of 5 November 2026. This is the English translation; the German version governs: Vereinbarung zur Auftragsverarbeitung. The main contract is the Terms of Service (German).
SHA-256 of the published text: b59da05c105bf5d43a46e9d8e495e13422d20752d469004bc81aed5b9c9f52b1
This English version is a convenience translation. The German version is legally binding.
between
the Licensee under the General Terms of Use Software as a Service orboto (hereinafter the "Controller")
and
Daniel Schemann, Triebelsheide 37b, 42111 Wuppertal, Germany (hereinafter the "Processor")
(together hereinafter the "Parties")
Preamble
The Parties have concluded an agreement on the use of the SaaS "orboto", including booked additional services (e-mail service, AI functions), under the General Terms of Use Software as a Service orboto (Allgemeine Nutzungsbedingungen; hereinafter the "Main Agreement"). Under clauses 7.5 and 10.2 of the Main Agreement the Processor processes personal data of the Controller exclusively on its behalf and on the basis of a separate data processing agreement. In order to specify the resulting rights and obligations under Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), the Parties conclude the following agreement.
Clause 1 Scope
(1) This agreement applies to the processing (Art. 4 (2) GDPR) of all personal data (hereinafter "data") that are the subject matter of the Main Agreement or arise in its performance and that the Processor processes on behalf of the Controller. Data of the Processor's employees are outside its scope insofar as they relate exclusively to the employment relationship with the Processor.
(2) In matters of data protection this agreement takes precedence over the Main Agreement and over other agreements and arrangements between the Parties, unless the Parties expressly agree otherwise.
Clause 2 Specification of the processing
(1) The subject matter, scope, nature and purpose of the processing follow from the Main Agreement and Annex C. This agreement applies for the term of the Main Agreement and beyond it until the end of the 90-day retention period under clause 12.3 of the Main Agreement and, insofar as data of the Controller still exist at the Processor after that, until their deletion under clause 7.
(2) The types of personal data subject to the processing follow from Annex C.
(3) The categories of data subjects follow from Annex C.
(4) The processing of special categories of personal data (Art. 9 GDPR) is not intended; the SaaS is not designed for it. As the Controller determines the content in the SaaS itself, such data may nevertheless be contained in that content. In that case this agreement and Annex B apply unchanged; the Controller assesses whether the processing is lawful.
(5) The Parties assume a normal level of protection need for the data under Annex C. Where the Controller determines a high level of protection need for its data, it informs the Processor in text form; the Parties then agree whether the measures under Annex B are sufficient.
Clause 3 Obligations and authority to issue instructions
(1) The Parties shall comply with the obligations imposed on them by data protection law, in particular the GDPR. The Controller may at any time demand the surrender, rectification, adaptation, erasure and restriction of processing of the data; the SaaS provides it with functions for access, export, rectification and erasure for this purpose.
(2) To safeguard the rights of data subjects under Chapter III GDPR, the Processor assists the Controller appropriately with suitable technical and organisational measures (Art. 28 (3) (e) GDPR).
(3) Where a data subject contacts the Processor directly to exercise a data subject right, the Processor forwards the request to the Controller without undue delay and does not answer it itself.
(4) The Processor processes data exclusively for the performance of the Main Agreement and within the documented instructions of the Controller (Art. 28 (3) sentence 2 (a) GDPR), unless it is required to process otherwise by Union or Member State law to which it is subject. In such a case it informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Instructions are initially the Main Agreement, this agreement and the settings the Controller makes in the SaaS (for example deletions, exports, retention and encryption settings). The Controller may subsequently amend, supplement or replace them by individual instructions in text form through the channels named in Annex D. Instructions are documented by both Parties.
(5) Where the Processor considers that an instruction infringes the GDPR or other data protection provisions, it informs the Controller without undue delay (Art. 28 (3) sentence 3 GDPR). It may suspend the execution of the instruction until the Controller confirms or amends it. The persons authorised to issue instructions on the Controller's side, the recipients authorised to receive instructions on the Processor's side and the communication channels are set out in Annex D.
