Auftrags­verarbeitungsvertrag (AVV)

1. General

(1)The Contractor processes personal data on behalf of the Client within the meaning of Art. 4 No. 8 and Art. 28 of the Regulation (EU) 2016/679 - General Data Protection Regulation (GDPR). This contract regulates the rights and obligations of the parties in connection with the processing of personal data.

(2)The terms “data processing” and “processing” (of data) used in this agreement are based on the “processing” definition within the meaning of Art. 4 No. 2 GDPR.

2. Subject matter of the contract

The subject matter of the processing, the nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1 of this contract.

3. Rights and Obligations of the Client

(1)The Client is responsible within the meaning of Art. 4 No. 7 GDPR for the data processing on behalf of the Contractor. If the Contractor is of the opinion that legally inadmissible data processing is the subject of the order and/or of an instruction, the Contractor has the right to notify the Client about it within the meaning of clause 4 (5).

(2)The Client is responsible for safeguarding the rights of the data subjects. The Contractor will immediately inform the Client if data subjects approach the Contractor to assert their data subject rights relating to the data processing in accordance with the order. The notification intents to enable the Client to act as the responsible party.

(3)The Client has the right at any time to give the Contractor additional instructions about the type, scope and process of the data processing. Instructions must be given in text form (e.g. e-mail).

(4)Arrangements on any remuneration of additional work incurred by the Contractor due to additional instructions given by the Client shall remain unaffected.

Instructions required under data protection law do not represent any additional expense.

(5)The Client may appoint persons authorised to issue instructions. Insofar as persons authorised to issue instructions are to be named, they shall be named in Annex 1. In the event that the persons authorised to issue instructions change at the Client, the Client shall inform the Contractor of this in text form.

(6)If the Client identifies mistakes or irregularities in regard to the personal data processing, the Client informs the Contractor without undue delay.

(7)The Client is responsible for compliance in the event of an obligation to inform third parties pursuant to Art. 33, 34 GDPR or any other statutory notification obligation applicable to the Client.

4. General obligations of the Contractor

(1)The Contractor shall process personal data exclusively within the framework of the agreements made and/or in compliance with any supplementary instructions issued by the Client. Exceptions are legal regulations that might require the Contractor to process data in other ways. The Contractor shall notify the contracting authority of these legal requirements prior to the processing, unless the law in question prohibits such notification due to an important public interest. In all other cases, the purpose, type, and scope of data processing are in line with this agreement and/or instructions given by the Client. The Contractor is prohibited from processing data in any other way, unless the Client has agreed to this in writing (e.g. email).

(2)The Contractor undertakes to generally carry out the data processing on behalf in member states of the European Union (EU) or the European Economic Area (EEA). The processing of personal data in a non-member country is only possible if the legal requirements within the meaning of Art. 44 - 49 GDPR are respected in order to guarantee a reasonable protection level of personal data.

(3)In the area of the processing of personal data in accordance to the order, the Contractor assures the contractual processing of all agreed measures.

(4)The Contractor shall be liable to organise its company and its operating procedures in such a way that the data which it processes on behalf of the Client are secured to the extent necessary in each case and protected against unauthorised access by third parties. The Contractor shall coordinate significant changes in the organisation of the data processing on behalf of the Client which are significant for the security of the data with the Client in advance.

(5)The Contractor shall inform the Client without delay if, in its opinion, an instruction issued by the Client violates statutory regulations. The Contractor shall be entitled to suspend the implementation of the relevant instruction until it is confirmed or amended by the Client. If the Contractor can demonstrate, that processing in accordance with the Client's instructions may lead to liability on the part of the Contractor pursuant to Article 82 of the GDPR, the Contractor shall be free to suspend further processing in this respect until the liability between the parties has been clarified.

(6)The Contractor shall process the data which he processes on behalf of the Client separately from other data. Physical separation is not mandatory.

(7)The Contractor may designate to the Client the person(s) authorised to receive instructions from the Client. If persons authorised to receive instructions are to be named, they shall be named in Annex 1. In the event that the persons authorised to receive instructions change at the contractor, the contractor shall notify the Client thereof in text form.

5. Reporting obligations of the Contractor

(1)The Contractor shall be obliged to inform the Client without undue delay in textform (e.g. email) of any violation of data protection regulations or contractual agreements and/or the Client's instructions given in the course of the processing of data by him or other involved persons.