(6) Changes to the subject matter of the processing involving changes of procedure are coordinated and documented by the Parties. The Processor announces adjustments of the SaaS under clause 1.4 of the Main Agreement with the notice period set out there; where an adjustment changes the subject matter, nature or purpose of the processing under Annex C, it offers the amended Annex C under clause 11 (1).
(7) The Processor provides information to third parties or to the data subject only with the Controller's prior express consent in text form, unless it is required to disclose by Union or Member State law.
(8) The Processor does not use the data for any other purposes and does not disclose them to third parties, unless it is required to do so by Union or Member State law; clauses 12 and 13 remain unaffected. Copies and duplicates are not made without the Controller's knowledge. Agreed with the Controller's knowledge are the backup copies under Annex B item 3 (hourly database backup, retention by plan) and the exports the Controller requests itself.
(9) The Controller maintains the record of processing activities under Art. 30 (1) GDPR. On request the Processor provides it with the information for inclusion in that record. The Processor maintains a record of all categories of processing activities carried out on behalf of the Controller under Art. 30 (2) GDPR.
(10) Processing takes place exclusively at EU providers with a data processing agreement or on own infrastructure in Germany. Processing therefore takes place exclusively within the territory of the European Union. Any transfer of data by the Processor to a third country or an international organisation takes place exclusively on the basis of a documented instruction of the Controller or to comply with a provision of Union or Member State law to which the Processor is subject, and must comply with Chapter V GDPR. The conditions for the lawfulness of the processing remain unaffected.
(11) The Processor ensures that natural persons acting under its authority who have access to data process them only on the Controller's instructions. The data are processed in the data centres of the sub-processors named in Annex A and on the own infrastructure described in Annex A. The persons engaged may access these systems also outside the Processor's premises (mobile working, home office), exclusively under the technical and organisational measures of Annex B. The Controller consents to this by concluding this agreement.
Clause 4 Compliance with mandatory statutory obligations by the Processor
(1) The Processor engages for the processing only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28 (3) sentence 2 (b) GDPR, clause 10.1 of the Main Agreement), and demonstrates this to the Controller on request. The commitment includes instruction on the restriction to instructions and to purpose that applies in this processing relationship and continues after the end of the engagement.
(2) The Parties support each other in demonstrating and documenting their accountability with regard to the principles of proper data processing, including the implementation of the necessary technical and organisational measures (Art. 5 (2), Art. 24 (1) GDPR). The Processor provides the Controller with the necessary information for this purpose where required, in particular the current Annex B.
(3) Where the Processor is legally required to designate a data protection officer, it communicates that officer's contact details to the Controller for direct contact. Irrespective of this, the Processor's contact for data protection can be reached at [email protected].
(4) The Processor informs the Controller without undue delay of inspections and measures by supervisory authorities and of any request, investigation or other enquiry by a supervisory authority at the Processor within its competence, insofar as it concerns the processing under this agreement.
Clause 5 Technical and organisational measures and their review
(1) The Parties agree on the technical and organisational measures under Art. 32 GDPR set out in Annex B. Annex B forms part of this agreement and states for each measure whether it is implemented, in implementation or not yet implemented.
(2) Where a review by the Controller shows that the measures do not reach the level of protection required under Art. 32 GDPR, the Processor implements the adjustments required to reach that level. Further adjustments are agreed separately by the Parties.
(3) Technical and organisational measures are subject to technical progress. The Processor may implement alternative adequate measures provided the security level of the measures set out in Annex B is not undercut. It documents significant changes and makes the current version of Annex B available to the Controller on request.
(4) The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this agreement and in Art. 28 GDPR (Art. 28 (3) sentence 2 (h) GDPR). It allows for and contributes to reviews in accordance with paragraphs 5 and 6 and clause 9.
(5) The review may also be carried out on the basis of current attestations or reports of sufficiently qualified and independent bodies (for example auditors, independent data protection auditors), adherence to approved codes of conduct under Art. 40 GDPR, a certification under Art. 42 GDPR or a suitable certification by IT security or data protection audit. The data centres of the sub-processors are reviewed through their own evidence. The Processor informs the Controller without undue delay of any exclusion from approved codes of conduct under Art. 41 (4) GDPR, any withdrawal of a certification under Art. 42 (7) GDPR and any other revocation or material change of the evidence provided.