(2)Furthermore, the Contractor shall inform the Client without undue delay if a supervisory authority takes action against the Contractor pursuant to Art. 58 GDPR. This may also concern a control of the processing that the Contractor provides on behalf of the Client.

(3)The Contractor is aware that the Client may have a reporting obligation in the event of data protection violations pursuant to Art. 33, 34 DSGVO, which provides for a report to the supervisory authority within 72 hours of becoming known. The Contractor shall support the Client in implementing the reporting obligations. The Contractor shall in particular notify the Client of any unauthorised access to personal data processed on behalf of the Client without undue delay, but at the latest within 48 hours of becoming aware of the access. The Contractor’s notification to the Client shall, as far as possible, include the following information:

a description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects, the categories concerned and the approximate number of personal data records concerned;

a description of the measures taken or proposed to be taken by the Contractor to address the personal data breach and, where appropriate, measures to mitigate its possible adverse effects.

6. Obligations of the Contractor to cooperate

(1)The Contractor shall support the Client in its obligation to respond to requests for the exercise of data subject rights pursuant to Art. 12-23 GDPR. Support services that go beyond what is reasonable shall be remunerated separately by the Client. The provisions of Section 10 of this contract shall apply.

(2)The Contractor shall support the Client in complying with the obligations set out in Art. 32-36 of the GDPR, taking into account the type of processing and the information available to it. Support services that go beyond what is reasonable shall be remunerated separately by the Client.

7. Powers of control

(1)The client accepts that proof of compliance with legal and contractual obligations shall primarily be provided by submitting suitable, up-to-date attestations or certificates from independent third parties (e.g., ISO 27001).

(2)If this evidence is insufficient or there is reasonable suspicion of data protection violations, the client has the right to verify compliance with the regulations by conducting an on-site inspection during normal business hours. Such inspections must be announced in writing with reasonable notice. The contractor shall cooperate in this regard and may refuse access to competitors. The costs of the inspection and any separate remuneration for support services exceeding what is reasonable shall be borne by the client.

(3)The contractor is obliged to provide the necessary information in the event of measures taken by the supervisory authority against the client within the meaning of Art. 58 GDPR and to allow the authority to carry out an on-site inspection.

(4)The contractor shall take appropriate measures to ensure that personal data is processed in accordance with data protection regulations when working from home (e.g. through guidelines for mobile working and regular training).

8. Subcontracting relationships

(1)The Contractor shall specify all subcontractor relationships that already exist at the time of the conclusion of the contract (i.e. further processors within the meaning of Article 28 (2) GDPR) in Annex 2 to this contract. The subcontractors listed in Annex 2 shall be deemed to have been approved in advance by the Client. The Contractor shall be liable for the fault of its subcontractors as for its own fault.

(2)The use of further subcontractors or the replacement of existing subcontractors is also permissible if the Contractor informs the Client of the assignment in writing beforehand (e-mail is sufficient) and gives the Client the opportunity to object to the assignment in writing within two (2) weeks. If no objection is made within this period, the assignment shall be deemed approved by the v. The legal consequence of the fictional approval shall be pointed out to the Client upon notification.

(3)When subcontracting, the Contractor shall contractually ensure that the agreed regulations between the Client and the Contractor also apply to subcontractors, whereby in particular sufficient guarantees must be provided that the appropriate technical and organisational measures are implemented in such a way that the data processing is carried out in accordance with the requirements of data protection law.

(4)The Contractor shall carefully select the subcontractor and check that the subcontractor is able to comply with the agreements made between the Client and the Contractor before commissioning the subcontractor, within the scope of its legal and actual possibilities. The Contractor shall check that the subcontractor has taken the technical and organisational measures required under Article 32 GDPR to protect personal data.

(5)Services which the Contractor uses from third parties as a purely ancillary service in order to carry out the business activity are not to be regarded as subcontracting relationships within the meaning of paragraphs 1 to 4. This includes, for example, cleaning services, financial services, insurances, pure telecommunication services without a concrete reference to services that the Contractor provides for the Client, postal and courier services, transport services, guarding services. The Contractor shall nevertheless be obliged, also in the case of ancillary services provided by third parties, to ensure that appropriate precautions and technical and organisational measures have been taken to guarantee the protection of personal data. The maintenance and servicing of IT systems or applications constitutes a subcontracting relationship and commissioned processing within the meaning of Art. 28 GDPR if the maintenance and testing concerns IT systems that are also used in connection with the provision of services for the Client and personal data processed on behalf of the Client can be accessed during the maintenance.