(6) The Controller is in principle not entitled to access the Processor's premises or other system components (clause 10.4 of the Main Agreement). This is without prejudice to the right of the Controller's data protection officer, after written notice with reasonable lead time, to carry out reviews including on-site inspections of compliance with this agreement and of the otherwise lawful and contractual handling of data in the operation of the SaaS. Reviews take place during the service hours under clause 4.2 of the Main Agreement and must not impair operation for other customers.
(7) The Processor also provides the Controller with all information it needs for reviews under paragraph 4 and for a data protection impact assessment under Art. 35 GDPR and a prior consultation under Art. 36 GDPR.
(8) Taking into account the nature of processing and the information available to it, the Processor assists the Controller in complying with the obligations under Art. 32 to 36 GDPR and, in consultation with the Controller and taking into account the state of the art, takes all measures necessary for the security of processing and to mitigate possible adverse effects on data subjects.
Clause 6 Notification of breaches by the Processor
(1) The Processor informs the Controller without undue delay of serious disruptions of its operations, of suspected infringements of this agreement or of data protection provisions, of such infringements and of other irregularities in the processing of the Controller's data. The information is given to the Controller's responsible contact person under Annex D.
(2) The Processor notifies the Controller of a personal data breach without undue delay after becoming aware of it (Art. 33 (2) GDPR). The notification contains, as far as known, the information under Art. 33 (3) GDPR; missing information is provided as soon as it is available.
(3) Where necessary, the Processor assists the Controller appropriately with its obligations under Art. 33 and 34 GDPR. The Processor makes notifications under Art. 33 or 34 GDPR on behalf of the Controller only after a prior instruction under clause 3.
Clause 7 Deletion and return of data
(1) The data belong exclusively to the Controller (clause 7.5 of the Main Agreement). Data carriers and data sets provided remain its property.
(2) After the end of the Main Agreement the Controller may retrieve a full export of its data in the customer portal within the 90-day retention period under clause 12.3 of the Main Agreement; this constitutes the return of the data. After that period the Processor deletes all data of the Controller processed on its behalf, including processing results, copies and backup copies, unless Union or Member State law requires storage (Art. 28 (3) sentence 2 (g) GDPR). Deletion covers the instance's database, the instance's object storage and all backup archives and exports of the instance at the backup storage. On request the Processor confirms the deletion in text form and provides a deletion record.
(3) Data the Controller deletes during the term remain in the backup archives until the backup retention expires (Cloud Team 14 days, Cloud Business 30 days) and are deleted with them afterwards.
(4) The Processor may retain documentation serving as evidence of processing in accordance with the order and with proper practice beyond the end of the agreement in line with the applicable retention periods, or hand it over to the Controller at the end of the agreement. Paragraph 2 applies to the retained data once the retention period has expired.
Clause 8 Sub-processors
(1) The Controller grants the Processor general authorisation to engage other processors (sub-processors) (Art. 28 (2) GDPR). The sub-processors engaged at the conclusion of this agreement are listed in Annex A; the Controller agrees to their engagement. The Processor informs the Controller in text form at least 30 days before engaging a new sub-processor or replacing one and provides the information the Controller needs to exercise its right to object. The Controller may object to the change within that period for an important reason relating to data protection. If the Processor cannot offer a reasonable alternative, the Controller may terminate the Main Agreement with effect from the date the change takes effect.
Ancillary services that the Processor obtains from third parties to support the performance of the processing and in which the service provider obtains no access to the Controller's data, in particular pure telecommunication, transport and DNS services, are not sub-processing within the meaning of this clause. The Processor makes appropriate and lawful contractual arrangements and takes control measures for such ancillary services as well, to protect the Controller's data.
(2) The Processor designs its contractual arrangements with each sub-processor so that the level of data protection corresponds at least to this agreement and the same data protection obligations apply (Art. 28 (4) GDPR), in particular with regard to appropriate technical and organisational measures.
(3) The Processor ensures that the Controller has audit and review rights towards sub-processors corresponding to this agreement; where a sub-processor uses standardised agreements, these rights are exercised through its evidence under clause 5 (5). On request in text form the Controller receives information on the content of the data processing agreement concluded with the sub-processor and on the implementation of the sub-processor's data protection obligations contained therein.
(4) Where a sub-processor fails to fulfil its data protection obligations, the Processor remains liable to the Controller for the performance of the sub-processor's obligations. In that case the Processor, at the Controller's request, ends the engagement of the sub-processor in whole or in part or terminates the contractual relationship with it, if and insofar as this is not disproportionate.
(5) A transfer to a third country takes place only under clause 3 (10) and under the conditions of Art. 44 et seq. GDPR. Annex A names the basis for each sub-processor.
Clause 9 Data protection audit
The Processor grants the Controller's data protection officer access, for the performance of the officer's statutory tasks in connection with this processing, in accordance with clause 5 (6) and clause 10.4 of the Main Agreement during the service hours under clause 4.2 of the Main Agreement. It answers the officer's questions truthfully and completely and instructs the persons engaged to cooperate with the officer. Statutory confidentiality obligations and the confidentiality of other customers' data remain unaffected.
Clause 10 Liability and damages
Art. 82 GDPR applies to liability and the right to compensation. As between the Parties, the liability provisions of the Main Agreement (clause 11) otherwise apply.
Clause 11 Final provisions
(1) Amendments and supplements to this agreement and its annexes require text form and an express statement that they amend or supplement this agreement. Clause 13.3 of the Main Agreement (change offer in the SaaS) applies accordingly. Notices of new sub-processors under clause 8 (1) and the updating of Annex B under clause 5 (3) remain unaffected.
(2) Should individual provisions of this agreement be or become invalid or unenforceable, the validity of the remaining provisions is not affected. The invalid or unenforceable provision is replaced by the valid and enforceable provision whose effects come closest to the objective the Parties pursued with the invalid or unenforceable provision. This applies accordingly if the agreement proves to be incomplete.
(3) Place of jurisdiction and applicable law follow clauses 13.1 and 13.4 of the Main Agreement.
(4) This agreement is concluded together with the Main Agreement. By clicking the button "Kostenpflichtig Buchen" (clause 1.1 of the Main Agreement) the Controller at the same time makes its offer to conclude this agreement in the version displayed in the order process; this agreement is concluded together with the Main Agreement. The Processor records the accepted version of this agreement and of the Main Agreement together with the time of acceptance. No signature is required.
(5) This agreement is concluded in the German language. An English version is provided for information only; in case of doubt the German version prevails.
Clause 12 AI functions and anonymised analyses
(1) AI requests of the Controller are routed through the Processor's AI gateway to the AI providers named in Annex A; the search embeddings are computed by Scaleway (Annex A no. 4), and by OVHcloud (Annex A no. 7) in the event of a disruption at Scaleway. The gateway technically permits only the provider endpoints named in Annex A.
(2) Data of the Controller are used to train AI models only if the Controller has consented under clause 3.5 of the Main Agreement.
(3) Analyses under clause 7.6 of the Main Agreement are carried out only with data that have no personal reference or whose personal reference has been removed by aggregation.
Clause 13 E-mail service
Where the Controller uses the e-mail service, the Processor processes recipient addresses, sender, subject and content for delivery as well as delivery metadata. The Processor keeps block lists under clause 10.3 of the Main Agreement to prevent repeated delivery to persons who have declined or withdrawn their consent.
Annex A - Sub-processors (to clause 8)
The sub-processors engaged at the conclusion of this agreement are listed below; under clause 8 (1) the Controller agrees to their engagement. Providers no. 1 to 4, 6 and 7 are engaged through SilentFuture UG (haftungsbeschränkt) (no. 5), which concluded the contracts with them in its own name; the agreement between the Processor and the UG imposes on it, and through it on the providers, the same data protection obligations as this agreement (Art. 28 (4) GDPR).