9. Confidentiality obligation

(1)When processing data for the Client, the Contractor shall be obliged to maintain confidentiality about data it receives in connection with the order.

(2)The Contractor warrants that he has familiarised his employees with the data protection provisions applicable to them and has obliged them to maintain confidentiality insofar as they are not already subject to an appropriate statutory duty of confidentiality.

(3)The Contractor's employees shall be obliged to maintain confidentiality and to protect data secrecy in accordance with a separate non-disclosure agreement (NDA) with a regular expiry period of 5 years even after termination of the employment relationship.

(4)The Contractor must be able to show proof of his employees’ obligation within the meaning of paragraph 2 within a reasonable period of time.

10. Protection of data subject’s rights

(1)The Client exclusively is responsible for the protection of the data subject’s rights. The Contractor is obliged to support the Client in his responsibility to handle requests of data subjects within the meaning of Art. 12 - 23 GDPR. The Contractor especially takes care of the information communication to the Client without undue delay, in order to enable the Client to fulfil his requirements within the meaning of Art. 12 para. 3 GDPR.

(2)Insofar as the cooperation of the Contractor is necessary for the protection of data subject rights - in particular to information, correction, blocking or deletion - by the Client, the Contractor shall take the necessary measures in each case in accordance with the Client's instructions. Where possible, the Contractor shall support the Client with suitable technical and organisational measures to fulfil its obligation to respond to requests to exercise data subject rights.

(3)This shall be without prejudice to any provisions on the remuneration of additional expenses incurred by the Contractor as a result of cooperation services in connection with the assertion of data subjects' rights towards the Client.

(4)In the event that a data subject asserts his or her rights under Art. 12-23 GDPR with the Contractor, although this obviously concerns a processing of personal data for which the principal is responsible, the Contractor is entitled to inform the data subject that the Client is responsible for the data processing. In this context, the Contractor may inform the data subject of the contact details of the responsible person.

11. Confidentiality obligations

(1)Both parties agree to unlimitedly treat all the information related to the conclusion and execution of this contract confidential and to use the information only for the execution of the contract. Neither party is entitled to use this information, in whole or in part, for purposes other than those just mentioned or to make this information available to third parties, insofar as no statutory provisions entitling or obliging such processing are opposed.

(2)The obligation neither applies to information that one of the parties evidently received from a third party without being obliged to secrecy nor to publicly known information.

12. Remuneration

Regulations on the remuneration of services and support services are to be agreed upon separately between the parties.

13. Technical and organisational measures to ensure data security

(1)The Contractor guarantees to keep to the technical and organisational measures necessary to obey the data security regulations. In particular, this includes the regulations in Art. 32 GDPR.

(2)The current state of technical and organisational measures which exists at the point of signature is attached to the agreement in Annex 3. The parties agree that adjustments to the technical and legal conditions might require adjustments to the technical and organisational measures. The Contractor informs the Client in advance (e-mail is sufficient) about substantial changes that affect the integrity, confidentiality, or availability of personal data. Measures that only entail minor technical or organisational changes and do not negatively affect the integrity, confidentiality and availability of the personal data may be implemented by the Contractor without notifying the Client.

(3)The Contractor controls the implemented technical and organisational measures for effectiveness regularly and also event-related. In case of the necessity for optimisation and/or changes, the Contractor will optimise the relevant technical and organisational measures.

14. Duration of the order

(1)The contract begins upon signing and is concluded for an indefinite period.

(2)In the event of cancellation or termination of the preceding service contract (hereinafter referred to as the "main contract"), this contract shall automatically end at the same time. Isolated cancellation of this contract without simultaneous termination of the main contract is excluded.

15. Termination

(1)After termination of the contract, the Contractor shall return or delete all documents, data and processing or utilisation results created in its possession that are related to the contractual relationship to the Client. The client must be informed of the deletion or destruction in writing or in a documented electronic format, stating the date. Any statutory retention obligations or other obligations to store the data shall remain unaffected.

(2)The Contractor may store personal data that has been processed in connection with the order beyond the termination of the contract if and to the extent that the Contractor has a legal obligation to retain it. In such cases, the data may only be processed for the purpose of implementing the respective statutory retention obligations. After the expiry of the retention obligation, the data must be deleted without undue delay.