| No. | Sub-processor (name, seat) | Date of the data processing agreement | Service within the processing | Data categories | Place of processing | Safeguards / transfer |
|---|---|---|---|---|---|---|
| 1 | STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin | Part of every contract since 18 July 2022 (current version 3.5 of 18 March 2024); last provided with the server order of 14 October 2026 (version 3.4 of 5 September 2022) All server contracts were concluded in 2026, so the DPA is part of every one of them. | Servers for the cloud instances (application and database per instance), object storage for files and attachments and dedicated backup storage | All content of the instance including uploaded files and attachments, user data, audit log, hourly database backups | Germany | EU, no third-country transfer |
| 2 | IONOS SE, Elgendorfer Straße 57, 56410 Montabaur | Part of the IONOS terms since the start of the contract (DPA at ionos.de/terms-gtc/avv) | Servers for the customer portal, control plane, e-mail service, AI gateway and the support mailbox | Account and contract data, AI requests and responses on their way to the model, usage metadata | Germany | EU, no third-country transfer |
| 3 | IONOS Cloud GmbH, Revaler Straße 30, 10245 Berlin | Part of the IONOS Cloud terms (data processing agreement for IONOS Cloud, version 7.4, as of 06/2023) | AI models in the IONOS AI Model Hub (chat, embeddings) | AI requests and responses; per the provider, content is neither logged nor used for training | Germany (IONOS Cloud data centres in Germany) | EU, no third-country transfer; no further sub-processors for the AI Model Hub per the provider |
| 4 | Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France | Part of the Scaleway contract terms (Data Processing Agreement) since the start of the contract | AI models via Scaleway Generative APIs, in particular the search embeddings (Qwen3-Embedding-8B) | Text of the instances for embeddings, AI requests and responses | France | EU, no third-country transfer |
| 5 | SilentFuture UG (haftungsbeschränkt), Triebelsheide 37b, 42111 Wuppertal | Sub-processing agreement under Art. 28(4) GDPR, effective since 13 July 2026 | Operation of the platform on behalf of and in the name of the Processor | All categories named above | Germany | EU, no third-country transfer |
| 6 | Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (Amazon SES) | Part of the AWS service terms (AWS GDPR Data Processing Addendum) since the start of the contract | Delivery of the instances' system mails (invitations, notifications, password resets) and of the e-mail service's mails | Recipient and sender address, subject and content (for delivery only), delivery metadata, bounce and complaint events | EU regions Frankfurt (primary) and Dublin (failover) | EU regions; the parent company is certified under the EU-U.S. Data Privacy Framework |
| 7 | OVH GmbH, Christophstraße 19, 50670 Köln (OVHcloud AI Endpoints) | Data processing agreement version 8.0, part of the customer contract with OVHcloud | AI models via OVHcloud AI Endpoints as the failover route for the search embeddings (Qwen3-Embedding-8B) and for individual chat models | Text of the instances for embeddings, AI requests and responses; per the provider, inputs are not stored | France (Gravelines) | EU, no third-country transfer |
Not a sub-processor: Cloudflare, Inc., San Francisco, as DNS provider resolves the domain names of the SaaS and forwards only the public website (orboto.io) and the status page. The customer portal, control plane, instances, object storage, e-mail service and support mailbox do not run through Cloudflare; Cloudflare receives no data of the Controller and is therefore not a sub-processor (clause 8 (1), ancillary services).
Not in this list: The payment service provider Polar Software, Inc. (clause 6.3 of the Main Agreement) processes the Licensee's billing and payment data as the contracting party for payment, not data from the instances; it is not a sub-processor under this agreement.
Annex B - Technical and organisational measures (to clause 5)
§ 1 Technical and organisational security measures. The Processor implements appropriate technical and organisational measures so that the processing of the data complies with the statutory requirements and the protection of the rights of data subjects is adequately ensured.
§ 2 Internal organisation. The Processor organises its internal operations so that they meet the particular requirements of data protection and in particular takes measures suited to the type of data to be protected.
§ 3 Specification of the individual measures.
(1) The following measures implementing Art. 32 GDPR are specified in detail. Status "implemented" means that the measure is effective in operation. Status "in implementation" means that the measure has been started and is not yet completed. Status "not implemented" means that the measure is missing.
(2) The procedure for regularly testing, assessing and evaluating the effectiveness of the measures is described in item 4.
(3) The Processor provides evidence under clause 5 (5) of the agreement and the current status of each measure on request.
Item 1 - Measures for pseudonymisation and encryption of personal data
| Measure | Status |
|---|---|
| Stored secrets (API keys, OAuth tokens, key material) encrypted with AES-256-GCM | implemented |
| Encrypted database volumes per instance with a key from the control plane | in implementation |
| Application-level encryption of backup archives and stored files (Enterprise feature, activated by the Controller per scope, also with a key held by the Controller); without activation the backup archives are unencrypted ZIP archives | implemented since orboto 0.204.0 (activation by the Controller) |
Item 2 - Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services
| Measure | Status |
|---|---|
| Tests run against isolated test databases in CI; the public demo workspace runs on a separate server without customer data | implemented |
| Monitoring of servers (storage, CPU, disks), AI gateway (every minute) and capacity with alerting | implemented |
Item 3 - Measures for ensuring the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident
| Measure | Status |
|---|---|
| Hourly backup of each instance's database to a separate backup server; retention Cloud Team 14 days, Cloud Business 30 days | implemented |
| Monitoring of backups with alerts on failure, absence and missing archives | implemented |
| Regular, recorded restore test (instance archive, control plane database) | in implementation |
| Contingency plan including loss of the key person | in implementation |
Item 4 - Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures
| Measure | Status |
|---|---|
| Information security management system (policies, risk assessment, internal review) | in implementation |
| Quarterly review of all operator, server, DNS and cloud accesses with a record | in implementation |
Item 5 - Measures for user identification and authorisation
| Measure | Status |
|---|---|
| Sign-in to the instance: password hash (bcrypt), two-factor authentication (TOTP, passkeys), single sign-on (OIDC, SAML), lockout after failed attempts with notification, rate limits on sign-in routes | implemented |
| Sign-in to the customer portal: Argon2id with pepper | implemented |
| Second factor for operator accounts of the control plane | in implementation |
| SSH access to servers only with personal keys, no password login (today: password login as root on four servers) | in implementation |
| Role and permission system in the instance; every API route is checked for authorisation in CI | implemented |
| AI key per instance with model allowlist and rate limiting | implemented |
| Least privilege for operator and bot accounts of the control plane (today all super_admin) | in implementation |
Item 6 - Measures for the protection of data during transmission
| Measure | Status |
|---|---|
| Transport encryption (TLS) for all external connections; the AI gateway rejects unencrypted provider endpoints and redirects | implemented |
| TLS for every transmission; signed webhooks (HMAC); signed exports with an offline verification tool; protection of outgoing requests against SSRF | implemented |
| AI requests only to approved provider endpoints in the EU or to the one host operated by the Processor in Germany (allowlist in code, fail-closed) | implemented |
Item 7 - Measures for the protection of data during storage
| Measure | Status |
|---|---|
| Each instance has its own containers, its own PostgreSQL database, its own bucket in object storage, its own prefix in backup storage with its own key and its own AI key | implemented |
Encryption of stored data: see item 1.
Item 8 - Measures for ensuring physical security of locations at which personal data are processed
| Measure | Status |
|---|---|
| Servers in data centres of STRATO and IONOS; physical security by the providers | implemented (operation); provider evidence (certificates) not yet available |
| Search embeddings run at Scaleway (Paris) under a data processing agreement since 3 October 2026 (Annex A no. 4); no own hardware in the service | implemented |
Item 9 - Measures for ensuring events logging
| Measure | Status |
|---|---|
| Tamper-evident audit log of the instance (hash chain) for administrative actions and changes; logging of every disclosure of stored credentials; forwarding to a SIEM possible | implemented |
| Audit log of the control plane with source (interface or agent) | implemented |
| Logging of root sessions on the production servers (workspace servers, backup server) | not implemented |
Item 10 - Measures for ensuring system configuration, including default configuration
| Measure | Status |
|---|---|
| Daily check for security updates, automatic installation (unattended-upgrades) | implemented |
Item 11 - Measures for internal IT and IT security governance and management
| Measure | Status |
|---|---|
| Processor control: agreements with all sub-processors, annual review | in implementation |
| Reporting channel for security vulnerabilities (security.txt, policy) | in implementation |
Information security management system: see item 4.
Item 12 - Measures for certification / assurance of processes and products
| Measure | Status |
|---|---|
| Automated checks on every change (tests, authorisation check, dependency audit) | implemented |
Certificates of the data centre providers: see item 8.