16. Final provisions

(1)Should the Client's data be jeopardised by third party measures (such as seizure or confiscation), insolvency proceedings or other events, the Contractor shall inform the Client without undue delay. The Contractor shall without undue delay inform the creditors of the fact that the data in question is being processed on behalf of the Client.

(2)Additional agreements must be made in writing (e.g. email).

(3)Should individual parts of this contract be invalid, this shall not affect the validity of the remaining provisions of the contract.

(4)The German version of this Agreement shall take precedence over the English version.

Annex 1 – Subject of the order

1. Subject, nature and purpose of processing

The Client's order to the Contractor shall include the following work and/or services:

The Contractor processes personal data in order to smoothly grant access to an online platform for order and process optimisation. The personal data is processed in order to be able to assign possible changes in the platform to individual persons who have been granted access to the platform by the Client.

2. Type(s) of personal Data

The following types of data are regularly subject to processing:

Title, first and last name, e-mail address, address, cell phone number, telephone number, fax number, comments on customer satisfaction, first and last name of the contact person, VAT ID and profile picture (optional).

3. Categories of data subject

Group of persons affected by the data processing:

Employees and customers of the Client.

Annex 2 – Subcontractor

For the processing of data on behalf of the Client, the Contractor shall use the services of third parties who process data on its behalf ("subcontractors").

These are the following companies:

Annex 3 – Technical and organisational measures of the Contractor Subcontractor

The Contractor shall take the following technical and organisational measures for data security within the meaning of Art. 32 DSGVO.

1. Confidentiality (Art. 32(1) GDPR)

A. Access control

Measures suitable for preventing unauthorised persons from gaining access to data processing systems with which personal data are processed or used.

Access control measures can be used to secure buildings and rooms include automatic access control systems, to use chip cards and transponders, to control access by gatekeepers and alarm systems. Servers, telecommunications systems, network technology and similar equipment should be protected in lockable server cabinets. In addition, it makes sense to support access control through organisational measures (e.g. service instructions that provide for the locking of service rooms during absences).

Technical measures

Automatic access control system

Manual locking system

Doors with knob outside

Organisational measures

Visitors accompanied by staff

Regular checks of access authorisations

Role-based access and minimisation of access rights

Access to the servers is controlled by the hosting provider Microsoft Azure. Information on physical security is described at the following URL:

https://learn.microsoft.com/en-us/azure/security/fundamentals/physical-security

B. Access control

Measures suitable for preventing data processing systems (computers) from being used by unauthorised persons.

Access control refers to the unauthorised prevention of the use of equipment. Possibilities are, for example, boot password, user ID with password for operating systems and software products used, screen saver with password, the use of chip cards for logging in as well as the use of call-back procedures. In addition, organisational measures may also be necessary, for example, to prevent unauthorised access (e.g. specifications for setting up screens, issuing guidance to users on how to choose a "good" password).

Technical measures

Login with username + password

Login with biometric data

Firewall

Intrusion detection systems

Encryption of data carriers

Automatic desktop lock

Encryption of notebooks / tablet

Organisational measures

Manage user permissions

Clean desk" policy

C. Access control

Measures to ensure that those authorised to use a data processing system can only access the data subject to their access authorisation and that personal data cannot be read, copied, modified or removed without authorisation during processing, use and after storage.

Access control can be ensured, among other things, through suitable authorisation concepts that enable differentiated control of access to data. In doing so, it is important to differentiate both the content of the data and the possible access functions to the data.

Furthermore, suitable control mechanisms and responsibilities must be defined in order to document the granting and withdrawal of authorisations and to keep them up to date (e.g. in case of hiring, change of job, termination of employment). Special attention must always be paid to the role and possibilities of the administrators.

Technical measures

Physical deletion of data carriers

Logging of access to applications, specifically at the time of entry, Datenverfügbarkeitmodification and deletion of data

Organisational measures

Privacy vault

Management of user rights by Administrators

Regular checks of access authorisations

Role-based access and minimisation of access rights

D. Separation control

Measures to ensure that data collected for different purposes can be processed separately.

Technical measures

Separation of productive and test environment

Physical separation (systems/databases/data carriers)

Multi-Client capability of relevant applications

Organisational measures

Control via authorisation concept

Definition of database rights

Data records are provided with purpose attributes

E. Pseudonymisation (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR)

Personal data shall be processed in such a way that the data can no longer be attributed to a specific data subject without recourse to additional information, provided that such additional information is kept separately and is subject to appropriate technical and organisational measures.