Item 13 - Measures for ensuring data minimisation
The Processor processes only the data the Controller enters in the SaaS or triggers through its functions (clause 3 (4)). Only the text needed for search embeddings is sent to the embedding model (Annex A). Analyses under clause 12 (3) are carried out only without personal reference.
Item 14 - Measures for ensuring data quality
Rectification by the Controller in the SaaS (clause 3 (1)); integrity protection through the tamper-evident audit log (item 9) and signed exports (item 6).
Item 15 - Measures for ensuring limited data retention
Backup retention per plan (item 3, clause 7 (3)); deletion of all data of the instance after the 90-day retention period following the end of the agreement (item 17, clause 7 (2)).
Item 16 - Measures for ensuring accountability
| Measure | Status |
|---|---|
| Processor's record of processing activities under Art. 30 (2) GDPR (clause 3 (9)) | in implementation |
Documentation of instructions: clause 3 (4) and Annex D. Audit logs: item 9.
Item 17 - Measures for allowing data portability and ensuring erasure
| Measure | Status |
|---|---|
| Full export in the customer portal in the orboto full-export format (ZIP archive with a manifest file, the complete records in NDJSON format and the associated files from object storage), also within 90 days after the end of the agreement | implemented |
| Deletion of the instance's database, object storage and all backup archives after the 90-day retention period | implemented |
Item 18 - Specific technical and organisational measures the Processor takes to assist the Controller
| Measure | Status |
|---|---|
| Procedure for security incidents and personal data breaches with notification to the supervisory authority within 72 hours and notification of the Controller | in implementation |
Functions for access, export, rectification and erasure to assist with data subject rights: clause 3 (1) to (3).
Annex C - Subject matter, nature and purpose of processing, types of data, data subjects (to clause 2)
Subject matter and purpose: Provision and operation of the SaaS orboto for the Controller: project and task management, documents, communication in the instance, delivery of system mails, e-mail service, AI functions, backup and export, support.
Nature of processing: Collection, storage, organisation, adaptation, retrieval, consultation, use, disclosure to recipients determined by the Controller (for example e-mail recipients), backup, erasure.
Types of personal data:
- User data: name, e-mail address, role, sign-in and session data, settings, two-factor data
- Content: tickets, comments, documents, attachments and all other content users enter in the instance, including persons named therein
- Log data: audit log, technical logs, usage and telemetry data of the instance
- E-mail data: recipient, sender, subject, content, delivery status
- AI data: requests and responses of the AI functions, embeddings of the content
Categories of data subjects: Employees and agents of the Controller (users), customers, suppliers and other contacts of the Controller whose data are entered in the instance, recipients of the Controller's e-mails.
Special categories of personal data (Art. 9 GDPR): not intended; the SaaS is not designed for them. Where the Controller nevertheless processes such data in its content, this agreement and Annex B apply unchanged (clause 2 (4)).
Protection need: normal (clause 2 (5)).
Annex D - Authority to issue instructions (to clause 3)
The Processor informs the Controller without undue delay where it considers that an instruction infringes data protection provisions, and may suspend the execution of the instruction until the Controller confirms or amends it (clause 3 (5)). The persons authorised to issue instructions, the receiving points and the communication channels are set out below.
Persons authorised to issue instructions on the Controller's side:
- the responsible contact person whom the Controller names at conclusion of the contract under clause 4.4 of the Main Agreement and may change in text form
- the administrators of the Controller's workspace, insofar as they issue instructions through settings in the SaaS (clause 3 (4))
Points authorised to receive instructions on the Processor's side:
- Data protection: [email protected]
- Operations and technical incidents: [email protected] (clause 4.1 of the Main Agreement)
Communication channels for instructions and for notices under clause 3 (5), clause 6 and clause 8 (1):
- electronically by e-mail to the addresses above or to the e-mail address of the responsible contact person
- through the customer portal
Instructions are documented by both Parties in text form; instructions given through settings in the SaaS are documented by the setting concerned and the instance's audit log. The Parties notify each other in text form without undue delay of changes to the persons authorised to issue instructions, the receiving points and the communication channels.