Technical measures

In case of pseudonymisation: separation of the assignment data and storage in separate and secured systems.

Organisational measures

Internal instruction to anonymise / pseudonymise personal data as far as possible in the event of transfer or after expiry of the statutory deletion period.

2. Integrity (Art. 32 para. 1 lit. b GDPR)

A. Transfer control

Measures to ensure that personal data cannot be read, copied, altered or removed by unauthorised persons during electronic transmission or during their transport or storage on data media, and that it is possible to verify and establish to which bodies personal data are intended to be transmitted by data transmission equipment.

Encryption techniques and virtual private networks can be used to ensure confidentiality in electronic data transmission. Measures to be taken while transporting or forwarding data carriers are transport containers with locking devices and regulations for data protection-compliant destruction of data media.

Technical measures

Email encryption

Provision via encrypted connections such as sftp, https

Organisational measures

Disclosure in anonymised or pseudonymised form

B. Eingabekontrolle

Measures to ensure that it is possible to check and establish retrospectively whether and by whom personal data have been entered into, modified or removed from data processing systems.

Input control is achieved through logging, which can take place on different levels (e.g. operating system, network, firewall, database, application). It must also be clarified which data is logged, who has access to logs, by whom and on what occasion/at what time these are checked, how long storage is required and when deletion of the logs takes place.

Technical measures

Technical recording of the entry, modification and deletion of data

Organisational measures

Overview of which programmes can be used to enter, change or delete which data

Traceability of entry, modification and deletion of data through individual user names (not user groups)

Allocation of rights to enter, change and delete data on the basis of an authorisation concept

Retention of forms from which data has been transferred to automated processes

3. Availability and resilience (Art. 32(1)(b) & (c) GDPR)

A. Availability control

Measures that ensure that personal data is protected against accidental destruction or loss. This includes topics such as an uninterruptible power supply, air conditioning, fire protection, data backups, safe storage of data media, virus protection, raid systems, disk mirroring, etc.

Technical measures

Fire and smoke detection systems

Organisational measures

Separate partitions for operating systems and data

Automatic backups are created at least every four hours and stored for up to seven days in a zone-redundant storage (ZRS).

Special note: Luminovo uses the services of Microsoft Azure with storage location Frankfurt. All information on the data centre, data protection and data security is described at the following URL.

https://learn.microsoft.com/en-us/azure/security/fundamentals/physical-security

4. Procedures for regular review, assessment and evaluation (Art. 32(1)(d) GDPR; Art. 25 GDPR)

A. Data protection management

Technical measures

Central documentation of all procedures and regulations on data protection with access for employees according to need / authorisation (e.g. wiki, intranet)

Organisational measures

data protection officer Naima Reß

Employees trained and committed to confidentiality/data secrecy

Regular sensitisation of employees (at least annually)

The organisation complies with the information obligations pursuant to Art. 13 and 14 GDPR

B. Incident-response-management

Support in responding to security breaches

Technical measures

Use of firewall and regular updating

Use of spam filter and regular updating

Organisational measures

Documented procedure for dealing with security incidents

Documentation of security incidents and data breaches e.g. ticket system

C. Data protection-friendly default settings (Art. 25 (2) GDPR)

Privacy by design / Privacy by default

Technical measures

No more personal data is collected than is necessary for the respective purpose

Simple exercise of the data subject's right of withdrawal through technical measures

D. Contract control (outsourcing to third parties)

Measures that ensure that personal data processed on behalf of the Client can only be processed in accordance with the Client's instructions.

In addition to data processing on behalf, this point also includes the performance of maintenance and system support services both on site and via remote maintenance. If the Contractor uses service providers in the sense of commissioned processing, the following points must always be regulated with them.

Organisational measures

Prior review of the security measures taken by the Contractor and their documentation.

Selection of the Contractor under due diligence aspects (especially with regard to data protection and data security).

Conclusion of the necessary agreement on commissioned processing with the guarantees on data transfers to third countries, if applicable.

Obligation of the Contractor to follow instructions

Obligation of the Contractor employees to maintain data secrecy

Obligation to appoint a data protection officer by the Contractor if there is an obligation to appoint one.

Agreement on effective control rights towards the Contractor

Regulation on the use of further subcontractors

Ensuring the destruction of data after termination of the contract.

In the case of longer cooperation: Ongoing review of the Contractor and its level of protection.